Skip to content

chore(toolchain): qualify Proofkit 0.14.21 and current dependency audits - #70

Open
iperev wants to merge 1 commit into
feat/custom-epoch-reviewfrom
chore/toolchain-qualification
Open

iperev wants to merge 1 commit into
feat/custom-epoch-reviewfrom
chore/toolchain-qualification

Conversation

@iperev

@iperev iperev commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Stacked PR 15 — base: #69 (feat/custom-epoch-review). Do not merge yet. Review only the top commit.

Context

CI-063 remainder after #56. Provisional owner decisions (2026-10-11): Q6(b) move Proofkit to the latest 0.14.x patch if the consumed contract is identical, and defer 0.16.0; Q7 document Intel macOS as unsupported for the pnpm/gitleaks locks.

What changed

  • Proofkit 0.14.18 → 0.14.21: pin, lock and requirements projection (only the Proofkit record changes), the dependency check and the tests.
  • Offline evidence: the seven consumed records, 168 definitions, process contract and help are identical; four wheel hashes verified.
  • The consumed-contract test now binds the 14 root-definition digests.
  • Intel macOS documented as unsupported for the pnpm/gitleaks locks, replacing the stale pnpm 11.25.0 reason; gitleaks added to the lock command.
  • Audit and currency observation for 2026-10-12 recorded; ROADMAP CI-063 row updated (still open).

Expected result

Native consumer tests pass on 0.14.21 with unchanged consumed behavior.

Non-claims: this does not prove runtime/binary equivalence, adopt 0.15 or 0.16, support Intel macOS, update other dependencies, close CI-063, or renew the runtime-repair expiry.

Provisional owner decisions (2026-10-11): Q6(b) and Q7, as listed under Context.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.

Move the development Proofkit pin from 0.14.18 to the latest 0.14.x patch,
0.14.21 (provisional owner decision 2026-10-11). Offline comparison of the
published wheels shows identical consumed command records, process contract,
all 168 contract definitions and root/command help for the seven consumed
commands; 0.15.0 and 0.16.0 stay deferred. uv.lock and the requirements
projection change only the agentic-proofkit record. The consumed-contract
test now binds the fourteen admitted root-definition digests.

Record Intel macOS as unsupported for the pnpm/gitleaks locks (provisional
owner decision 2026-10-11) and correct the stale pnpm 11.25.0 artifact reason.
Record the 2026-10-12 audit/lock observation: no admitted advisory, three low
dev-only mermaid advisories below the owned high threshold, no other version
change. Native consumer tests remain required; CI-063 stays open.
@iperev
iperev force-pushed the chore/toolchain-qualification branch from b3acbab to b9554ab Compare October 12, 2026 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant