Repository navigation
fix(release): stable 0.23.2 identity across all surfaces (#385, gauntlet Phase-B P1) - #388
Conversation
….2 (#385) Phase-B gauntlet finding (2/2 adversarial votes): plugin.yaml declared version: 0.23.0-rc1 at the v0.23.2-rc1 tag — a semver downgrade from the v0.23.1 GA — and tests/test_release_workflow.py synchronized README, operator-guide, CHANGELOG, and the bug-report form to that frozen value, so CI stayed green while every release since v0.23.0 shipped the wrong identity. Design (rc-first aware): the release identity is the STABLE target 0.23.2 with no rc suffix, set once for the line and identical at rc and GA — the rc/GA distinction lives only in the git tag and notes filename, preserving the GA-tree = rc-tree + notes-only invariant. The test suite now separates IDENTITY_VERSION (surface sync) from RC_TAG (notes location), validates the current rc notes' real structure instead of v0.23.0-rc1's content, and gains a no-downgrade regression guard. CHANGELOG gets the v0.23.2 section (Unreleased emptied). Historical release-notes files untouched. No product code changes. Closes #385
|
Warning Review limit reachedNext included review available in 44 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
|
| Layer / File(s) | Summary |
|---|---|
Update release identity surfaces .github/ISSUE_TEMPLATE/bug_report.yml, CHANGELOG.md, README.md, docs/operator-guide.md, plugin.yaml |
The manifest and release references now identify v0.23.2. |
Align runtime version assertions tests/test_lcm_command.py, tests/test_lcm_engine.py, tests/test_packaging_install.py |
Runtime identity, status, doctor, metadata, and packaging tests now expect v0.23.2. |
Strengthen release workflow checks tests/test_release_workflow.py |
Release tests separate identity and RC tag values, verify manifest synchronization, prevent downgrades below 0.23.1, and validate release-note structure and length. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Merge Risk: ⚪ Minimal · up to d1ab9
This PR synchronizes the release identity to 0.23.2 across metadata, documentation, and tests without changing product behavior. No actionable merge-blocking risk remains beyond normal checks and review.
Suggested reviewers: stephenschoettler
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage | Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files. (6 skipped: 5 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the stable 0.23.2 release-identity fix and references the linked issue. Confidence: 99%. |
| Description check | ✅ Passed | The description accurately explains the stale-version defect, the synchronized metadata and test changes, the RC/GA invariant, and verification results. Confidence: 99%. |
| Linked Issues check | ✅ Passed | The changes satisfy issue #385. They set plugin.yaml to 0.23.2, synchronize release-identity references, separate the stable identity from the RC tag, preserve the RC/GA tree requirement, and add guar… |
| Out of Scope Changes check | ✅ Passed | The changes remain within the stated release-metadata and test scope. No unrelated product-code changes or historical release-note modifications are present. Confidence: 99%. |
Full details: Linked Issues check
Explanation
The changes satisfy issue #385. They set plugin.yaml to 0.23.2, synchronize release-identity references, separate the stable identity from the RC tag, preserve the RC/GA tree requirement, and add guards against mismatches and downgrades. Confidence: 98%.
Full details: Docstring Coverage
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 3 files. (6 skipped: 5 unsupported, 1 too large.)
✨ Finishing Touches 💡 2
📝 Generate docstrings 💡
- Create stacked PR
- Commit on current branch
🛠️ Fix failing CI checks 💡
- Create stacked PR
- Commit on current branch
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
fix/385-release-identity-0232
Warning
Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30d312da35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #388 - fix(release): stable 0.23.2 identity across all surfaces (#385, gauntlet Phase-B P1)
Head: 30d312da35bbe5e81cbd9e41bb64d1547c6bfda7 into main. Review event: COMMENT.
Estimated review effort: 3/5 (~48 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/ISSUE_TEMPLATE/bug_report.yml |
modified | +1/-1 | Changed file | Low |
CHANGELOG.md |
modified | +2/-0 | Documentation | Low |
README.md |
modified | +2/-2 | Documentation | Moderate: validated P3 finding |
docs/operator-guide.md |
modified | +1/-1 | Documentation | Low |
plugin.yaml |
modified | +1/-1 | Changed file | Low |
tests/test_lcm_command.py |
modified | +2/-2 | Test coverage | Low |
tests/test_lcm_engine.py |
modified | +5/-5 | Test coverage | Low |
tests/test_packaging_install.py |
modified | +1/-1 | Test coverage | Low |
tests/test_release_workflow.py |
modified | +26/-16 | Test coverage | Moderate: validated P3 finding |
Review Signal
Validated inline findings: 2 (P0: 0, P1: 0, P2: 0, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Maintainer Analysis
Changed behavior:
- The plugin manifest identity changes from 0.23.0-rc1 to 0.23.2.
