diff --git a/docs/review-context/CHANGELOG.md b/docs/review-context/CHANGELOG.md index fc5f2d94..a7b93302 100644 --- a/docs/review-context/CHANGELOG.md +++ b/docs/review-context/CHANGELOG.md @@ -4,6 +4,26 @@ Vault status: append-only change log. ## 2026-06-15 +### Recorded Platform PR And Protection Status + +- Recorded platform PR #31 as merged to `master` with a Workspace-focused PR + gate and legacy full E2E suite moved to manual advisory. +- Recorded platform PR #32 as merged to `master`, including local durable + review state, staged decision persistence, advisory agent completion + persistence, and release-owner audit trail scope. +- Clarified that these PRs improve R5 evidence but do not change product-level + release readiness, which remains blocked. +- Recorded the GitHub protection limitation for the private + `yha9806/vulca-platform` repository and the temporary no-direct-master + operational rule until GitHub branch protection becomes available. + +Source basis: + +- `yha9806/vulca-platform` PR #31. +- `yha9806/vulca-platform` PR #32. +- GitHub ruleset/protection API checks on 2026-06-15. +- Local verification for `codex/vulca-workspace-durable-review`. + ### Added M5 Closeout Summary - Added `release-readiness/M5-CLOSEOUT.md` and diff --git a/docs/review-context/PROTECTION.md b/docs/review-context/PROTECTION.md index 3b423a6c..4375f210 100644 --- a/docs/review-context/PROTECTION.md +++ b/docs/review-context/PROTECTION.md @@ -47,6 +47,28 @@ While the repository has only one maintainer, the shared pull-request rule uses `require_code_owner_review: false` to avoid a solo-maintainer lockout. Code owner review can be re-enabled only after a second valid reviewer or team exists. +## Related Platform Repository Protection + +As of 2026-06-15, `yha9806/vulca-platform` is a private repository. GitHub's +branch-protection and ruleset APIs returned HTTP 403 with the message that the +feature requires GitHub Pro or a public repository. Therefore, the platform +repository cannot currently enforce the same hard no-direct-push rule through +GitHub branch protection. + +Operational rule until the repository is upgraded or made public: + +- do not push directly to `master`; +- push product work to `codex/*` branches; +- use PRs for `master` integration; +- treat `Run Tests` and `security` as required evidence even when GitHub cannot + technically enforce them; +- record any exception in this vault before merging. + +Once GitHub protection becomes available for `yha9806/vulca-platform`, mirror +the context-vault rule shape: require pull requests, block deletion, block +non-fast-forward updates, configure no bypass actors by default, and require +`Run Tests` plus `security` for `master`. + ## Modification Path Reader sessions may: @@ -83,5 +105,6 @@ If a critical repair requires temporary bypass: ## Sources - Repository rulesets verified through the GitHub API on 2026-06-15. +- `yha9806/vulca-platform` protection and ruleset API checks on 2026-06-15. - Context-vault branch: `codex/vulca-context-vault`. - GitHub user owner in `.github/CODEOWNERS`: `@yha9806`. diff --git a/docs/review-context/release-readiness/M5-CLOSEOUT.md b/docs/review-context/release-readiness/M5-CLOSEOUT.md index a024d743..5447a773 100644 --- a/docs/review-context/release-readiness/M5-CLOSEOUT.md +++ b/docs/review-context/release-readiness/M5-CLOSEOUT.md @@ -18,6 +18,23 @@ and a human release owner decision exist. - Required boundary: public copy may cite the example-specific gate only when it preserves the R4 scope. +## Current Platform Merge State + +As of 2026-06-15: + +- Platform PR #31, `[codex] Workspace review product shell`, merged to + `master` at `6810e67ca967a47782b5d9f83d751148d1eb6d26`. Its PR gate + includes `tests/e2e/specs/workspace.spec.ts`, while the legacy full E2E suite + is manual advisory because it still covers retired `/login` and `/canvas` + flows. +- Platform PR #32, `[codex] Durable workspace review persistence`, merged to + `master` at `61da8e9f296b7c1e66f61720e487e8e42d4eb6ce`. It implements local + durable review state and the release-owner audit trail, with local + verification plus remote `Run Tests` and `security` gates. + +These PRs improve R5 evidence, but they do not change the product-level +decision above. + ## Indexed Evidence - RR1 checklist/report template: @@ -35,7 +52,7 @@ and a human release owner decision exist. ## Remaining R5 Blockers -- production Workspace persistence evidence; +- production/shared Workspace persistence evidence beyond the local durable PR; - repeated bridge ingestion across more than one workflow; - production EvidencePack rendering evidence; - human-owned release workflow implementation evidence; @@ -49,3 +66,5 @@ and a human release owner decision exist. - `docs/review-context/workspace-durable/m3-durable-review-fixture.json` - `docs/review-context/public-examples/m3-public-example-gate.json` - `docs/review-context/copy-gates/website-ppt-copy-gate.json` +- `yha9806/vulca-platform` PR #31. +- `yha9806/vulca-platform` PR #32. diff --git a/docs/review-context/workspace-durable/README.md b/docs/review-context/workspace-durable/README.md index 59827eaf..185c0b43 100644 --- a/docs/review-context/workspace-durable/README.md +++ b/docs/review-context/workspace-durable/README.md @@ -10,6 +10,23 @@ Product branches may implement it with a backend, database, local durable demo store, or test fixture, but they must preserve the same review evidence, blocker, decision-state, and human-audit boundaries. +## Product Implementation Status + +As of 2026-06-15, the platform implementation has two merged PRs on +`yha9806/vulca-platform` `master`: + +- PR #31, `[codex] Workspace review product shell`, merged at + `6810e67ca967a47782b5d9f83d751148d1eb6d26`. Its PR gate blocked on + TypeScript, quiet ESLint, frontend unit tests, backend tests, backend + coverage, and `tests/e2e/specs/workspace.spec.ts`. +- PR #32, `[codex] Durable workspace review persistence`, merged at + `61da8e9f296b7c1e66f61720e487e8e42d4eb6ce`. It adds local durable review + state, staged decision persistence, advisory-agent completion persistence, + and the release-owner audit trail. + +PR #32 is intentionally a local durability slice. It does not certify shared +production persistence or product-level release readiness. + ## Current Fixtures - `m3-durable-review-fixture.json`: RR3 reference fixture showing the M3 @@ -31,3 +48,5 @@ blocker, decision-state, and human-audit boundaries. - `docs/review-context/12-complete-demo-path.md` - `docs/review-context/14-release-readiness-evidence-gate.md` - `docs/review-context/artifact-bridge/m3-demo-bridge-fixture.json` +- `yha9806/vulca-platform` PR #31. +- `yha9806/vulca-platform` PR #32.