v4.8.0 — safety kernel
Full entry: CHANGELOG.md § [4.8.0]. This file records release evidence and the upgrade note.
Upgrade note — read before upgrading
| Change |
Effect on you |
| Missing Python 3.10+ now BLOCKS a commit with staged changes |
Previously the FR-12 secret scan silently did not run and FR-07 printed a warning and committed. If you commit on a host without Python 3.10+, install it. --no-verify is not the answer. The hook tries python3, then python, then py -3 before refusing. |
fusebase-flow-verify.yml no longer runs on push/PR |
.github/ ships with the template. Ordinary pushes now run no CI; run it with workflow_dispatch. Release coverage is unchanged. |
What shipped
| Area |
Item |
| Security |
FR-07 protected-path approvals now authorize by populated paths (MAJOR 11) |
| Security |
Missing-interpreter fail-closed contract (MAJOR 12) |
| Release integrity |
Publication bound to the verified SHA, not the tag name (B2) |
| Harness honesty |
Skipped discriminator is a non-pass (B4); watchdog rc 124/137 labelled, not conflated with crashes (MAJOR 7) |
| Recovery |
Predicate 32 exercises the production write path, not mirror parity (B3) |
| Tests |
One additive minimal-PATH fixture replaces two host-dependent masks; causally constrained mutation discriminator; changed-phase rows 66 → 101 |
Release evidence
| Item |
Value |
| Branch verification |
run 31451240122, SHA 1227652 — verify-linux + verify-windows-msys + verify-gate GREEN |
| Tag verification |
the v4.8.0 tag run is the authoritative gate; a local run is never release evidence |
| Local full suite |
929/929 PASS (developer evidence only) |
Known residuals
Carried deliberately, each with a roadmap slice in docs/specs/msys-hardening-roadmap/roadmap.md:
pre-commit:20 exits 0 when git is unresolvable — decided (A2), not yet built.- A resolved
python3 skips the ≥3.10 probe the fallbacks must pass.
preflight.sh skips Python checks silently when Python is absent.- Nothing here authenticates git or the interpreter. Under the locked same-principal model a caller
controlling PATH can still supply a shim; Flow has no trust root and no signing seam.
