Skip to content

sync(#1874): main to dev after v5.10.1 release - #1876

Merged
me2resh merged 2 commits into
devfrom
sync/main-to-dev-after-v5.10.1
Oct 24, 2026
Merged

me2resh merged 2 commits into
devfrom
sync/main-to-dev-after-v5.10.1

Conversation

@atlas-apex

@atlas-apex atlas-apex commented Oct 24, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Syncs main to dev after the v5.10.1 release. The v5.10.1 squash commit becomes an ancestor of dev. The next dev to main release PR then shows only new commits.
  • Plain merge. One conflict occurred: README.md, the SecFathy credit row added on the release branch. The CEO chose to keep main's side, so the row stays between samahali and sts1078.
  • No CHANGELOG carry-forward needed. CHANGELOG.md already matches main after the merge.
  • Post-merge check passed. FAILED_COMMITS is empty. The one main-only commit still reverse-applies on this branch.
  • No functional changes. This is a bookkeeping merge.

Background

Each release squash-merges dev into main. The squash commit is not on dev, so the next release PR conflicts on the same changes. This PR merges main into dev with a plain merge, so the squash commit becomes an ancestor of dev. A plain merge stops on every conflict, because main can carry content that dev does not have (#1348, #1394). The SecFathy row is such content.

Testing

  1. After merge, git merge-base --is-ancestor fa6911078bb3c91af457290cd2c7e8bd91843746 upstream/dev exits 0.
  2. After merge, git log upstream/dev..upstream/main --oneline returns nothing.
  3. Merge this PR with --merge, never --squash or --rebase.

Refs #1874

Glossary

Term Definition
Squash divergence A release squash commit on main that dev does not contain. The next release PR then conflicts on changes that dev already has.
Main-only content A change that exists on main and not on dev, for example an edit made on the release branch before the squash.
Post-merge content check Step 5c of /release-sync: each main-only commit's patch must still reverse-apply on the sync branch.

🤖 Generated with Claude Code

atlas-apex and others added 2 commits October 24, 2026 18:03
## Summary

- **Releases v5.10.1** — see CHANGELOG section below for the full list of changes included in this release
- **CHANGELOG.md updated** — new section prepended at the top with the grouped entries and PR refs
- **Auto-tag on merge** — `.github/workflows/auto-tag-on-release-pr-merge.yml` will tag the squash commit on main and create a GitHub Release entry automatically when this PR merges (AgDR-0076)
- **Release provenance recorded** — a `Released-From` trailer captures the exact `dev` SHA this release was cut from, so the next release's changelog range is deterministic instead of inferred (AgDR-0094, #872)

## CHANGELOG

## [v5.10.1] — 2026-10-24

Patch release — 4 improvements.

### Changed (refactor / chore / docs)

- (#1873) harden the terraform-ci golden-path template — ce979c5
- (#1872) state the hook threat model in SECURITY.md — 953d450
- (#1868) add an after-the-release checklist to /release — f9fd80d
- (#1869) credit five missing issue authors — 0024f0f

### Thanks

- @SecFathy (Mohammed Fathy) reported the problems that #1872 and #1873 fix.

## Migration script

- [x] A no-op migration script `.claude/migrations/v5.10.0-to-v5.10.1.sh` is included, and `docs/upgrading.md`'s "What each migration does" table has a matching row. See `.claude/migrations/README.md`.

## Testing

1. After merge, confirm CI creates tag `v5.10.1` on `main` (check the `auto-tag-on-release-pr-merge` workflow run)
2. Verify `git describe --tags --abbrev=0 upstream/main` returns `v5.10.1`
3. Run `/release-sync v5.10.1` to sync main→dev and prevent squash divergence
4. Verify the squash commit's message carries the trailer: `git log -1 --pretty=format:'%(trailers:key=Released-From,valueonly)' v5.10.1`

Refs #1874

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---

## Glossary

| Term | Definition |
|------|------------|
| Squash merge | GitHub merges all commits on the PR branch into a single commit on main; the branch HEAD is discarded and the resulting main tip has a new SHA |
| Auto-tag | The `auto-tag-on-release-pr-merge.yml` workflow fires on `pull_request` → `closed` + `merged` for `release/v*` branches, tags `github.sha` (the squash commit), and creates a GitHub Release |
| Ancestry guard | `git merge-base --is-ancestor <sha> main` — fails if the tag would not be reachable from main, preventing a mis-placed tag like v2.3.0 |
| `/release-sync` | The mandatory follow-up skill that merges main→dev after a squash-merge release, preventing SHA divergence accumulation |
| `Released-From` trailer | A git trailer (`Key: value` in the commit message's final paragraph) recording the exact `dev` SHA this release was cut from — `bin/release-changelog.sh` reads it back for the next release's changelog range (AgDR-0094) |

Released-From: ce979c5
Squash-merge divergence from the v5.10.1 release PR creates phantom divergence
between main and dev. This merge makes the v5.10.1 squash commit an ancestor
of dev so future dev to main release PRs only see genuinely-new commits.

