Add fastlane keychain password - #4
Merged
Merged
Conversation
nasirky
approved these changes
Nov 29, 2023
grafele
added a commit
that referenced
this pull request
Aug 5, 2026
…the identifiers
Moving all of it out went too far. The WI now carries the technical shape at process level and Annex B
only what it alone holds.
Back in the WI:
§1.2 when observation happens — the four points in time, what each asks, and which record it
produces. With the dependency drawn: stage #3 produces the document stage #4 reads, stage #4
produces the records stage #7 reconciles.
§6.2 the maintenance window grid, drawn. A finding reported between two windows falls due in the
second one, and a missed window does not move the grid.
§7.1 the steps inside the two automated stages, in order, because the order is what makes them
auditable: an unlisted artefact stops the run before anything is scanned, an image is recorded
by its digest rather than the tag that was requested, and the deployed version comes from the
deployment record rather than from the newest tag.
§7.2 which build produces evidence — candidate, staging, branch, and what each may be used as.
Still no file name, script name or configuration key in the WI: those are Annex B's job and repeating
them in a controlled document means two places to update.
Annex B went from 1195 to 356 lines. Nine of its sixteen sections had become duplicates of WI sections
after the restructure — classification, deadlines, what carries the deadline, currency, escalation,
roles, the overview, the limitations, the review items. Two documents stating the same rule is how they
drift apart, so those are gone and what remains is the reference: which script does what, which files a
run produces, the three files a project owns, the configuration keys with their defaults, the object
store prefixes, the `quickbird:` properties recorded in the document, and the implementation limits.
Annex A's cross-references pointed at the old numbering and are remapped to the WI.
139 tests, 5 against live feeds.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
grafele
added a commit
that referenced
this pull request
Aug 6, 2026
…ot an orphan Analysing the twelve "matches no component" records on a real product showed the message lumped three different situations together: four records named images that sat fully scanned in the same document — the join matched record.package against component names only, and image artifacts are named after the candidate id, not the image. Records now also match on the scanned reference (quickbird:scan:target), so keycloak finds quay.io/keycloak/keycloak and the approval lands on the artifact component. two records named things the build ships in a DIFFERENT version family — wireguard approved as 1.0.20241014 with 1.0.20210914 deployed, node approved as 24.x with 22.x live. That is approval drift, not a stale record, and it now gets its own count, its own metadata property in the evidence document, and a message that names both versions (WI §7 #4 review event). the genuinely absent ones remain orphans. 162 tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
grafele
added a commit
that referenced
this pull request
Aug 6, 2026
Three places, matching the three consumers: the component itself carries quickbird:soup:approval-drift — whoever opens the document at the component must not have to hunt the metadata to learn that an approval exists and does not cover this version; the PDF renders the mismatches as their own red section next to the orphans, one line per record with both versions; the dated monitor record carries the result of the approval check per scanned target (matched / orphaned / version_mismatch) — WI §7.1 stage #4 step 5 names that check, and the record is its evidence, so a log line nobody retains was not enough. Verified against the real product document: the drift lands on the deployed wireguard image (approved 1.0.20241014, shipped 1.0.20210914), both node binaries and their images, and the three Dart-side records. 162 tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.