Skip to content

Retire finite Go1.27.2 bootstrap with accepted-base policy proof - #203

Merged
intel352 merged 5 commits into
mainfrom
fix/policytool-go1272-promote-20261009
Oct 10, 2026
Merged

intel352 merged 5 commits into
mainfrom
fix/policytool-go1272-promote-20261009

Conversation

@intel352

@intel352 intel352 commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Normal CI still used the finite PR201/first-main bootstrap, so every later PR failed TestActualAcceptedPolicyBootstrap even after canonical policy restoration. This retires that one-shot admission while retaining the required test, complete SDK/source receipt and all 14 real hostile controls.

The proof anchors accepted main d85f44c7 and its complete 257-file inventory, binds the actual event-selected accepted base to the candidate, checks immutable synthetic merge headers/tree independently of shallow traversal, and builds only the accepted-base checker. Candidate policy maps remain inert. The trust cleanup promotes the proven Go1.27.2 CI context; CI, canonical workflow, SDK authentication and all 47 authority files are unchanged from the reviewed promotion candidate.

Validation at exact head 9db2e992c5f75b21a1fc9303c1adc9bc8d00ff48:

  • Normal CI38028790891: all 12 test steps, unfiltered race/vet, full shell fixtures, complete v3 receipt and 14 real controls passed. The actual merge is c85703da, with ordered parents acceptedA/candidateR and the candidate tree.
  • Canonical policy38028791052: all 9 steps passed using trusted acceptedA and inert candidateR under Go1.27.2.
  • All 8 checks and 5 actual workflow runs passed, including CodeQL actions analysis and typed IaC conformance. Two independent exact-source reviews passed.

Strict policy+test and review count1 remain enforced. The previous finite-bootstrap failure and first source review's shallow-parent blocker are retained as historical evidence; neither was waived. Merge/accepted-main proof and release remain subsequent gates.

Rebind the existing draft to accepted d85f44c while preserving its ancestry.
Promote only the proven CI context and update its owning inventory guard.
Retain the finite normal bootstrap; no retirement or merge authority.
@intel352 intel352 changed the title Promote staged Go1.27.2 CI trust after PR201 Retire finite Go1.27.2 bootstrap with accepted-base policy proof Oct 10, 2026
@intel352
intel352 marked this pull request as ready for review October 10, 2026 10:11
@intel352
intel352 merged commit 435a02d into main Oct 10, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant