daichunghy · daichunghy · Aug 23, 2026 · Aug 23, 2026
@@ -1,7 +1,7 @@
 # Codex for Open Source evidence dossier
 
 **Status:** preparation only; not submitted and not an approval claim  
-**Date:** 2026-08-22
+**Date:** 2026-08-23
 **Project:** PatchGate
 
 ## Purpose
@@ -18,9 +18,9 @@ and the program terms linked from that application.
 
 | Program signal | Evidence currently available | Strength | Missing before submission |
 | --- | --- | --- | --- |
-| Public active open-source project | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 `LICENSE`, community files, CI definitions, public Project #1, merged hardening PR #9 (administrator merge, not independent review) and a [successful public `main` CI run](https://github.com/daichunghy/patchgate/actions/runs/32333914059); `package.json` remains private | public foundation, pre-release | independent review, public release |
-| Meaningful usage or ecosystem importance | Product rationale, threat model, five self-authored Discussions including [#10](https://github.com/daichunghy/patchgate/discussions/10), a requirements question and context-specific questions on four related OSS repositories; no verified downstream users or pilots. Pre-release tags `v0.1.0-beta.1` (superseded) and `v0.1.0-beta.2` exist — re-check live star/fork counts at submission time | ecosystem relevance hypothesis, not usage evidence | public release, real users/pilots, independent maintainer responses and concrete ecosystem references |
-| Active maintenance | Public Git history, current implementation, security review, deterministic verification, protected `main`, contribution issues, public Project #1, merged PR #9 and follow-ups, and passing required checks are recorded | public pre-release maintainer activity | merged external contributions, independent review and external pilots |
+| Public active open-source project | Public repository `https://github.com/daichunghy/patchgate`, Apache-2.0 `LICENSE`, community files, CI definitions, public Project #1, merged hardening PR #9 (administrator merge, not independent review), the public [`v0.1.0-beta.5` Action release](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5), and successful public `main` CI | public beta foundation | independent review and external pilot |
+| Meaningful usage or ecosystem importance | Product rationale, threat model, public Discussions, targeted ecosystem questions, 1 GitHub star and 0 forks at the live check; no verified downstream users, pilots or external maintainer endorsements | ecosystem relevance hypothesis, not usage evidence | real users/pilots, independent maintainer responses and concrete ecosystem references |
+| Active maintenance | Public Git history, current implementation, security review, deterministic verification, protected `main`, contribution issues, public Project #1, current beta release and passing required checks | public maintainer activity | merged external contributions, independent review and external pilots |
 | Maintainer role | Repository is public under `daichunghy/patchgate`; the application still requires the maintainer to state the role explicitly | partially verified | final applicant identity/role confirmation |
 | Security and quality | Local verification passes; no high-severity npm audit findings; security boundary and fail-closed tests exist; protected `main`, public PR checks, CodeQL, Security Audit and Full Verify runs are observable; current PR head passed an authorized GET-only live smoke | local/fixture plus public PR and live snapshot evidence | independent review/merge, post-merge default-branch verification and external review |
 | Codex use case | Clear fit for PR review-readiness, triage, security review and release maintenance | documented | explain concrete day-to-day workflow after publication |
@@ -37,10 +37,10 @@ It does not prove meaningful usage, broad adoption, external maintainer support
 or a completed pilot. The four outbound comments are outreach attempts, not
 responses or endorsements. Self-authored Discussions, a Project board and a
 scheduled-post workflow must not be counted as independent community activity.
-The current public repository has no verified downloads, downstream users or
-external pilots. Pre-release tags `v0.1.0-beta.1` (superseded) and
-`v0.1.0-beta.2` exist; they are not adoption evidence. Re-check live star/fork
-counts at submission time.
+The current public repository has no verified downstream users or external
+pilots. The current Action release is `v0.1.0-beta.5`; it is still shadow-only
+and is not adoption evidence. Re-check live star/fork counts at submission
+time.
 
