diff --git a/docs/application/codex-for-open-source-evidence-dossier.md b/docs/application/codex-for-open-source-evidence-dossier.md index d0d246f..34ae231 100644 --- a/docs/application/codex-for-open-source-evidence-dossier.md +++ b/docs/application/codex-for-open-source-evidence-dossier.md @@ -1,7 +1,7 @@ # Codex for Open Source evidence dossier **Status:** preparation only; not submitted and not an approval claim -**Date:** 2026-08-22 +**Date:** 2026-08-23 **Project:** PatchGate ## Purpose @@ -18,9 +18,9 @@ and the program terms linked from that application. | Program signal | Evidence currently available | Strength | Missing before submission | | --- | --- | --- | --- | -| Public active open-source project | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 `LICENSE`, community files, CI definitions, public Project #1, merged hardening PR #9 (administrator merge, not independent review) and a [successful public `main` CI run](https://github.com/daichunghy/patchgate/actions/runs/32333914059); `package.json` remains private | public foundation, pre-release | independent review, public release | -| Meaningful usage or ecosystem importance | Product rationale, threat model, five self-authored Discussions including [#10](https://github.com/daichunghy/patchgate/discussions/10), a requirements question and context-specific questions on four related OSS repositories; no verified downstream users or pilots. Pre-release tags `v0.1.0-beta.1` (superseded) and `v0.1.0-beta.2` exist — re-check live star/fork counts at submission time | ecosystem relevance hypothesis, not usage evidence | public release, real users/pilots, independent maintainer responses and concrete ecosystem references | -| Active maintenance | Public Git history, current implementation, security review, deterministic verification, protected `main`, contribution issues, public Project #1, merged PR #9 and follow-ups, and passing required checks are recorded | public pre-release maintainer activity | merged external contributions, independent review and external pilots | +| Public active open-source project | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 `LICENSE`, community files, CI definitions, public Project #1, merged hardening PR #9 (administrator merge, not independent review), the public [`v0.1.0-beta.5` Action release](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5), and successful public `main` CI | public beta foundation | independent review and external pilot | +| Meaningful usage or ecosystem importance | Product rationale, threat model, public Discussions, targeted ecosystem questions, 1 GitHub star and 0 forks at the live check; no verified downstream users, pilots or external maintainer endorsements | ecosystem relevance hypothesis, not usage evidence | real users/pilots, independent maintainer responses and concrete ecosystem references | +| Active maintenance | Public Git history, current implementation, security review, deterministic verification, protected `main`, contribution issues, public Project #1, current beta release and passing required checks | public maintainer activity | merged external contributions, independent review and external pilots | | Maintainer role | Repository is public under `daichunghy/patchgate`; the application still requires the maintainer to state the role explicitly | partially verified | final applicant identity/role confirmation | | Security and quality | Local verification passes; no high-severity npm audit findings; security boundary and fail-closed tests exist; protected `main`, public PR checks, CodeQL, Security Audit and Full Verify runs are observable; current PR head passed an authorized GET-only live smoke | local/fixture plus public PR and live snapshot evidence | independent review/merge, post-merge default-branch verification and external review | | Codex use case | Clear fit for PR review-readiness, triage, security review and release maintenance | documented | explain concrete day-to-day workflow after publication | @@ -37,10 +37,10 @@ It does not prove meaningful usage, broad adoption, external maintainer support or a completed pilot. The four outbound comments are outreach attempts, not responses or endorsements. Self-authored Discussions, a Project board and a scheduled-post workflow must not be counted as independent community activity. -The current public repository has no verified downloads, downstream users or -external pilots. Pre-release tags `v0.1.0-beta.1` (superseded) and -`v0.1.0-beta.2` exist; they are not adoption evidence. Re-check live star/fork -counts at submission time. +The current public repository has no verified downstream users or external +pilots. The current Action release is `v0.1.0-beta.5`; it is still shadow-only +and is not adoption evidence. Re-check live star/fork counts at submission +time. The correct application claim is therefore: “PatchGate has a public, security-conscious pre-release maintenance workflow and is seeking its first diff --git a/docs/application/codex-for-open-source-form-draft.md b/docs/application/codex-for-open-source-form-draft.md index dac8ebc..84fd810 100644 --- a/docs/application/codex-for-open-source-form-draft.md +++ b/docs/application/codex-for-open-source-form-draft.md @@ -1,7 +1,7 @@ # Codex for Open Source form draft **Status:** ready for applicant completion; not submitted and not an approval claim -**Last reviewed:** 2026-08-22 +**Last reviewed:** 2026-08-23 **Official form:** https://openai.com/form/codex-for-oss/ This is a copy-ready draft for the current OpenAI form. The form asks for the @@ -27,7 +27,7 @@ OpenAI Organization ID: [FILL BEFORE SUBMISSION] ### Why does this repository qualify? (maximum 500 characters) ```text -PatchGate is an Apache-2.0 review-readiness gate: trusted policy, commit-bound checks, ownership and human boundaries before a PR consumes review time. Public pre-release CLI/Action, security model, documented shadow path. 0 GitHub stars, no npm package (name taken), no external pilots (2026-08-22). Applying on ecosystem importance, not adoption. +PatchGate is an Apache-2.0 review-readiness gate: trusted policy, commit-bound checks, ownership and human boundaries before a PR consumes review time. Public beta Action, security model, documented shadow path. 1 GitHub star, 0 forks, no npm package (name taken), no external pilots (2026-08-23). Applying on ecosystem importance, not adoption. ``` ### How will you use API credits for your project? (maximum 500 characters) @@ -39,7 +39,7 @@ API credits would support bounded issue triage, deterministic regression-fixture ### Anything else we should know? (maximum 500 characters) ```text -PatchGate addresses review burden when contributions move faster than maintainer attention. It does not detect AI authorship or replace human approval. Checkable evidence: public Apache-2.0 repo, v0.1.0-beta.2 shadow tag, CI on main, SECURITY.md. Discussions and issues are self-authored maintenance, not community adoption. No external pilots. +PatchGate addresses review burden when contributions move faster than maintainer attention. It does not detect AI authorship or replace human approval. Checkable evidence: public Apache-2.0 repo, v0.1.0-beta.5 shadow tag, CI on main, SECURITY.md. Discussions and issues are self-authored maintenance, not community adoption. No external pilots. ``` ## Evidence snapshot for the application @@ -47,8 +47,8 @@ PatchGate addresses review burden when contributions move faster than maintainer | Signal | Verified state on 2026-08-22 | Evidence boundary | | --- | --- | --- | | Repository visibility | `daichunghy/patchgate` is public, Apache-2.0, default branch `main` | Public foundation, not adoption | -| Default branch | `main@6db56a4`; hardening PR #9, follow-ups #15–#18, and #26 merged by the maintainer (administrator decisions, recorded as such) | Merged workflow; those merges lacked an independent approving review | -| Release | Recommended tag [`v0.1.0-beta.2`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.2) at `edab0ec`; `v0.1.0-beta.1` is superseded because Action inputs were unreadable on real runners | Beta for shadow evaluation; not production-declared, not externally piloted | +| Default branch | Current `main@34d998b`; hardening PR #9, follow-ups and current beta5 release merged by the maintainer (administrator decisions, recorded as such) | Merged workflow; those merges lack independent approving review | +| Release | Current tag [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) at `34d998b`; earlier beta tags are superseded | Beta for shadow evaluation; not production-declared, not externally piloted | | Dependency hygiene | Dependabot PRs #11/#13/#14 merged after local re-verification; #12 (TypeScript 7) deferred with documented `@vercel/ncc` blocker | Active maintenance, not a quality guarantee | | Community activity | Discussions #1, #2, #3, #8 and [#10](https://github.com/daichunghy/patchgate/discussions/10); community scheduler active on `main` | Self-authored maintenance activity; no external replies yet | | Usage signals | No verified downloads, downstream users or pilots; check live star/fork counts at submission time | Do not claim broad adoption | diff --git a/docs/application/constitution-readiness-matrix.md b/docs/application/constitution-readiness-matrix.md index e07917d..7f929da 100644 --- a/docs/application/constitution-readiness-matrix.md +++ b/docs/application/constitution-readiness-matrix.md @@ -1,7 +1,7 @@ # Constitution and release-readiness matrix **Status:** current operational snapshot; preparation evidence only -**Reviewed:** 2026-08-22 +**Reviewed:** 2026-08-23 This matrix maps the constitution and roadmap gates to the strongest evidence currently available. It is intentionally conservative: a local test or public @@ -17,7 +17,7 @@ PR does not become a release, pilot or adoption claim. | G3 authenticated snapshot | Partial | Bounded GET-only live smoke on PR #9, schema-valid input/receipt, base/head binding, branch-protection and supported Rulesets subset | Post-merge default-branch smoke, complete merge-group contract and external consumer evidence | | G4 shadow Action | Partial | Root `action.yml`, committed bundle, pinned workflows, explicit permissions, clean-room consumer fixture, shadow and rollback runbooks | Two consenting external shadow installations, fork E2E and live merge-group E2E | | G5 enforcement | Open | Adversarial tests and fail-closed native-control behavior exist | Shadow evidence review, explicit