- Runtime-identity tests and operator-facing documentation are updated to expect 0.23.2.
- Release tests separate the stable plugin identity 0.23.2 from the artifact tag 0.23.2-rc1.
- Release-note validation changes from concrete scope markers to section-shape and line-count checks.
Affected invariants:
- A documented commit SHA must retain the identity actually stored in that immutable commit.
- The no-downgrade regression must be anchored independently of the candidate version value.
- Stable plugin identity and RC artifact-tag identity must remain intentionally distinct across release surfaces.
Evidence:
- README.md:127-133 binds the changed version claim to an unchanged historical main SHA.
- tests/test_release_workflow.py:47-51 introduces a no-downgrade test that compares the manifest only with its own mutable constant.
- plugin.yaml:2 changes the runtime identity to 0.23.2 while tests/test_release_workflow.py:6 uses the separate 0.23.2-rc1 tag.
Limitations:
- Review was limited to the supplied checkout diff; no shell commands, tests, builds, package scripts, app commands, or arbitrary PR code were executed.
- The existence and contents of
.github/release-notes/v0.23.2-rc1.mdwere not independently inspected, so no finding is asserted about that file or resulting CI behavior.
No-finding rationale: No validated runtime correctness, security, data-loss, migration, dependency, Unity, or immediate CI-breaking defect was established from the supplied changes beyond the documentation inconsistency and ineffective regression guard.
Risk Taxonomy
- Release regression: 2
Validation and Proof
No required validation recommendation selected; rely on existing GitHub checks and human review.
Proof status: not_applicable - No required behavior proof selected for this changed surface.
Related Context
Related issues/PRs: #385.
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
…eal downgrade guard) Four review refinements on the release-identity reconciliation: - CHANGELOG heading 'release candidate' -> 'security + lossless point release' (GA-neutral; true at both rc and GA under the notes-only-GA invariant). (P2) - README: stop pinning a historical SHA to the new version (a restamp of an immutable baseline's recorded identity); reframe as a forward alignment from the v0.23.1 stable tag with the drift resolved (#385). (P3) - operator-guide: note 0.23.2 is the identity the next GA tag carries unchanged (rc and GA share the tree, differ only by notes) so the guide stays accurate across the transition. (P2) - test_plugin_version_is_not_a_release_downgrade: parse the version and assert the release core >= the 0.23.1 stable floor (a restored older RC now fails) instead of a tautological substring match of the constant. (P3)
There was a problem hiding this comment.
Walkthrough
PR: #388 - fix(release): stable 0.23.2 identity across all surfaces (#385, gauntlet Phase-B P1)
Head: d1ab95855c62ff8511fb51fffcb22b59ef4491ff into main. Review event: COMMENT.
Estimated review effort: 3/5 (~48 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/ISSUE_TEMPLATE/bug_report.yml |
modified | +1/-1 | Changed file | Low |
CHANGELOG.md |
modified | +2/-0 | Documentation | Low |
README.md |
modified | +9/-8 | Documentation | Low |
docs/operator-guide.md |
modified | +5/-2 | Documentation | Low |
plugin.yaml |
modified | +1/-1 | Changed file | Low |
tests/test_lcm_command.py |
modified | +2/-2 | Test coverage | Low |
tests/test_lcm_engine.py |
modified | +5/-5 | Test coverage | Low |
tests/test_packaging_install.py |
modified | +1/-1 | Test coverage | Low |
tests/test_release_workflow.py |
modified | +35/-16 | Test coverage | Low |
Review Signal
No validated inline findings.
Dropped findings before posting: 0. High-severity findings: 0.
Maintainer Analysis
Changed behavior:
- Runtime/plugin identity changes from 0.23.0-rc1 to 0.23.2 across the manifest, user-facing status/doctor expectations, documentation, changelog, and issue template.
- Release-workflow tests now separate the stable plugin identity (0.23.2) from the release-candidate tag (0.23.2-rc1).
- A regression assertion prevents the manifest version from falling below the previously shipped 0.23.1 stable floor.
Affected invariants:
- Release identity surfaces should remain synchronized.
- An RC and its GA may share the same runtime identity while the tag and commit remain the authoritative release proof.
- The declared plugin version must not regress below the last stable release.