Refs #1874

@me2resh me2resh left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CHANGES REQUESTED. The merge commit is correct. The PR body has no Glossary section, and the Glossary is mandatory. Next action: add the Glossary table from the /release-sync PR body template to the PR body. The head SHA does not change, so a delta re-review of the body is sufficient.

Code Review: PR #1876

Commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
Scope: Full

Summary

This PR merges main into dev after the v5.10.1 release. The head is a two-parent merge commit. Parent 1 is the dev tip ce979c5c. Parent 2 is the release squash commit fa691107, which tag v5.10.1 names. The merge makes the release squash commit an ancestor of dev. The diff against dev contains only the release's own edits.

Acceptance Criteria

Issue Criterion Status Evidence
#1874 Release PR release/v5.10.1 to main is open, and its changelog lists #1869, #1868, #1872 and #1873. Met The release PR merged as fa691107. CHANGELOG.md on the head has the v5.10.1 entry with all four PR numbers.
#1874 The no-op migration script and its docs row are in the release. Met .claude/migrations/v5.10.0-to-v5.10.1.sh (mode 100755, exits 0) and the docs/upgrading.md table row are in fa691107 and in this head.
#1874 After merge, tag v5.10.1 exists on main and the squash commit carries a readable Released-From trailer. Met The forge tag v5.10.1 is annotated and peels to fa691107, which is the forge main tip. The trailer reads ce979c5c63805a5f7d61a12e7a7ff3c04e8fa98f.
#1874 /release-sync v5.10.1 is done. Not verifiable This PR is the sync. The criterion is complete only after this PR merges with --merge. Check after merge: git merge-base --is-ancestor fa691107 upstream/dev exits 0.

Checklist Results

  • Architecture & Design: N/A. The PR adds no new code. It brings release content into dev.
  • Code Quality: ✅ Pass. The only script is the no-op migration from the release. It uses set -u, honors APEXYARD_MIGRATION_QUIET, and exits 0.
  • Testing: ✅ Pass. No new tests are necessary. The head tree is identical to the main tree, which CI already ran on the release PR. CI is green on this head.
  • Security: N/A for this pass. No secret, auth, or hook file changes against dev. Gate integrity belongs to the Security Auditor.
  • Performance: N/A. Docs and one no-op script.
  • PR Description & Glossary: ❌ Fail. The body has no ## Glossary section. See Issues Found. The ticket link is correct: Refs #1874, no closing keyword, and no session URL.
  • Summary Bullet Narrative: ✅ Pass. Each bullet states the change and its effect.
  • Technical Decisions (AgDR): N/A. A routine sync. The merge strategy is already recorded in AgDR-0053 and AgDR-0170.
  • Adopter Handbooks: N/A. No handbook applies to a docs-and-merge sync.
  • Fallow Static Analysis (JS/TS): N/A. The diff has no JS or TS file.

Issues Found

  1. Missing Glossary (blocking). .claude/rules/pr-quality.md § "Glossary (MANDATORY)" states that a PR without a Glossary gets a changes-requested result, with no exceptions. The /release-sync PR body template also includes a Glossary. Fix: copy the template's Glossary table into the PR body. A body edit does not change the head SHA.

Note: the Rex review of #1865 (the v5.10.0 sync) treated the same gap as advisory. That result did not agree with the rule. This review follows the rule.

Suggestions

  • suggestion: The body omits the template's ## Background section. Consider adding it so the sync PR matches the template. Advisory.
  • nit (pre-existing on main, not introduced by this PR): the new SecFathy row in README "Issue contributors" links to the profile page. The other rows link to an issue search for that author. If the report came through a non-issue channel, the profile link is correct. Advisory only.

