Skip to content

v0.1.0-beta.3 — determinism, contract and first-run hardening

Pre-release
Pre-release

Choose a tag to compare

View all tags
@daichunghy daichunghy released this 22 Aug 20:26
v0.1.0-beta.3
a22812b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.0-beta.3 consolidates the multi-persona review fixes and first-run improvements on top of beta.2. It supersedes v0.1.0-beta.2 as the pinned reference for shadow evaluation.

What changed since beta.2

  • Determinism: five adapter collection sorts that used localeCompare now use a locale-independent code-unit comparator; positional requirement IDs (codeowners.N, native.*.check.N) and native-control digests are reproducible across runtimes with different ICU collation.
  • Receipt contract: receipts now include nativeControls when present, so decisionInputDigest is recomputable from the receipt alone; the receipt schema accepts any semantic-version-shaped evaluatorVersion instead of pinning one build, so future version bumps no longer self-invalidate.
  • CLI parity: evaluate and github snapshot accept --fail-on with the same five levels and precedence semantics as the Action (default blocked); root help documents --json and --fail-on.
  • First-run experience: init writes a fully commented draft policy and supports .github/patchgate.yml; local doctor/preflight accept the .github/ policy location with the same root-first order as the live adapter; preflight resolves Git refs without --repo; an honest clone-first install path is documented (the npm patchgate name is taken by an unrelated package — a scoped package name decision is pending).
  • Action hardening: summary/check-run cell content is HTML-encoded against markup breakout; rejected snapshots now post a neutral rejection Check Run when create-check-run: true.
  • Policy-change detection matches the loaded policy source identity, so a nested policy path is flagged without manual duplication.

Full record: docs/reviews/2026-08-22-multi-persona-review.md, docs/reviews/2026-08-22-live-smoke-findings.md, docs/CHANGELOG.md.

Consumer reference (shadow, non-blocking)

- name: PatchGate beta shadow gate
  uses: daichunghy/patchgate@a22812b6b802a31786a9607648b978031bd82e7b
  with:
    fail-on: never
    create-check-run: true
    github-token: ${{ github.token }}

Pin to this full commit SHA. With github.token the evaluation fails closed with GITHUB_PROVENANCE_AMBIGUOUS (native-control visibility needs a PAT or GitHub App token with administration: read); a rejected snapshot posts a neutral rejection Check Run and exits 0 under fail-on: never.

Verification

Fresh-checkout npm run verify at the tagged commit: lint, typecheck, budget/pin/event/doc-link/community/dossier checks, audit (0 vulnerabilities), full test suites (unit, security, GitHub integration, CLI process incl. --fail-on precedence cases), clean-room action bundle, consumer fixture and release-candidate checks all pass; public CI, CodeQL and Dependabot runs pass on the same commit. Maintainer smoke repository: daichunghy/patchgate-beta-smoke.

Beta status unchanged: pre-release for shadow evaluation; not production-declared, not externally piloted, and blocks merges only where a maintainer configures it as a required status check with an expected-source setting.

Assets 2
Loading