Evidence:
- plugin.yaml:2 declares version 0.23.2.
- tests/test_release_workflow.py synchronizes identity surfaces and independently retains RC_TAG 0.23.2-rc1.
- Runtime identity assertions were updated consistently in tests/test_lcm_command.py, tests/test_lcm_engine.py, and tests/test_packaging_install.py.
- README.md and docs/operator-guide.md explicitly warn that version text alone is not release proof.
Limitations:
- Review was limited to the supplied checkout diff; no shell commands, tests, builds, package scripts, app commands, or arbitrary PR code were executed.
- The existence and exact contents of the unchanged v0.23.2-rc1 release-notes file and remote release/tag state were not independently proven.
No-finding rationale: The diff consistently applies the intended stable 0.23.2 identity while keeping RC tag identity separate, and no concrete correctness, security, data-loss, CI, release, or high-signal test defect was validated from the provided evidence.
Risk Taxonomy
No finding categories.
Validation and Proof
No required validation recommendation selected; rely on existing GitHub checks and human review.
Proof status: not_applicable - No required behavior proof selected for this changed surface.
Related Context
Related issues/PRs: #385.
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1ab95855c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This PR fixes a Phase-B-caught P1, so per the release gate the candidate must advance rather than keep validating rc1. Adds .github/release-notes/v0.23.2-rc2.md (rc1 notes + the #383/#384 marker-independent-validator hardening paragraph) and points RC_TAG at 0.23.2-rc2 so the notes-coverage test validates the new rc. Identity stays the stable 0.23.2 (unchanged rc1→rc2→GA); only the notes file and git tag carry the rc number.
There was a problem hiding this comment.
Walkthrough
PR: #388 - fix(release): stable 0.23.2 identity across all surfaces (#385, gauntlet Phase-B P1)
Head: 8aeb55cd01ec76f45107dc9e292e0d2cbb27b1c2 into main. Review event: COMMENT.
Estimated review effort: 3/5 (~50 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/ISSUE_TEMPLATE/bug_report.yml |
modified | +1/-1 | Changed file | Low |
.github/release-notes/v0.23.2-rc2.md |
added | +86/-0 | Documentation | Moderate: validated P2 finding |
CHANGELOG.md |
modified | +2/-0 | Documentation | Low |
README.md |
modified | +9/-8 | Documentation | Low |
docs/operator-guide.md |
modified | +5/-2 | Documentation | Low |
plugin.yaml |
modified | +1/-1 | Changed file | Low |
tests/test_lcm_command.py |
modified | +2/-2 | Test coverage | Low |
tests/test_lcm_engine.py |
modified | +5/-5 | Test coverage | Low |
tests/test_packaging_install.py |
modified | +1/-1 | Test coverage | Low |
tests/test_release_workflow.py |
modified | +35/-16 | Test coverage | Moderate: validated P3 finding |
Review Signal
Validated inline findings: 2 (P0: 0, P1: 0, P2: 1, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Maintainer Analysis
Changed behavior:
- The plugin runtime identity changes from 0.23.0-rc1 to stable identity 0.23.2 across the manifest, status surfaces, documentation, and tests.
- Release-workflow tests now distinguish the stable runtime identity from the v0.23.2-rc2 tag and notes file.
- New rc2 release notes document privacy, PEM-redaction, instrumentation, and release-process changes.
Affected invariants:
- Release receipts must cover the full candidate diff before GA.
- The RC tag, release notes, plugin manifest, runtime status, and documented identity must remain mutually consistent.
- Version identity must not regress below the last shipped stable release.
Evidence:
- .github/release-notes/v0.23.2-rc2.md:3-7 scopes Phase B to rc1 despite being rc2 notes.
- .github/release-notes/v0.23.2-rc2.md:47-53 describes security changes introduced in rc2.
- tests/test_release_workflow.py:6-8 declares identity and tag independently.
- tests/test_release_workflow.py:36-62 checks each constant's surfaces but not their relationship.
Limitations:
- Review was limited to the supplied diff because shell commands, tests, builds, and arbitrary PR code execution were prohibited.
- The release workflow implementation and unchanged source files were not inspected, so actual tag-validation behavior was not proven.
No-finding rationale: No additional correctness, data-loss, authentication, CI, or runtime regression was validated from the supplied changes.
Risk Taxonomy
- Release regression: 2
Validation and Proof
No required validation recommendation selected; rely on existing GitHub checks and human review.
Proof status: not_applicable - No required behavior proof selected for this changed surface.