 The correct application claim is therefore: “PatchGate has a public,
 security-conscious pre-release maintenance workflow and is seeking its first

@@ -1,7 +1,7 @@
 # Codex for Open Source form draft
 
 **Status:** ready for applicant completion; not submitted and not an approval claim
-**Last reviewed:** 2026-08-22
+**Last reviewed:** 2026-08-23
 **Official form:** https://openai.com/form/codex-for-oss/
 
 This is a copy-ready draft for the current OpenAI form. The form asks for the
@@ -27,7 +27,7 @@ OpenAI Organization ID: [FILL BEFORE SUBMISSION]
 ### Why does this repository qualify? (maximum 500 characters)
 
 ```text
-PatchGate is an Apache-2.0 review-readiness gate: trusted policy, commit-bound checks, ownership and human boundaries before a PR consumes review time. Public pre-release CLI/Action, security model, documented shadow path. 0 GitHub stars, no npm package (name taken), no external pilots (2026-08-22). Applying on ecosystem importance, not adoption.
+PatchGate is an Apache-2.0 review-readiness gate: trusted policy, commit-bound checks, ownership and human boundaries before a PR consumes review time. Public beta Action, security model, documented shadow path. 1 GitHub star, 0 forks, no npm package (name taken), no external pilots (2026-08-23). Applying on ecosystem importance, not adoption.
 ```
 
 ### How will you use API credits for your project? (maximum 500 characters)
@@ -39,16 +39,16 @@ API credits would support bounded issue triage, deterministic regression-fixture
 ### Anything else we should know? (maximum 500 characters)
 
 ```text
-PatchGate addresses review burden when contributions move faster than maintainer attention. It does not detect AI authorship or replace human approval. Checkable evidence: public Apache-2.0 repo, v0.1.0-beta.2 shadow tag, CI on main, SECURITY.md. Discussions and issues are self-authored maintenance, not community adoption. No external pilots.
+PatchGate addresses review burden when contributions move faster than maintainer attention. It does not detect AI authorship or replace human approval. Checkable evidence: public Apache-2.0 repo, v0.1.0-beta.5 shadow tag, CI on main, SECURITY.md. Discussions and issues are self-authored maintenance, not community adoption. No external pilots.
 ```
 
 ## Evidence snapshot for the application
 
 | Signal | Verified state on 2026-08-22 | Evidence boundary |
 | --- | --- | --- |
 | Repository visibility | `daichunghy/patchgate` is public, Apache-2.0, default branch `main` | Public foundation, not adoption |
-| Default branch | `main@6db56a4`; hardening PR #9, follow-ups #15–#18, and #26 merged by the maintainer (administrator decisions, recorded as such) | Merged workflow; those merges lacked an independent approving review |
-| Release | Recommended tag [`v0.1.0-beta.2`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.2) at `edab0ec`; `v0.1.0-beta.1` is superseded because Action inputs were unreadable on real runners | Beta for shadow evaluation; not production-declared, not externally piloted |
+| Default branch | Current `main@34d998b`; hardening PR #9, follow-ups and current beta5 release merged by the maintainer (administrator decisions, recorded as such) | Merged workflow; those merges lack independent approving review |
+| Release | Current tag [`v0.1.0-beta.5`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) at `34d998b`; earlier beta tags are superseded | Beta for shadow evaluation; not production-declared, not externally piloted |
 | Dependency hygiene | Dependabot PRs #11/#13/#14 merged after local re-verification; #12 (TypeScript 7) deferred with documented `@vercel/ncc` blocker | Active maintenance, not a quality guarantee |
 | Community activity | Discussions #1, #2, #3, #8 and [#10](https://github.com/daichunghy/patchgate/discussions/10); community scheduler active on `main` | Self-authored maintenance activity; no external replies yet |
 | Usage signals | No verified downloads, downstream users or pilots; check live star/fork counts at submission time | Do not claim broad adoption |

@@ -1,7 +1,7 @@
 # Constitution and release-readiness matrix
 
 **Status:** current operational snapshot; preparation evidence only  
-**Reviewed:** 2026-08-22
+**Reviewed:** 2026-08-23
 
 This matrix maps the constitution and roadmap gates to the strongest evidence
 currently available. It is intentionally conservative: a local test or public
@@ -17,7 +17,7 @@ PR does not become a release, pilot or adoption claim.
 | G3 authenticated snapshot | Partial | Bounded GET-only live smoke on PR #9, schema-valid input/receipt, base/head binding, branch-protection and supported Rulesets subset | Post-merge default-branch smoke, complete merge-group contract and external consumer evidence |
 | G4 shadow Action | Partial | Root `action.yml`, committed bundle, pinned workflows, explicit permissions, clean-room consumer fixture, shadow and rollback runbooks | Two consenting external shadow installations, fork E2E and live merge-group E2E |
 | G5 enforcement | Open | Adversarial tests and fail-closed native-control behavior exist | Shadow evidence review, explicit maintainer consent, performance/abuse evidence and enforcement decision |
-| G6 public beta | Open | Release-candidate checker, rollback runbook, and tagged `v0.1.0-beta.2` (shadow-evidence only; `v0.1.0-beta.1` superseded) | Clean external consumer install, upgrade/downgrade/rollback proof, production-ready release |
+| G6 public beta | Partial | Release-candidate checker, rollback runbook, and tagged `v0.1.0-beta.5` (shadow-evidence only) | Clean external consumer install, upgrade/downgrade/rollback proof, production-ready release |
 | G7 diverse pilots | Open | Pilot brief, consent-safe feedback template and installation runbook | Two different public repositories with consented shadow/enforcement evidence and feedback-driven fixes |
 | G8 `v0.1` and application | Open | Evidence dossier, form draft, maintainer workflow and this matrix | All constitutional gates, `v0.1.0`, pilot links, applicant fields and manual submission |
 
