Harden cold-start branch lifecycle - #15

Final cold-start hardening and pre-visibility evidence - 2026-07-23

Scope: final Public Preview pre-visibility hardening only. This evidence was collected while the repository remained private. It does not claim Public Preview readiness. The current maintainer request authorized only the private topic branch, commit and push, private pull request, credential-free CI, squash merge, this evidence comment, and local fast-forward synchronization.

Exact final state

• Merged private PR: Harden cold-start branch lifecycle #15
• PR head: 88b03f82f43e08bd337a79f6fb09e39569f4a269
• Squash-merged final private main: 40021cf78e90773de9ba02b88a679a75d6a23b26
• After merge, the worktree was clean; origin was fetched; local main was required to be an ancestor of origin/main and fast-forwarded with --ff-only; existing local dev was required to be an ancestor of main and fast-forwarded with --ff-only.
• The checkout finished on clean local-only dev, with HEAD, main, dev, and origin/main resolving to the final commit. dev was not pushed.

Hardened repository contract

• AGENTS.md now supports a fresh clone: absent local dev may be created only from checked-out, clean, synchronized main; existing dev must be an ancestor of main, fast-forward with --ff-only, and end at the exact same commit; ahead or divergent state fails closed without reset, rebase, deletion, recreation, or push.
• AGENTS.md and RELEASING.md now state that repository documents define constraints but grant no standing remote-write permission. Private pushes, pull requests, merges, comments, and all other remote mutations require explicit authorization in the current maintainer request.
• ROADMAP.md is dated 2026-07-23 and records Public Preview pre-visibility complete; visibility change awaiting explicit authorization. It explicitly distinguishes that stop gate from Public Preview readiness.
• The existing RELEASING.md merged-PR timeline evidence mechanism remains unchanged.

Cold-start and fail-closed probes

• An initial read-only SSH clone attempt failed with a connection reset before repository access. No remote state changed.
• A --no-local, --single-branch, isolated clone of local main verified that the fresh clone had no local dev; main was clean and equal to origin/main; dev was created from that exact commit; no origin/dev existed; and a topic branch started from the same commit.
• A separate isolated probe verified that a behind dev satisfying merge-base --is-ancestor dev main fast-forwarded to exact main with --ff-only.
• An ahead dev probe failed the required ancestry condition while leaving refs unchanged; no reset, rebase, deletion, recreation, or push was used.

Local verification on exact final commit

Environment: Node.js v24.15.0, npm 11.12.1, macOS 27.0.

All candidate commands passed on 40021cf78e90773de9ba02b88a679a75d6a23b26: npm ci, npm run build, npm test, npm run typecheck, npm run lint, npm run format:check, npm run test:secrets, npm run test:package, npm run test:live-contract, npm run test:fixtures, npm run test:compat, npm run check:standalone-content, npm run check:self-contained, npm run check:public-preview, npm run actionlint, and npm run verify.

• Vitest: 11 files and 177 tests passed.
• Secret scanning passed without printing candidate values; standalone content passed for every reachable Git tree.
• Public Preview content and identity validation and mocked live-smoke semantic checks passed.
• Package validation passed publint and Are the Types Wrong; the local packed 0.1.0-alpha.1 tarball was reported as 5,820 bytes with expected ESM, CommonJS, and declaration exports.
• Clean packed-artifact fixtures passed for ESM, CommonJS, and a compatible OpenAI host with one effective OpenAI installation and preserved error identity.
• Compatibility passed OpenAI 6.47.0 minimum, 6.47.0 locked, and 6.48.0 latest within major.
• actionlint 1.7.12 validated all four workflows.
• The first exact-tree npm run check:self-contained reached the isolated actionlint download after all inner offline checks passed, then failed on one external ECONNRESET. A retry on the unchanged final commit passed the exact tracked-tree copy, isolated npm ci, offline verification, package and fixture checks, locked compatibility, and actionlint. The subsequent aggregate npm run verify also exited 0 and repeated a successful self-contained gate.
• npm audit --omit=dev reported zero production vulnerabilities.
• The full development audit reported one low-severity transitive esbuild@0.27.7 Windows development-server advisory, GHSA-g7r4-m6w7-qqqr. npm reported fixAvailable: true; npm audit fix --dry-run --json proposed zero added, changed, or removed packages and still reported the advisory. A tracked scripts and source search found no esbuild serve path, so this remains a low-severity non-production residual risk.

