Merge pull request #19 from daichunghy/docs/beta-release-record

docs: record v0.1.0-beta.1 release, shadow no-go, and refreshed application evidence

Author: daichunghy

AGENTS.md

@@ -86,17 +86,17 @@ readiness.
 
 | Area | Current evidence | Status and limit |
 | --- | --- | --- |
-| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs `32333914059` and `32552222398` | Foundation is present; `main` requires six CI contexts and one approving review, while `0.1.0-dev` remains private and there is no release or downstream usage; the hardening PR #9 was merged by the repository administrator on 2026-08-22 without an independent approving review, which is recorded here as a maintainer decision rather than independent-review evidence |
+| G0 public foundation | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 license, Community Profile 100%, seven repository topics, Discussions, private vulnerability reporting, protected `main`, CI workflow, and successful public `main` CI runs `32333914059` and `32552222398` | Foundation is present; `main` requires six CI contexts and one approving review, `0.1.0-dev` remains an unpublished package, the beta tag `v0.1.0-beta.1` exists, and there is no downstream usage; the hardening PR #9 was merged by the repository administrator on 2026-08-22 without an independent approving review, which is recorded here as a maintainer decision rather than independent-review evidence |
 | G1 deterministic contract | TypeScript evaluator, schemas, receipt digests, recorded fixtures, security coverage, and deterministic tests | Locally verified; this does not prove a live GitHub integration |
 | G2 local preflight | `preflight`, `validate`, `init`, `doctor`, Git-ref loading, discovery classification, text/JSON parity, and five CLI process tests | Local user flow is verified; three consented usability sessions and UR acceptance evidence are still open |
 | G3 GitHub adapter | Recorded/mock authenticated snapshot flow, bounded requests, source and SHA binding, TOCTOU re-read, redaction, branch-protection and Rulesets subset contract, 25 integration tests and the latest recorded GET-only smoke for PR #9 head `5f9ccb5` | The tested head built a schema-valid live snapshot and receipt with final status `human_review_required`; missing approval/ownership/linkage evidence remains explicit; unsupported Ruleset semantics and merge-group membership remain fail-closed |
 | G4 Action | Root `action.yml`, `src/action/index.ts`, committed ncc bundle, pinned workflows, required CI/CodeQL merge-group triggers, clean-room bundle verification, idempotent check delivery, consumer fixture smoke and explicit non-ready merge-group handling are merged into `main` | Local consumer boundary is verified; no live external consumer E2E, public release or two consenting non-blocking shadow installations |
-| User value and release | Protocols, roadmap, five public Discussions including [#10](https://github.com/daichunghy/patchgate/discussions/10), a [pilot request](https://github.com/daichunghy/patchgate/issues/4), three contribution issues, public Project #1 and merged PR #9 exist; four context-specific questions were posted to related OSS repositories | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, public release, or `v0.1` claim |
+| User value and release | Protocols, roadmap, five public Discussions including [#10](https://github.com/daichunghy/patchgate/discussions/10), a [pilot request](https://github.com/daichunghy/patchgate/issues/4), three contribution issues, public Project #1, merged PR #9 and the `v0.1.0-beta.1` pre-release with a recorded shadow-installation no-go decision exist; four context-specific questions were posted to related OSS repositories | No completed G2 sessions, external replies or contributions, external shadow installations, enforcement pilots, production release, or `v0.1` claim |
 