Related Context
Related issues/PRs: #385.
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
| **RELEASE CANDIDATE — not GA.** This prerelease enters the RELEASE-READINESS-V1 gauntlet | ||
| (bench/specs/RELEASE-READINESS-V1.md): Phase A (all-tools live matrix on a fresh clone across | ||
| privacy postures, planted-secret battery), Phase B (multi-agent P0/P1 sweep of the full | ||
| v0.23.1→rc1 diff), Phase C (30+ turn live session soak). GA follows only with all three |
There was a problem hiding this comment.
P2: Phase B is scoped to rc1 instead of the full rc2 release diff
The rc2 notes say Phase B reviews the v0.23.1→rc1 diff, excluding the rc2 security changes described later in this same file. RELEASE-READINESS-V1 requires the adversarial sweep to cover the full release diff. Update this boundary to the exact rc2 candidate/tag so the new validator and scanner changes cannot reach GA without the mandated Phase-B coverage.
Category: Release regression
Why this matters: A stale review boundary can produce a green release receipt that does not cover the security-sensitive rc2 delta.
| RELEASE_VERSION = "0.23.0-rc1" | ||
| RELEASE_NOTES = REPO_ROOT / ".github" / "release-notes" / f"v{RELEASE_VERSION}.md" | ||
| IDENTITY_VERSION = "0.23.2" | ||
| RC_TAG = "0.23.2-rc2" |
There was a problem hiding this comment.
P3: RC tag and runtime identity can drift independently
RC_TAG and IDENTITY_VERSION are separate constants, but no assertion relates the RC tag's release core to the runtime identity. The tests can therefore pass with notes for one release line and plugin.yaml/documentation identifying another. Add an assertion that stripping the -rcN suffix from RC_TAG equals IDENTITY_VERSION.
Category: Release regression
Why this matters: This leaves the release guard unable to prevent the cross-surface identity drift that this PR is intended to fix.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8aeb55cd01
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| privacy postures, planted-secret battery), Phase B (multi-agent P0/P1 sweep of the full | ||
| v0.23.1→rc1 diff), Phase C (30+ turn live session soak). GA follows only with all three |
There was a problem hiding this comment.
If operators use these rc2 notes to scope Phase B, they will review only v0.23.1→rc1, excluding the rc2-only privacy-validator and release-identity fixes. bench/specs/RELEASE-READINESS-V1.md:56-62 requires the full previous-GA-to-current-RC diff, and Phase B must rerun after every respin, so this must name and validate v0.23.1→rc2 before GA.
AGENTS.md reference: AGENTS.md:L155-L161
Useful? React with 👍 / 👎.
| verify the loaded commit and tag. `0.23.2` is the stable identity the next GA | ||
| tag (`v0.23.2`) will carry unchanged — the release candidate and the GA cut | ||
| share this exact tree and differ only by the added release-notes file, so this | ||
| guide stays accurate across that transition without an edit. |
There was a problem hiding this comment.
When this exact tree is promoted to v0.23.2, the added phrase “the next GA tag” becomes false while the guide still directs exact-stable users to v0.23.1 at lines 85-103 and shows that version at line 173. Because the GA tree may add only release notes, those instructions cannot be corrected during the cut. Fresh evidence after the prior review is this final added wording and the unchanged v0.23.1 installation section, so the attempted fix does not actually make the guide GA-safe.
AGENTS.md reference: AGENTS.md:L159-L161
Useful? React with 👍 / 👎.
1 participant
Summary
Fixes the Phase-B-caught P1: the release identity was frozen at 0.23.0-rc1 since the v0.23.0 rc chain (a semver downgrade from v0.23.1 GA), with tests + README + operator-guide + CHANGELOG + bug-report form all synchronized to the stale value so CI never noticed.
Design (rc-first aware)
Identity = stable
0.23.2everywhere, identical at rc and GA (the rc/GA distinction is the git tag + notes filename only) — preserving RELEASE-READINESS-V1's GA-tree = rc-tree + notes-only invariant. Test suite splits IDENTITY_VERSION from RC_TAG, validates the current rc notes structurally, and adds a no-downgrade guard.Change class
Release metadata + tests only; zero product-code changes; historical release-notes files untouched.
Verification
tests/test_release_workflow.py green (8 passed, includes the new no-downgrade guard); test_packaging_install's 0.23.2 assertion updated (its 28 failures are the pre-existing 'No module named agent' venv quirk — identical on clean main, verified by a baseline run); every 0.23.0-rc1 reference outside historical records eliminated.
Closes #385