base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Complete audit remediation and verification

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-01 21:18:07 +00:00
parent d368bb32f9
commit 67963102d9
7 changed files with 117 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
docs/roadmap/interfaces.md
View File

@@ -3,7 +3,8 @@
## Status and scope
Audit completed against source commit `3f00ad2` on 2026-11-01. The findings below
remain open for consideration. This audit changes documentation only.
are resolved as recorded in their completion markers. The audit itself changed
documentation only.
The review covered exported declarations and conversions in both public
facades; candidate capture, validation, callbacks, and publication outcomes;
@@ -46,7 +47,10 @@ an architectural redesign.
### 1. Build source inspection loses cancellation identity
**Priority:** medium. **Status:** open.
**Priority:** medium. **Status:** complete.
**Completion evidence:** `28a4144`: synchronized cancellation, deadline,
partial-artifact, and race checks pass.
**Relevant code:** `cleanSource`, `gitCommit`, and `checkVersion` in
[internal/build/build.go](../../internal/build/build.go), reached through public
@@ -81,7 +85,10 @@ error type or cancellation policy.
### 2. A release lookup can produce an unusable asset handle without an error
**Priority:** low. **Status:** open.
**Priority:** low. **Status:** complete.
**Completion evidence:** `9fa4407`: backend and public page-only/prebuilt
regressions pass with malformed-handle classification.
**Relevant interfaces:** `forge.Backend.FindRelease` and `ListAssets` in
[internal/forge/forge.go](../../internal/forge/forge.go); Gitea `FindRelease`,
@@ -117,7 +124,10 @@ page URLs or write-response fields on page-only reads.
### 3. Dependency preparation uses a different repository anchor
**Priority:** low; contract clarification needed. **Status:** open.
**Priority:** low; contract clarification needed. **Status:** complete.
**Completion evidence:** `b47202a`, `5aba4c6`, `abbab3c`: checkout discovery,
standalone preparation, and build-composition regressions pass.
**Relevant API:** `DependencyPreparationRequest` and `PrepareBuildDependencies`
in [preparation.go](../../preparation.go), compared with `Build`, `Check`, and
@@ -153,7 +163,10 @@ to remove standalone directory preparation.
### 4. Empty-prebuilt GoDoc omits the required source identity
**Priority:** low. **Status:** open.
**Priority:** low. **Status:** complete.
**Completion evidence:** `d368bb3`: GoDoc and consumer guidance describe
matching empty results; page-only regressions pass.
**Relevant API:** `DeliveryRequest` in [delivery.go](../../delivery.go),
`validateBuildIdentity` in
@@ -181,7 +194,10 @@ and consumer guide without adding a zero-result compatibility path.
### 5. Prebuilt delivery guidance promises hashing before every hosted request
**Priority:** low. **Status:** open.
**Priority:** low. **Status:** complete.
**Completion evidence:** `d368bb3`: consumer guidance matches preflight-first
order; the existing preflight-before-hashing regression passes.
**Relevant documentation:** the prebuilt paragraph in the
[Go API delivery guidance](../consumers/delivery.md#go-api), compared with
@@ -227,8 +243,8 @@ preflight continues to verify the available access evidence, and
`SourceVerified` continues to describe source observations rather than an
attestation.
Address the cancellation error chain and asset-handle failure classification
first, then align the preparation and delivery descriptions with the selected
behavior. The findings do not call for new public extension interfaces,
The remediation addresses the cancellation error chain and asset-handle failure
classification and aligns preparation and delivery descriptions with the selected
behavior. The findings did not call for new public extension interfaces,
compatibility shims, stricter page-only response requirements, or a new release
procedure.