Credential-free GitHub Actions evidence

• PR run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987059793
• PR Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987059793/job/89141176915
• PR Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987059793/job/89141176880
• Final main run: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987344773
• Final main Node.js 22: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987344773/job/89142049702
• Final main Node.js 24: https://github.com/cometapi-dev/cometapi-node/actions/runs/29987344773/job/89142049728

Both runs passed static workflow validation, blocking Node.js 22 and 24, minimum OpenAI, Node.js 26 advisory, and standalone-repository jobs. The latest-OpenAI canary was correctly skipped for these non-Dependabot runs; local compatibility separately verified OpenAI 6.48.0.

Dependency-update dispositions

• PR build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 remains closed unmerged because it raised the supported OpenAI lower-bound contract from ^6.47.0 to ^6.48.0; the branch-specific disposition is recorded at build(deps): bump openai from 6.47.0 to 6.48.0 in the production-dependencies group #6 (comment).
• PR build(deps-dev): bump the development-dependencies group with 5 updates #7 remains closed unmerged because TypeScript 7 conflicted with the current typescript-eslint peer range and grouped Node 26 and tooling majors require separate compatibility review; the branch-specific disposition is recorded at build(deps-dev): bump the development-dependencies group with 5 updates #7 (comment).
• No open failing dependency-update PR remained at audit time. PRs chore(deps): bump googleapis/release-please-action from 4.3.0 to 5.0.0 #1 through chore(deps): bump actions/checkout from 6.0.3 to 7.0.1 #5 remained open with green check rollups; their checks predate this final main, and GitHub reported mergeability as UNKNOWN during the final read. They are not treated as current release-path execution evidence or as pre-visibility blockers.

Read-only remote audit

• Repository: PRIVATE; default branch main at 40021cf78e90773de9ba02b88a679a75d6a23b26.
• main reports protected:false. GraphQL reported zero branch-protection rules and zero repository rulesets. The REST rulesets endpoint returned 403 because the private repository plan does not expose that feature; no settings were changed.
• Repository environments: 0. Repository Actions secrets: 0. Repository Actions variables: 0. Repository Dependabot secrets: 0. Some read-only queries encountered transient connection resets and succeeded on retry.
• Immutable releases reported enabled:false and enforced_by_owner:false. Tags: 0. GitHub releases: 0. Publish workflow runs: 0.
• Live smoke has three retained scheduled runs, all skipped. Release Please was skipped for the final-main push because its enable condition was false or missing.

Skipped, unknown, and unchanged boundaries

• Protected live smoke was not authorized, configured, or run. No COMETAPI_KEY was used and no live CometAPI request was made.
• npm Trusted Publisher, ownership, public package, and dist-tag state were not configured or exercised and remain outside this evidence layer.
• Organization-level inherited Actions or Dependabot secrets and variables remain unknown because repository-level reads cannot enumerate all inherited organization state.
• Private Vulnerability Reporting returned 404. This records no readable enabled evidence, not a definitive disabled-state claim.
• Retained API state cannot rule out deleted historical tags, releases, or workflow runs without organization audit-log access.
• No repository visibility, settings, branch or tag rule, environment, secret or variable, live API, tag, release, npm publication, dist-tag, provenance, or registry state was changed.

Cold-start hardening and all currently authorized pre-visibility work are complete at this evidence boundary. Stop before repository visibility changes or any public-only settings, rules, secrets, environments, protected-live, tag, release, or npm action pending separate explicit maintainer authorization.

Post-comment remote cold-clone confirmation

• A later retry cloned final private main directly from GitHub successfully. The fresh clone was clean, contained the hardened documents, and had no local dev.
• After a read-only fetch, local main passed the ancestry check and was exactly equal to origin/main; local dev was created from that checked-out synchronized main; no origin/dev existed; and a local topic probe resolved with HEAD, main, dev, and origin/main all at 40021cf78e90773de9ba02b88a679a75d6a23b26.
• The probe created no commit and performed no remote write.