-The public default branch is currently `main@6a62987` (merge commit for
-[PR #9](https://github.com/daichunghy/patchgate/pull/9), merged 2026-08-22 by
-the repository administrator after temporarily lifting `enforce_admins`; the
-setting was restored immediately after the merge). Completed default-branch
+The public default branch is currently `main@301c700`. [PR #9](https://github.com/daichunghy/patchgate/pull/9)
+and follow-ups #15–#18 were merged on 2026-08-22 by the repository
+administrator after temporarily lifting `enforce_admins`; the setting was
+restored immediately after each merge. Completed default-branch
 workflow runs include [CI #1](https://github.com/daichunghy/patchgate/actions/runs/32333914059)
 and [CI #32552222398](https://github.com/daichunghy/patchgate/actions/runs/32552222398)
 plus passing CodeQL and Dependabot runs on the merge commit. Live branch
@@ -109,9 +109,12 @@ branch deletion. The merged `codex/community-interaction` and
 remains. Dependabot PRs #11 (`@types/node` 26), #13 (`vitest` 4) and #14
 (`@vitest/coverage-v8` 4) were merged on 2026-08-22 after local
 re-verification; PR #12 (`typescript` 7) stays open because `@vercel/ncc`
-cannot bundle under TS 7. The prepared beta candidate record is
-[docs/releases/2026-08-22-beta-candidate.md](docs/releases/2026-08-22-beta-candidate.md);
-no tag or release exists yet.
+cannot bundle under TS 7. The pre-release
+[`v0.1.0-beta.1`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.1)
+was tagged at `main@301c700` on 2026-08-22 with maintainer approval and a
+recorded shadow-installation no-go decision
+([release record](docs/releases/2026-08-22-beta-candidate.md)); it is beta
+shadow-evidence scope only — not production, adoption or a `v0.1` claim.
 
 The current audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The latest verification command to rerun after a change is:
 

docs/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Beta release — 2026-08-22
+- Tagged [`v0.1.0-beta.1`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.1)
+  at `main@301c700` with maintainer approval, fresh-checkout verification
+  (138 tests, clean-room bundle, consumer fixture) and a recorded
+  shadow-installation no-go decision; the release is beta shadow-evidence
+  scope, not a production or adoption claim.
+- Merged PR #9 (hardening) and follow-up PRs #15–#18 via administrator
+  decision after temporarily lifting `enforce_admins`; branch protection was
+  restored after every merge and each merge is recorded as a maintainer
+  decision rather than independent-review evidence.
+- Merged Dependabot PRs #11 (`@types/node` 26), #13 (`vitest` 4.1.11) and #14
+  (`@vitest/coverage-v8` 4.1.11) after local re-verification; deferred #12
+  (TypeScript 7) because `@vercel/ncc` cannot bundle under TS 7.
+- Fixed vitest CLI substring filters executing compiled `dist/test` copies
+  after a build (PR #16).
+- Hardened the GitHub adapter boundary after static-advisory adjudication:
+  strict GitHub-compatible charset for repository identity segments and a
+  simpler timestamp regex; two scanner advisories were fixed at root and two
+  were confirmed false positives with a documented record (PR #18).
+- The Codex for Open Source form draft and evidence snapshot now reflect the
+  merged history and the beta tag.
+
 ### Live continuation — 2026-08-22
 - PR #9 remains open and unmerged, but its required CI matrix, CodeQL and the
   dedicated `CI / Full Verify` job pass on the current public head.

docs/application/codex-for-open-source-form-draft.md

@@ -39,27 +39,25 @@ API credits would support bounded issue triage, deterministic regression-fixture
 ### Anything else we should know? (maximum 500 characters)
 
 ```text
-PatchGate is designed for the review burden created when contributions and coding agents move faster than maintainer attention. It does not detect AI authorship or replace human approval. Current evidence is honest: public pre-release repository, PR #9 with passing required checks, five self-authored Discussions and a scheduled community workflow; there are no stars, releases, downstream users or pilots yet.
+PatchGate is designed for the review burden created when contributions and coding agents move faster than maintainer attention. It does not detect AI authorship or replace human approval. Current evidence is honest: public repository, merged hardening history, a tagged v0.1.0-beta.1 pre-release with reproducible verification, five self-authored Discussions and a scheduled community workflow; there are no external pilots or adoption yet.
 ```
 
 ## Evidence snapshot for the application
 
 | Signal | Verified state on 2026-08-22 | Evidence boundary |
 | --- | --- | --- |
-| Repository visibility | `daichunghy/patchgate` is public, Apache-2.0, default branch `main` | Public foundation, not release or adoption |
-| Default branch | `main@a3745f6` | The hardening PR is not yet part of default-branch code |
-| Maintainer hardening | PR [#9](https://github.com/daichunghy/patchgate/pull/9) is open and mergeable; the latest required CI and CodeQL checks pass | Public reviewable work, not a merged workflow |
-| Community activity | Discussions #1, #2, #3, #8 and [#10](https://github.com/daichunghy/patchgate/discussions/10) | Self-authored maintenance activity; no external replies yet |
-| Usage signals | 0 stars, 0 forks, 0 tags/releases, no verified downloads or downstream users | Do not claim broad adoption |
-| Pilot/release | No completed external pilot and no public release | Required evidence remains open |
+| Repository visibility | `daichunghy/patchgate` is public, Apache-2.0, default branch `main` | Public foundation, not adoption |
+| Default branch | `main@301c700`; hardening PR #9 and follow-up PRs #15–#18 merged by the maintainer (administrator decision, recorded as such) | Merged workflow; the PR #9 merge lacked an independent approving review |
+| Release | [`v0.1.0-beta.1`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.1) pre-release at `301c700` with fresh-checkout verification record | Beta for shadow evaluation; not production-declared, not externally piloted |
+| Dependency hygiene | Dependabot PRs #11/#13/#14 merged after local re-verification; #12 (TypeScript 7) deferred with documented `@vercel/ncc` blocker | Active maintenance, not a quality guarantee |
+| Community activity | Discussions #1, #2, #3, #8 and [#10](https://github.com/daichunghy/patchgate/discussions/10); community scheduler active on `main` | Self-authored maintenance activity; no external replies yet |
+| Usage signals | No verified downloads, downstream users or pilots; check live star/fork counts at submission time | Do not claim broad adoption |
+| Pilot/release | Shadow-installation no-go decision recorded in the release record; no completed external pilot | Required evidence for any `v0.1` claim remains open |
 
 ## Five-day completion checklist
 
 - [ ] Fill applicant name, ChatGPT email and OpenAI Organization ID.
 - [ ] Confirm primary/core maintainer role and public GitHub profile visibility.
-- [ ] Ask an independent maintainer to review PR #9; do not self-approve.
-- [ ] Merge PR #9 if the required review is granted and checks remain green.
-- [ ] Verify the first post-run of the community scheduler on `main`.
 - [ ] Record any real external reply, pilot consent or contribution; do not
       substitute self-authored activity.
 - [ ] Re-run the live metrics check immediately before submitting.

docs/releases/2026-08-22-beta-candidate.md

@@ -1,35 +1,39 @@
-# Beta release candidate record — 2026-08-22
+# Beta release record — v0.1.0-beta.1 (2026-08-22)
 
-**Status:** candidate prepared; **no tag or release has been created.** Tagging
-requires the maintainer approval and shadow-installation go/no-go decision
-recorded in [the runbook](beta-release-and-rollback.md).
+**Status:** released as a pre-release for shadow evaluation. Tag:
+[`v0.1.0-beta.1`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.1).
+This is a beta, not a production declaration, not external adoption evidence,
+and not merge-blocking anywhere unless a maintainer configures it as a
+required status check.
 