maintainer consent, performance/abuse evidence and enforcement decision | -| G6 public beta | Open | Release-candidate checker, rollback runbook, and tagged `v0.1.0-beta.2` (shadow-evidence only; `v0.1.0-beta.1` superseded) | Clean external consumer install, upgrade/downgrade/rollback proof, production-ready release | +| G6 public beta | Partial | Release-candidate checker, rollback runbook, and tagged `v0.1.0-beta.5` (shadow-evidence only) | Clean external consumer install, upgrade/downgrade/rollback proof, production-ready release | | G7 diverse pilots | Open | Pilot brief, consent-safe feedback template and installation runbook | Two different public repositories with consented shadow/enforcement evidence and feedback-driven fixes | | G8 `v0.1` and application | Open | Evidence dossier, form draft, maintainer workflow and this matrix | All constitutional gates, `v0.1.0`, pilot links, applicant fields and manual submission | @@ -48,8 +48,8 @@ The consent-safe outreach drafts are in scheduler state. 3. Run only consented G2/shadow sessions and record raw evidence; do not count self-authored Discussions as adoption. -4. Decide whether beta publication is authorized and execute the rollback test - before creating a release. +4. Treat beta5 as shadow-only, execute the rollback test, and record the result + before any stable release decision. 5. Fill the applicant identity fields, refresh live links, and submit the official form manually. Selection is not guaranteed by this preparation. diff --git a/docs/application/evidence-index.md b/docs/application/evidence-index.md index 0650344..59e8777 100644 --- a/docs/application/evidence-index.md +++ b/docs/application/evidence-index.md @@ -1,7 +1,7 @@ # Codex for Open Source evidence index **Status:** preparation only; this index does not claim eligibility or selection. -**Last reviewed:** 2026-08-22 +**Last reviewed:** 2026-08-23 This index separates public maintenance evidence from usage, adoption and pilot evidence. The distinction matters because self-authored activity is not the @@ -11,12 +11,12 @@ same as independent community use. | Signal | Current evidence | What it supports | What it does not prove | | --- | --- | --- | --- | -| Public open-source foundation | [Repository](https://github.com/daichunghy/patchgate), Apache-2.0 license, public Discussions, protected `main` and [default-branch CI](https://github.com/daichunghy/patchgate/actions/runs/32333914059) | Public pre-release project | Release, adoption or selection | +| Public open-source foundation | [Repository](https://github.com/daichunghy/patchgate), Apache-2.0 license, public Discussions, protected `main`, [default-branch CI](https://github.com/daichunghy/patchgate/actions/runs/32333914059), and public [`v0.1.0-beta.5` Action release](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) | Public beta project | Adoption or selection | | Active maintenance | [Discussions](https://github.com/daichunghy/patchgate/discussions), [issues #4–#7](https://github.com/daichunghy/patchgate/issues), [public Project](https://github.com/users/daichunghy/projects/1), merged [PR #9](https://github.com/daichunghy/patchgate/pull/9) (administrator decision) and passing required checks | Ongoing maintainer work and contribution routing | Independent review or merged external contributions | | Technical quality | [G4/G0 audit](../reviews/2026-08-20-g4-g0-audit.md), deterministic fixtures, security tests, passing PR checks and `npm run verify` | Reproducible technical quality evidence | Default-branch production reliability | | Live integration boundary | [G3 live smoke record](../reviews/2026-08-20-g3-live-smoke.md) reached PR head `5f9ccb5` with 24 bounded GET requests, built a schema-valid snapshot and receipt, and reported the actual missing approval/ownership/linkage evidence | Authenticated live read-only snapshot path and native branch-protection coverage | A released Action, external adoption, or a ready result on a PR that still lacks its required human gates | | Ecosystem research | Context-specific questions to Policy Bot, Danger, Reviewdog and Zizmor | Relevant ecosystem questions | Replies, endorsement or downstream use | -| Usage and adoption | No verified downloads, downstream users or pilots; pre-release tags `v0.1.0-beta.1` (superseded) and [`v0.1.0-beta.2`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.2) exist. Re-check live star/fork counts at submission time | Open gap | Meaningful usage | +| Usage and adoption | 1 GitHub star, 0 forks at the live check; no verified downstream users, external pilots or independent maintainer endorsements | Open gap | Meaningful usage | ## Evidence rules @@ -34,7 +34,7 @@ same as independent community use. 1. An independent maintainer review of the current `main` history (hardening PR #9 is already merged by the administrator). 2. One immutable public beta with a clean install and rollback path - (`v0.1.0-beta.2` is shadow-evidence scope only). + (`v0.1.0-beta.5` remains shadow-evidence scope only). 3. Three consented G2 usability sessions with raw task observations. 4. Two consented non-blocking shadow pilots in different public repositories. 5. At least one independent maintainer response, contribution or pilot change