@@ -48,8 +48,8 @@ The consent-safe outreach drafts are in
    scheduler state.
 3. Run only consented G2/shadow sessions and record raw evidence; do not count
    self-authored Discussions as adoption.
-4. Decide whether beta publication is authorized and execute the rollback test
-   before creating a release.
+4. Treat beta5 as shadow-only, execute the rollback test, and record the result
+   before any stable release decision.
 5. Fill the applicant identity fields, refresh live links, and submit the
    official form manually. Selection is not guaranteed by this preparation.
 

@@ -1,7 +1,7 @@
 # Codex for Open Source evidence index
 
 **Status:** preparation only; this index does not claim eligibility or selection.
-**Last reviewed:** 2026-08-22
+**Last reviewed:** 2026-08-23
 
 This index separates public maintenance evidence from usage, adoption and pilot
 evidence. The distinction matters because self-authored activity is not the
@@ -11,12 +11,12 @@ same as independent community use.
 
 | Signal | Current evidence | What it supports | What it does not prove |
 | --- | --- | --- | --- |
-| Public open-source foundation | [Repository](https://github.com/daichunghy/patchgate), Apache-2.0 license, public Discussions, protected `main` and [default-branch CI](https://github.com/daichunghy/patchgate/actions/runs/32333914059) | Public pre-release project | Release, adoption or selection |
+| Public open-source foundation | [Repository](https://github.com/daichunghy/patchgate), Apache-2.0 license, public Discussions, protected `main`, [default-branch CI](https://github.com/daichunghy/patchgate/actions/runs/32333914059), and public [`v0.1.0-beta.5` Action release](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.5) | Public beta project | Adoption or selection |
 | Active maintenance | [Discussions](https://github.com/daichunghy/patchgate/discussions), [issues #4–#7](https://github.com/daichunghy/patchgate/issues), [public Project](https://github.com/users/daichunghy/projects/1), merged [PR #9](https://github.com/daichunghy/patchgate/pull/9) (administrator decision) and passing required checks | Ongoing maintainer work and contribution routing | Independent review or merged external contributions |
 | Technical quality | [G4/G0 audit](../reviews/2026-08-20-g4-g0-audit.md), deterministic fixtures, security tests, passing PR checks and `npm run verify` | Reproducible technical quality evidence | Default-branch production reliability |
 | Live integration boundary | [G3 live smoke record](../reviews/2026-08-20-g3-live-smoke.md) reached PR head `5f9ccb5` with 24 bounded GET requests, built a schema-valid snapshot and receipt, and reported the actual missing approval/ownership/linkage evidence | Authenticated live read-only snapshot path and native branch-protection coverage | A released Action, external adoption, or a ready result on a PR that still lacks its required human gates |
 | Ecosystem research | Context-specific questions to Policy Bot, Danger, Reviewdog and Zizmor | Relevant ecosystem questions | Replies, endorsement or downstream use |
-| Usage and adoption | No verified downloads, downstream users or pilots; pre-release tags `v0.1.0-beta.1` (superseded) and [`v0.1.0-beta.2`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.2) exist. Re-check live star/fork counts at submission time | Open gap | Meaningful usage |
+| Usage and adoption | 1 GitHub star, 0 forks at the live check; no verified downstream users, external pilots or independent maintainer endorsements | Open gap | Meaningful usage |
 
 ## Evidence rules
 
@@ -34,7 +34,7 @@ same as independent community use.
 1. An independent maintainer review of the current `main` history (hardening
    PR #9 is already merged by the administrator).
 2. One immutable public beta with a clean install and rollback path
-   (`v0.1.0-beta.2` is shadow-evidence scope only).
+   (`v0.1.0-beta.5` remains shadow-evidence scope only).
 3. Three consented G2 usability sessions with raw task observations.
 4. Two consented non-blocking shadow pilots in different public repositories.
 5. At least one independent maintainer response, contribution or pilot change