Skip to content

PHCT v1.9.0-rc.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@crypticpy crypticpy released this 22 Aug 21:29
v1.9.0-rc.2
bb2e447
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PHCT v1.9.0-rc.2

PHCT v1.9.0-rc.2 is the corrected, audited release candidate for the wider-demo validation. It is not the stable release or a BCHC organizational handoff.

  • Full commit: bb2e44714969d261ce77860ddd27af8c5d9626d0
  • Git tree: 2e4815abed84626524e119d8625e5509d3eed84f
  • Stable rollback point: v1.8.1
  • Supersedes: v1.9.0-rc.1, retained only as immutable failure evidence

Change summary

  • Adds the protected, ownership-aware PHCT-to-deployment updater, immutable version lock, exact-toolchain verification, and the full release-readiness system introduced in rc.1.
  • Fixes workflow-file publication with a dedicated, repository-scoped PHCT_UPDATE_TOKEN while leaving routine content automation on its narrower credential.
  • Detects workflow changes and fails with actionable setup guidance when the required credential is absent.
  • Keeps the workflow-capable credential out of checkout, dependency installation, generation, verification, candidate processes, and candidate-controlled Git hooks.
  • Transfers the verified downstream commit through a digest-checked Git bundle into a fresh publication runner that never checks out or executes the candidate.

Security and compatibility

  • Exact npm and Bundler advisory audits, CodeQL, dependency-license review, security-exception validation, CycloneDX generation, browser/accessibility checks, and performance/scale gates passed on this exact commit.
  • The publication runner receives PHCT_UPDATE_TOKEN only after bundle integrity and exact commit matching succeed. The token is stored in neither the remote URL nor Git configuration.
  • The tested support ceiling is 100 entries. The 500- and 1,000-entry fixtures remain characterization evidence, not a support claim.
  • The downstream updater protects BCHC identity, governance, schema, content, media, naming, and demo configuration with before/after checksums.

BCHC candidate procedure

  1. In BCHC, run Actions → Update from PHCT with exact release v1.9.0-rc.2.
  2. Confirm the generated pull request records this parent commit, the verified downstream commit, the publication bundle digest, and the previous lock.
  3. Review the protected-path checksum report, generated-file changes, preview artifact, migrations, and every downstream check.
  4. Keep the candidate pull request unmerged until wider-demo review and rollback evidence are complete.

Rollback

Before the downstream candidate merges, close its pull request and delete the machine branch; the published BCHC site remains unchanged at its current lock. If an update is later merged, revert that merge through a normal reviewed pull request. Never rewrite main or move this tag.

Evidence

Assets 3
Loading