Validation

  • Merge parents: git rev-list --parents -n 1 31f4d98a gives ce979c5c and fa691107. The forge dev ref is ce979c5c. The forge main ref is fa691107. v5.10.1^{commit} is fa691107.
  • Diff against dev: git diff --stat ce979c5c 31f4d98a shows 4 files, 41 insertions, 0 deletions. The files are CHANGELOG.md (v5.10.1 entry), the migration script, the docs/upgrading.md row, and the README SecFathy row.
  • Diff against main: empty. The head tree id and the main tree id are both 5f70026f.
  • Conflict: git show --remerge-diff 31f4d98a shows one conflict in README.md. The resolution keeps main's side, the SecFathy row between samahali and sts1078, and removes the markers. No other line changed. A search for conflict markers in README.md, CHANGELOG.md and docs/upgrading.md at the head finds none. The other README content is the same as on dev.
  • CHANGELOG: git diff --quiet fa691107 31f4d98a -- CHANGELOG.md exits 0. No carry-forward commit is necessary.
  • Step 5c: upstream/dev..upstream/main has one non-merge commit, fa691107. A reverse-apply run in a scratch export did not run, because the reviewer mutation lock stopped the setup command. The tree equality above is stronger evidence: the head tree is identical to fa691107's tree, so all of that commit's content is present.
  • CI (read once, head 31f4d98a): CodeQL, Analyze (actions), hook test suite, hook tests (linux jq-1.7), Verify Ticket ID, markdownlint-cli2, records-lint and tier pass. nightly-failure and conformance are skipped.

Verdict

CHANGES REQUESTED
The merge commit, the conflict resolution, the CHANGELOG, and the content check are all correct. The only blocker is the missing Glossary, which the PR quality rule makes mandatory. After the body edit, request a delta re-review. Merge with --merge only.


🤖 Reviewed by Rex (Code Reviewer Agent)
📌 Reviewed commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2

@me2resh me2resh left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

APPROVED. The PR body now has a Glossary, so the one blocker is resolved. Next action: get the per-PR human approval, then merge with --merge only.

Code Review: PR #1876

Commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2
Scope: Delta re-review, 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2..31f4d98a5be9dd1308cb0f1cca801e0b315c80c2 (PR body only)

Summary

The head did not change. Only the PR body changed: it adds a ## Background section and a ## Glossary table with three terms. Prior review: 5639174545, at the same commit. The acceptance criteria results from that review stay the same. Three of the #1874 criteria are Met. "/release-sync v5.10.1 is done" is Not verifiable until this PR merges with --merge.

Checklist Results

  • PR Description & Glossary: ✅ Pass. The Glossary defines squash divergence, main-only content, and the post-merge content check. Each definition agrees with /release-sync steps 5 and 5c. The Background is correct: a plain merge stops on every conflict, and the SecFathy row is main-only content. #1348 and #1394 are real issues. The body has Refs #1874, no closing keyword, no session URL, and no private path or identifier.
  • Architecture, Code Quality, Testing, Security, Performance, AgDR, Handbooks, Fallow: unchanged from review 5639174545. The code did not change, so these checks were not run again.

Issues Found

  • Missing Glossary (blocking, review 5639174545): resolved. The body now has a ## Glossary table.
  • Missing Background (suggestion): resolved.
  • SecFathy row links to the profile page (nit, already on main): not touched. Advisory only.
  • New findings: None.

Validation

  • Current: the forge head is 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2, the same as the prior review's commit_id. The body was read from the forge in this run.
  • CI: the earlier read in this run, at the same head, showed all checks pass, with nightly-failure and conformance skipped. The hook stopped a second CI read in the same run, so CI was not read again. The head did not change, so that result still applies to this commit.
  • Merge parents, the tree equality with main, the conflict resolution, and the CHANGELOG match: from review 5639174545. Not run again.

Verdict

APPROVED
The only blocker is resolved and the new body text is correct. The merge commit is still correct. Merge with --merge only, never --squash or --rebase.


🤖 Reviewed by Rex (Code Reviewer Agent)
📌 Reviewed commit: 31f4d98a5be9dd1308cb0f1cca801e0b315c80c2

@me2resh me2resh added the ready-to-merge Rex approved; the refresh Action keeps this PR up to date label Oct 24, 2026
@me2resh
me2resh merged commit e600ada into dev Oct 24, 2026
12 checks passed
@me2resh
me2resh deleted the sync/main-to-dev-after-v5.10.1 branch October 24, 2026 18:04
@me2resh me2resh mentioned this pull request Oct 24, 2026
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-to-merge Rex approved; the refresh Action keeps this PR up to date

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants