Repository navigation
test(DEN-1418): ratchet candidate certification procedure - #22
Merged
ORESoftware merged 1377 commits intoAug 29, 2026
Merged
ORESoftware merged 1377 commits into
ORESoftware merged 1377 commits into
Conversation
Preserve exact .zpkg.lock selections as bounded, deduplicated evidence; annotate only proven direct declaration edges; exclude transitive pins from nodes, edges, SCCs, cycles, and waves; render pins as disconnected evidence; and add adversarial conformance coverage.
Preserve the independent GitHub dependency-inventory conformance update while bringing the DEN-2038 certification branch to current test-org main. The reviewed file sets do not overlap.
) Add Ubuntu and macOS certification for canonical checkout-local ownership across Git-submodule takeover, nested cooperative installation, owner termination, different-home transaction recovery, and pre-Git recovery ordering. Preserve current test-org mainline work and pin the human-authored product candidate.
Compose the exact six-file DEN-3003 integrity repair with current main after DEN-2996 and DEN-2038 landed. Current main and the merged DEN-2996 head share the same parser blob, so this union preserves all intervening work while retaining the previously certified hardening blobs.
Expand declared workspace members from the same immutable Git tree, preserve root/member provenance and identity, resolve local path dependencies to actual member packages, and fail closed on unsafe, ambiguous, missing, or over-budget workspace graphs. Add offline positive and adversarial coverage.
Source fallback tries Releases first; this fixture exists only on ghcr.io so install-when-registry-is-down must take the Packages path. Co-authored-by: Cursor <cursoragent@cursor.com>
…dator-materializer'
…ect-cli-contract'
…de-inspect-v1-interop'
…nore-manifest-union'
…enum-wire-canary'
…-3017-zedignore-union'
…-2957-zed-cli-production-matrix-v1'
…-3089-polyglot-zedignore'
…-2997-workspace-member-inventory'
…ct-source-render'
…inventory-20260808'
…take-operation-lock-cert'
…on-concurrency-20260820'
ORESoftware
merged commit Aug 29, 2026
507329a
into
agent/den-1418-candidate-smoke-gate
50 of 61 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an executable, fail-closed contract around the reusable
zed-pkg-testcandidate gate introduced by #9.The new checks prevent the certification procedure from silently drifting toward mutable or privileged behavior:
contents: readwith no write scopes;pull_request_target, repository secrets, inherited secrets, and persisted checkout credentials are rejected;rev-parse HEADrather than following a default branch;Tests
Adds 16 focused Python tests covering:
A read-only, SHA-pinned workflow compiles the lifecycle/policy modules, runs the unit suite, and audits the checked-out procedure itself.
Stack
This PR is intentionally stacked on #9 (
agent/den-1418-candidate-smoke-gate) so it reviews only the procedure ratchet. Merge #9 first, then retarget or rebase this PR ontomainwithout weakening assertions.Exact-head validation
Head
4115a72d34ffc90eac7944ef230818e16cb367bbis green across every triggered workflow:30832165595;30832164056;30832166066; and30832164229.The PR remains draft solely because it is stacked on #9. No product or fixture assertions were weakened.
Linear
github.com/zed-pkgzed-pkg-test certification runbookzed-pkg-test executable procedure ratchets