Skip to content

Submit a Launch v1.5.0

Choose a tag to compare

View all tags
@programmable-infra programmable-infra released this 14 Aug 01:07
Immutable release. Only release title and notes can be modified.
v1.5.0
b4d5c74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Version 1.5.0 makes the repository-owned launch policy the single authored source for Programmable-specific admission
requirements. The policy, reviewer, Workflow Canary, generated documentation, and integrity checks now bind the same
exact policy identity and stable Rule IDs.

What changed

  • Added the canonical policy/launch-policy.v1.json contract and generated, digest-bound public projections.
  • Added a policy-bound deterministic reviewer that cannot accept private analyzer requirements.
  • Added the one-file hidden Workflow Canary for testing the GitHub application handoff without creating a launch,
    Registry entry, audit claim, public route, or permission to use real funds.
  • Added primitives for short-lived, signed, audience-bound hidden Canary eligibility. The repository does not claim that
    a Website signer, replay or revocation service, or production Website integration has been deployed.
  • Added a repository ownership manifest that closes the reviewed file inventory, admission entrypoints, import graph,
    Rule-ID handlers, generated projections, and frozen vendor boundary.
  • Added a release integrity gate that requires package.json, the root lockfile projections, Registry config, and the
    current history snapshot to agree on version 1.5.0 and verifies every released Registry history snapshot by exact
    bytes.
  • Added the append-only Registry history snapshot for 1.5.0. Project records and their Registry digest are unchanged.

Compatibility and authority

The receipt-bound Hookbuilder v0.5.1 validator and existing six-file legacy V2 intake remain unchanged compatibility
paths. They do not satisfy Workflow Canary, hidden Website eligibility, or production launch authority.

The canonical policy remains version 1.1 and existing v1 schemas retain their versions. The production-launch
profile remains disabled, and this release cannot emit LAUNCH_APPROVED. Passing checks is not an audit, deployment,
public availability, funds authorization, or launch approval.

Verify locally

Use Node.js 24 or newer:

npm ci --ignore-scripts
npm test
Assets 3
Loading