Skip to content

perf(release-rc-cut): render the RC command blocks as code, one file per outcome - #1604

Open
potiuk wants to merge 3 commits into
mainfrom
perf/release-mgmt-1-rc-cut
Open

perf(release-rc-cut): render the RC command blocks as code, one file per outcome#1604
potiuk wants to merge 3 commits into
mainfrom
perf/release-mgmt-1-rc-cut

Conversation

@potiuk

@potiuk potiuk commented Oct 12, 2026

Copy link
Copy Markdown
Member

Summary

First of a stack that moves the release-management skills' deterministic work into code, the same deep split #1570–#1585 did for pr-management.

  • New tools/release-management package. It renders everything a release-* skill hands the release manager from what release-config load prints. Each skill is a subpackage the CLI discovers, so later PRs add commands without editing a shared file. It is stdlib-only and runs nothing: no git, gpg, svn, gh, aws or atr call, no key, no network.
  • release-rc-cut renders every block as code. That covers the signed tag, the reproducible source build, convenience artefacts, sign and checksum commands, per-backend staging, the ATR upload, the Step 2b self-check, the Step 2c CI-signed trigger and the Step 4 planning-issue comment with its reproducibility record (parsed from what repro-archive build printed).
  • SKILL.md becomes a router: 9,962 → 6,503 tokens, 696 → 459 lines. Each Step 0 blocker, refused render and self-check failure, plus the ATR staging notes, gets its own file. The prerequisites and references move to siblings. Every Golden rule, Hard rule and JSON contract is unchanged, and so are the headings the evals extract.

Security notes

Two rules the skill only stated in prose are now enforced in code:

  • Golden rule 5, the dist/release/ denylist, had no check anywhere. A svnpubsub staging URL under dist/release/ is now refused ({"ok": false, "refused": …}, exit 2).
  • An MD5 or SHA-1 digest is refused the same way (Golden rule 3).

The exact-match RC tag check (rc1 must not match rc10) is a tag-exists command.

Also in this PR

  • Archive-review step number. rc-cut, the release-config blocker text, release-build.md and reproducibility.md all said "Step 2f". In release-prepare that step composes the PR; the archive review is 2e.
  • test(agent-isolation), a separate commit. test_signing_in_flight_matches_the_whole_process_name failed whenever the workspace pytest hook ran from a commit made under the gpg-touch overlay's wrap: the inherited MAGPIE_GPG_TOUCH_WRAPPED_SIGNER makes the script report a signature in flight. The test helper now drops it. Reproduced before the fix, passing after.

Type of change

  • Skill change — eval fixtures updated below
  • Python package (new tools/release-management)

Test plan

  • prek run --all-files passes
  • tools/release-management: pytest (25) / ruff / mypy. This includes an integration test that renders from a real release-config load, so a renamed field on either side fails.
  • The model-graded suites step-2-tag-build-sign, step-2b-reproducibility and step-3-staging cases 1–2 (9 cases) are now pytest cases named after each former case.
  • release-rc-cut evals after the change: 7/7. That is step-0 6/6, plus the step-3 injection case, now given the real render output. The baseline before the change was 16/16.

Notes for reviewers

  • The body is still a little over the 5k budget, about 5.5k without the pre-flight block. What remains is the Golden and Hard rules, which I left word for word rather than reword without review.
  • The stack's later PRs: verify-rc, then vote-draft + vote-tally, promote + announce-draft, prepare, and audit-report + archive-sweep + keys-sync.
Was generative AI tooling used to co-author this PR?
  • Yes — Claude Code (Opus 5). I reviewed the diff and the test results; commits carry Generated-by:.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv

@potiuk potiuk added family:tools tools/* capability:resolve Close-out: invalidate, dedupe, CVE allocate, announcement family:release-management release-* skills substrate:release Tool substrate: release-artefact helpers (reproducible archive build, lint, comparison) labels Oct 12, 2026
@github-actions github-actions Bot added family:setup setup-* skills family:docs Docs, MISSION.md, READMEs family:ci .github workflows, prek, validators substrate:sandbox Tool substrate: agent isolation, egress control, settings audit substrate:framework-dev Tool substrate: build / validate / eval the framework itself labels Oct 12, 2026
potiuk added 3 commits October 13, 2026 14:06
@potiuk
test(agent-isolation): keep the wrapped-signer variable out of the pr…
8f947fd 
…obe tests

A commit made under the gpg-touch overlay's own `wrap` exports
MAGPIE_GPG_TOUCH_WRAPPED_SIGNER to its hooks. With it set,
signing_in_flight reports a signature whatever is running, so
test_signing_in_flight_matches_the_whole_process_name failed whenever
the workspace pytest hook ran from such a commit. _run now drops the
variable, so the probes see only the processes the test starts.

Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
@potiuk
perf(release-rc-cut): render the RC command blocks as code, one file …
a9aceb8 
…per outcome

release-rc-cut had the agent compose every paste-ready block by hand
from ~10k tokens of prose: the signed tag, the reproducible source build,
one sign and checksum command per artefact and digest, the per-backend
staging sequence, the ATR upload, the self-check and the planning-issue
comment with its reproducibility record. A new tools/release-management
package renders all of it from what `release-config load` prints;
the agent presents the block and keeps the judgement. The tool runs
nothing: no git, gpg, svn, gh, aws or atr call, no key, no network.

Two rules the skill only stated in prose are now enforced in code: a
svnpubsub staging URL under dist/release/ is refused (Golden rule 5 had
no check anywhere), and so is an MD5 or SHA-1 digest. The exact-match
RC tag check (rc1 must not match rc10) is a `tag-exists` command.

SKILL.md becomes a router (9,962 → 6,503 tokens): each Step 0 blocker,
the refused renders, the self-check failures and the ATR staging notes
get their own file, and the prerequisites and references move to
siblings. Every Golden rule, Hard rule, JSON contract and the headings
the evals extract are unchanged.

The model-graded step-2, step-2b and step-3 (cases 1-2) suites become
pytest cases named after each former case; step-0 and the step-3
injection case stay model evals, the latter now given the real render
output. An integration test renders from a real `release-config load`,
so a renamed field on either side fails.

Also fixes the archive-review step number: rc-cut, the release-config
blocker, release-build.md and reproducibility.md said "Step 2f", which
in release-prepare is composing the PR; the review is 2e.

Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
@potiuk
fix(release-management): quote every configured value in the rendered…
a1e7c62 
… commands

The release manager pastes these blocks into a shell, so a value taken
from configuration (an archive prefix, an artefact name, a staging URL)
must never be able to expand there. A new release_management.shell
module provides dq (a double-quoted word with \\, ", $ and backquote
escaped) and w (a bare word, unchanged when plainly safe or a
<placeholder>, otherwise shell-quoted), and every rc-cut renderer uses
them. Ordinary values render byte-for-byte as before; a hostile one
comes out as inert text, which tests pin through a real shell.

Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
@potiuk
potiuk force-pushed the perf/release-mgmt-1-rc-cut branch from 52edbe9 to a1e7c62 Compare October 13, 2026 13:11
@potiuk potiuk mentioned this pull request Oct 13, 2026
Open
7 tasks done
@potiuk
potiuk added this pull request to stack #1620 October 13, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

capability:resolve Close-out: invalidate, dedupe, CVE allocate, announcement family:ci .github workflows, prek, validators family:docs Docs, MISSION.md, READMEs family:release-management release-* skills family:setup setup-* skills family:tools tools/* substrate:framework-dev Tool substrate: build / validate / eval the framework itself substrate:release Tool substrate: release-artefact helpers (reproducible archive build, lint, comparison) substrate:sandbox Tool substrate: agent isolation, egress control, settings audit

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@potiuk