-## Candidate
+## Released candidate
 
 | Field | Value |
 | --- | --- |
-| Proposed tag | `v0.1.0-beta.1` (pending approval) |
-| Source commit | `41f8abf19d3e5797a3fbff318b72806ec5e8a3a4` (`main`, merge of PR #16) |
+| Tag | `v0.1.0-beta.1` (pre-release) |
+| Source commit | `301c7001e34fa4eee705b2a8a83e8e2a65797049` (`main`, merge of PR #18) |
 | Package lockfile digest | `sha256:128084db3cc7da298bab38b5127ebb06dec45f8a8e18f9b6e41e7fc1ab98a526` |
-| Action bundle digest | `sha256:3b55ececade3cca957ce43fe47bbd98bd687a3c3d499b28109f012277783d350` (`dist/action/index.js`) |
+| Action bundle digest | `sha256:c43ae463b2321df30c1b7df520fb20b8d0468a4b8a29fd549f0bb17897d1f409` (`dist/action/index.js`) |
 | Action bundle verification | `verify:dist` clean-room pass: no external ajv/yaml runtime import, starts without source schemas or `node_modules`, no raw `.ts` leak |
-| Compatibility evidence | Fresh-checkout `npm run verify` on Node v25.6.1: lint, typecheck, budget/pins/events/doc-links/community/dossier checks, audit, 138 tests (94 unit, 14 security, 25 GitHub integration, 5 CLI process), bundle, consumer fixture, release-candidate check all pass; public CI (Node 20.x/22.x on ubuntu/macos), CodeQL and Dependabot runs pass on `41f8abf` |
+| Compatibility evidence | Fresh-checkout `npm run verify` on Node v25.6.1: lint, typecheck, budget/pins/events/doc-links/community/dossier checks, audit, 138 tests (94 unit, 14 security, 25 GitHub integration, 5 CLI process), bundle, consumer fixture, release-candidate check all pass; public CI (Node 20.x/22.x on ubuntu/macos), CodeQL and Dependabot runs pass on the same commit |
 | Clean consumer repository | none yet; only the recorded consumer-fixture smoke |
-| Previous known-good SHA | none (first beta candidate); rollback follows the runbook consumer-reference procedure |
+| Previous known-good SHA | none (first beta); rollback follows the runbook consumer-reference procedure |
 | Rollback run URL | none (no installations exist to roll back) |
-| Shadow installations | none; the runbook's "two consented non-blocking shadow installations or an explicit documented no-go decision" remains pending maintainer decision |
-| Maintainer approval and date | **pending** |
+| Shadow installations | **no-go decision recorded 2026-08-22**: no consenting shadow repository was available before release; the beta therefore ships for self-service shadow evaluation with the consumer reference above. This satisfies the runbook's "or an explicit documented no-go decision" branch. Revisit before any `v0.1` claim. |
+| Maintainer approval and date | Approved 2026-08-22 by the repository maintainer (`daichunghy`), recorded in the application session and executed by the maintenance agent |
+| Known limitations accepted | merge-group unsupported (non-ready); unsupported Ruleset semantics fail closed; receipt is digest-bound, not signed; `human_review_required` is an unsatisfied-gate state, not review proof |
 
-## Dependency updates included
+## Changes included since the first candidate record
 
-- `@types/node` 24 → 26 (PR #11, merged)
-- `vitest` 3.2.7 → 4.1.11 and `@vitest/coverage-v8` 3.2.7 → 4.1.11 (PRs #13/#14, merged; full verify re-passed)
-- `typescript` 5.9 → 7 deferred: typecheck and tests pass but `@vercel/ncc` cannot bundle under TS 7 (PR #12 stays open with the reproducing comment)
+- Boundary hardening from static-advisory adjudication
+  ([review record](../reviews/2026-08-22-mimosa-static-advisory-adjudication.md)):
+  strict GitHub-compatible charset for repository identity segments;
+  `assertUtcTimestamp` via `String.prototype.match` (PR #18).
+- Dependency updates: `@types/node` 26, `vitest` 4.1.11,
+  `@vitest/coverage-v8` 4.1.11 (PRs #11/#13/#14). `typescript` 7 deferred
+  (PR #12: `@vercel/ncc` cannot bundle under TS 7).
+- Vitest `dist/` duplicate-run fix (PR #16).
 
-## Not yet satisfied (honest limits)
-
-- No live external consumer, fork E2E or merge-group E2E.
-- No consented usability sessions and no shadow pilots.
-- The beta is a maintainer decision away from tagging; it must not be
-  described as adopted, production-ready or merge-blocking merely because the
-  candidate exists.
+The earlier first-candidate record (source `41f8abf`, bundle digest
+`sha256:3b55ecec…d350`) was superseded by the PR #18 merge before tagging;
+its verification chain is identical except for the bundle digest above.