feat: gate Production lifecycle on acceptance evidence - #11
Merged
Conversation
- Split the summary policy binding into acceptance_policy_sha256 (pinned private acceptance policy digest) and lifecycle_policy_sha256 so the two authorities cannot be collapsed into one field. - Replace the free-form condition inventory with a closed qualification contract: campaign contract/outcome digests, a task-condition inventory digest, and a zero excluded-trial count. - Domain-separate the target release and artifact inventory digests so a digest cannot be replayed across targets or claim scopes. - Accept millisecond UTC retention timestamps, matching the canonical form the private acceptance certificate records; refuse any other precision. - Apply minimum_trials_per_condition to observed trials, and keep the policy floor of three on required trials per condition. - Keep governed-repair model calls informational while refusing any healthy-path model call through the failure taxonomy. - Keep this PR mechanism-only: restore the profile README and keep Capture's public label Experimental (the Beta relabel stays in draft PR #10 until the final evidence lands). All Production memberships and admission lists remain empty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
abrichr
marked this pull request as ready for review
August 19, 2026 21:38
abrichr
added a commit
to OpenAdaptAI/openadapt-ops
that referenced
this pull request
Aug 19, 2026
OpenAdaptAI/.github#11 merged as d60445b. Move source_commit and every pinned input URL from the pre-merge branch head 6d882bd to the merged commit, and re-render the projection. All eight pinned digests are byte-identical across the squash merge, so only the commit-bound URLs change. Re-rendered and validated against the live pinned commit: the canonical validator reports 0 active admissions and all seven targets project latest_admission null with empty history. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
abrichr
added a commit
to OpenAdaptAI/openadapt-ops
that referenced
this pull request
Aug 19, 2026
* feat: render Production lifecycle from the signed registry - Pin the canonical organization-profile commit and the SHA-256 of every lifecycle input (policy, admissions, registry, schemas, validator) in production-lifecycle-source.json. - Add a deterministic renderer that fetches those exact bytes, refuses any digest or URL drift, runs the pinned canonical validator, and only then writes the remote-safe projection docs/production-lifecycle.json. - The projection derives Production from the latest signed admission at read time. It stores no static Production flag, no fallback to an older release, and currently no admissions: every target renders with an empty admission history, so no visible lifecycle label or claim changes. - Document the admission contract in docs/reference/production-lifecycle.md and register the page in the reference nav. - Gate drift in CI: a new workflow re-renders with --check on pull requests, main pushes, manual dispatch, and a daily schedule, and files a durable issue on scheduled failure; the committed projection is also checked network-free by the test suite that ci.yml and the deploy pipeline already run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: repin the lifecycle source to merged org-profile main OpenAdaptAI/.github#11 merged as d60445b. Move source_commit and every pinned input URL from the pre-merge branch head 6d882bd to the merged commit, and re-render the projection. All eight pinned digests are byte-identical across the squash merge, so only the commit-bound URLs change. Re-rendered and validated against the live pinned commit: the canonical validator reports 0 active admissions and all seven targets project latest_admission null with empty history. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Productionto the machine lifecycle vocabulary without assigning it to any repository or public surfacedocs.openadapt.aiacceptance_policy_sha256(pinned private acceptance-policy digest) andlifecycle_policy_sha256, so the two authorities cannot be collapsed into one fieldminimum_trials_per_conditionapplied to observed trials, and a floor of three required trials per conditionCurrent state
All Production memberships and admissions are empty. This PR is mechanism-only: it does not promote a component, does not change any visible lifecycle label, and does not change public product copy.
profile/README.mdis byte-identical tomain, and Capture keeps its Experimental label here.Public/private boundary
The lifecycle registry never publishes the private Cloud acceptance certificate or its location. The protected private verifier checks that artifact. The public attested summary carries only its schema, digest, and signer-provenance digest. A private Cloud deployment publishes only an opaque release identity and digests.
Coordination
This PR starts from exact
.githubmain4f81ac3768689e0bfa812721cb61871e13d5de07. Draft PR #10 carries the Capture Experimental-to-Beta relabel and the quickstart fix; that visible label change stays out of this PR and ships only with the final evidence, per the one-visible-change-at-the-end decision. After this mechanism merges, rebase #10.The policy names the target protected Evals authority workflow
.github/workflows/production-lifecycle-evidence.yml. That workflow must land with the final reviewed evidence exporter before any admission can exist.Validation
python3 -m unittest discover -s tests -p 'test_*.py'— 40 passedpython3 scripts/validate_production_lifecycle.py— 0 active admissionspython3 scripts/validate_production_lifecycle.py --previous-admissions <main ledger>— rollback gate passespython3 scripts/check_profile.py— 36 linksruff checkandruff format --checkactionlint .github/workflows/profile-consistency.ymlgit diff --check🤖 Generated with Claude Code