Skip to content

v3.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 18:55
v3.1.0
7d337c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3.1.0

Released 2026-07-07.

A verifiability feature release. Task completion now produces a sealed,
content-addressed proof of what passed, not just a status line, and that proof
verifies with the same audit chain that seals everything else.

Verification evidence bundles (#2362)

"Done" used to be a status plus scattered logs that died with the worktree. Now
every completed task that declares evidence producers emits a verification
evidence bundle:

  • Evidence producers (test command, coverage, lint, an optional screenshot or
    recording command for web-facing work) are declared in the task spec and run
    at gate time. Required producers gate completion; advisory producers attach a
    failure record without blocking.
  • Bundle outputs are content-addressed, stored under a size-capped store with
    garbage collection, referenced from the task lineage record, and sealed by a
    new audit-chain event. Media evidence flows through the existing content
    credentials support.
  • Sealing runs at task completion and is fail-open: a task that declares no
    producers is untouched, and any error while sealing is logged and swallowed so
    it can never block or fail a completion.
  • bernstein evidence show <task> renders a bundle. bernstein audit verify
    now covers bundle integrity, so a tampered evidence file is detected exactly
    like a tampered chain entry, naming the file that broke.
  • Deterministic producers replay to byte-identical bundle hashes, signatures,
    and journal anchors.
  • Generated pull-request bodies link the sealed bundle: the bernstein pr path,
    the orchestrator auto-PR path, and the issue-to-PR path each emit an evidence
    summary when a bundle is present and are unchanged when it is absent.

Reliability

  • Eliminated the order-dependent shard flakiness in the unit suite: the worker
    installs its terminating-signal handler before the PID file exists (so a
    signal in that window cannot leave a stale file for a later test), and
    retry-budget marker matching is anchored on token boundaries to remove a
    cross-test leak. (#2341)

Housekeeping

  • Resolved the open refurb idiom warnings across the recently shipped
    interop, orchestration, and security modules; behavior unchanged.
  • Removed the expired one-shot Scorecard 90-day self-resolve workflow now that
    the repository has passed the threshold and its tracking checkpoint is closed.
  • Routine toolchain and action updates (uv, setup-uv, harden-runner, and
    frontend dependency digests).
Assets 4
Loading