Repository navigation
perf(release-audit-report, release-archive-sweep, release-keys-sync): decide and render as code - #1625
Open
potiuk wants to merge 1 commit into
Open
perf(release-audit-report, release-archive-sweep, release-keys-sync): decide and render as code#1625potiuk wants to merge 1 commit into
potiuk wants to merge 1 commit into
Conversation
potiuk
added
family:tools
potiuk
added this pull request to stack #1620
October 13, 2026 15:24
… decide and render as code The last three release skills each had one rule in a skill-local script and the rest in prose. The scripts move unchanged into tools/release-management (render_record → audit_report.record, retention → archive_sweep, check_key → keys_sync), and new commands do what the agent did by hand, printing JSON and running nothing: - audit-report: `verdict` (planning issue found, `org/repo#n` normalised to the canonical URL), `gather` (PonyMail subjects and queries, the `svn info` revision command, the required fields; the search itself stays with the agent), `voters` (the [RESULT] voters mapped to roster handles with vote-tally's binding resolution, unresolved ones listed, never cited), `check` (Step 1 missing / redacted fields, schema violations, the thread-permalink shape), `record`, and `pr`. - archive-sweep: `verdict`, `listing`, `trains` (strict `N.x` lines become patterns; a free-text retention rule leaves `keep` to the agent), `retention`, and `render` for svn mv, gh release delete (with the permanent-deletion warning), aws s3 mv, self-hosted, and atr (no command). - keys-sync: whether the fingerprint is in KEYS and its UID matches the keyserver's is no longer a text scan. A new read-only `release-verify list-keys` lists fingerprints and UIDs in the existing throwaway GNUPGHOME (no agent, no keyring, no network, private-key material refused), and `keys-sync verdict` classifies it as proceed / noop / blocked, failing closed when it cannot compare. `render` draws the `# <uid>` KEYS block, the svn / git / generic sequence and the upload reminder with the expiry advisory. Every rendered command quotes its values with the shared shell helpers. Each backend and outcome gets its own file; audit-report's PR step moves, byte-identical with its generated adversarial block, to audit-log-pr.md at the skill root. Golden rules, Hard rules and the eval headings are unchanged. audit-report 6,657 → 5,136 tokens, archive-sweep 4,573 → 4,165, keys-sync 4,871 → 4,584. Evals: the scripted cases become pytest cases named after each former case (expected records byte-identical); the judgement and injection cases stay, their fixtures now carrying the real tool output. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
potiuk
force-pushed
the
perf/release-mgmt-6-audit-archive-keys
branch
from
October 14, 2026 08:09
784a463 to
2f20bb6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Last PR of the release-management stack; it builds on the prepare PR.
tools/release-management:render_record→audit_report.record,retention→archive_sweep,check_key→keys_sync.verdict,gather(the mail-archive search plan; the search itself stays with the agent),voters(roster handles through vote-tally's binding resolution, never citing an unresolved voter),check,recordandpr. The PR step moves, byte-identical with its generated adversarial block, toaudit-log-pr.mdat the skill root.verdict,listing,trains,retentionandrender. The render covers svn mv, gh release delete (with the permanent-deletion warning), aws s3 mv, self-hosted, and atr (no command).release-verify list-keyslists fingerprints and UIDs in the existing throwaway GNUPGHOME. It uses no agent, no keyring and no network, and refuses private-key material.keys-sync verdictclassifies that output as proceed / noop / blocked.renderdraws the KEYS block, the svn / git / generic sequence and the upload reminder.Security notes
release-managementstill runs nothing. The only gpg call isrelease-verify list-keys, with the same isolation guarantees as its other checks.Behaviour changes worth a look
noopmeans the keyserver's primary UID is among the KEYS entry's UIDs.\ # commentcontinuation lines, which broke a pasted command.gh release listadds--exclude-drafts. The self-hosted backend needs--command-template, since no config key holds that command.Type of change
tools/release-management,tools/release-verify)Test plan
prek run --all-filespasses on the stack tip.tools/release-managementandtools/release-verify: pytest / ruff / mypy, with three real-loadintegration tests. The gpg-basedlist-keystests ran.Was generative AI tooling used to co-author this PR?
Generated-by:.🤖 Generated with Claude Code
https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv