From 4c5a1d71500a40a950f9d2677acb037b2e2a36e2 Mon Sep 17 00:00:00 2001 From: Harrison O'Connor-Hoover <130776285+harrisonoconnorhover@users.noreply.github.com> Date: Thu, 1 Oct 2026 10:52:19 -0400 Subject: [PATCH] Record verified guided client candidate delivery --- HANDOFF.md | 18 ++++++------ tickets/DRUFF-32-guided-pipeline-journey.md | 31 +++++++++++++++++++-- 2 files changed, 38 insertions(+), 11 deletions(-) diff --git a/HANDOFF.md b/HANDOFF.md index 4895948..7a783bc 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -6,7 +6,7 @@ - Bound unsaved change previews to the draft, graph address and revision; running requires the reviewed content hash to match the saved graph. - Added recorded outcome explanations, missing-measurement handling and explicit retained-raw date repair with date/revision invalidation and safe retry keys. - Preserved loopback editing, OIDC/capability gates, graph conflicts, logs, cancellation and replay; corrected the existing font variable and toolbar overflow. -- Documented the experimental repair boundary and added a read-only production-client observation test for an already-completed native repair. +- Published candidate `0.2.0-rc.1` from protected source `eabceb21`; verified native repair through the production client and preserved active/rollback images. ## Try It @@ -14,13 +14,14 @@ In hosted mode, browse a graph, edit its source/output configuration, choose **P For real HTTP contract checks, start an ephemeral Dander Control API and use `DANDER_CONTROL_URL=... DANDER_EXPECTED_VERSION=... pnpm test:current-dander`. For an accepted native repair, use the explicit project, graph and run ID variables documented in README with `pnpm test:repair-observation`. +Pull `ghcr.io/harrisonoconnorhover/druff:0.2.0-rc.1`, paired with the published RC34 Control wheel in README. Immutable digest: `sha256:6aade12c399a67c604577e4a022af6dff22db7764626dd9a7a4f5cea1a2ceac1`. + ## Checks -- Passed 685 unit/component tests, nine artifact checks, TypeScript, ESLint, Prettier and static build against the verified published RC33 wheel; independent contract regeneration reports no drift. -- Passed all 11 Playwright journeys, including reviewed save/run, date invalidation, repair submission and existing conflict/retry behavior. Browser OIDC/API responses are synthetic. -- Passed real HTTP acceptance against published RC34 Control: exact hashes, canvas round trip, unsaved preview/save, stale rejection and truthful unsupported execution. Final RC34 regeneration/drift, 29 contract tests, 18 journey/API tests, TypeScript and focused lint passed; its bundle is unchanged. -- Visually inspected the synthetic browser screenshot; font and horizontal overflow defects are corrected. A focused test also confirms late explanations cannot replace newer run status. -- PR #25 initially found three fixed high Caddy dependency findings. Pinned x/crypto 0.55.0 and gRPC 1.83.2; CI `36870826744` passed both architecture scans, reproducibility, runtime checks and frontend/secret checks. +- PR #25 and exact-main CI `36877515144` passed: 685 unit/component tests, nine artifact checks, published-contract drift, lint/type/format/build, 11 Playwright journeys and container checks. Browser OIDC/API fixtures are synthetic; default guided-panel screenshot was visually checked. +- Real HTTP acceptance against published RC34 passed. Native observer read `run-ec3ecadaeb48d3cca4ccf537`: September 10–12 window, zero extracted, two written, four affected. Dander separately verified unchanged outside rows/raw/watermark, restored Job and complete temporary-resource cleanup. +- Both candidate architectures passed source-free/non-root runtime, routes/headers, reproducibility, SBOM/provenance and high/critical/secret scans. Existing Caddy findings were corrected with x/crypto 0.55.0 and gRPC 1.83.2. +- Copied the verified OCI bytes without rebuilding; anonymous public fetch matched the exact digest. Active/rollback digests stayed unchanged; local release builder/registry were removed. ## Decisions @@ -30,9 +31,8 @@ For real HTTP contract checks, start an ephemeral Dander Control API and use `DA ## Remaining -- Candidate version is `0.2.0-rc.1`, paired with published RC34 Control and the unchanged contract digest in README. This does not promote the RC20 public beta. -- Observe the separately authorized native repair once its accepted run ID is available; no provider workload was launched by Druff tests. -- Complete protected PR #25, exact-main checks and candidate image publication with the final RC34 pin. +- This is an integration candidate, not a promotion of Dander's RC20 public beta or other provider profiles. +- Source credentials and deployed environments still require operator setup; historical source recovery is outside this repair capability. ## Review First diff --git a/tickets/DRUFF-32-guided-pipeline-journey.md b/tickets/DRUFF-32-guided-pipeline-journey.md index 03429a3..baf4c3a 100644 --- a/tickets/DRUFF-32-guided-pipeline-journey.md +++ b/tickets/DRUFF-32-guided-pipeline-journey.md @@ -1,7 +1,7 @@ --- id: DRUFF-32 title: Guide graph configuration, reviewed runs and date repair -status: in-review +status: done component: frontend created: 2026-10-01 --- @@ -45,7 +45,7 @@ hashes and independent drift verification. RC34 fixes Control's native image ide the contract bundle is unchanged. Final real HTTP acceptance against RC34, 29 contract tests, 18 journey/API tests, TypeScript and focused lint passed. This GitHub candidate does not promote the RC20 PyPI beta. -Native repair success and cleanup remain separate operator qualification; +Native repair success and cleanup are recorded separately below; `pnpm test:repair-observation` reads an accepted run without launching another workload. Protected PR run `36869153273` passed frontend and secret checks but found three fixed high @@ -54,3 +54,30 @@ for CVE-2026-56854 and `google.golang.org/grpc` to `v1.83.2` for CVE-2026-84304 CVE-2026-84445. The existing Caddy version, image pins and scan policy remain intact. Protected run `36870826744` passed both architecture scans, reproducibility, runtime/routes/headers and frontend/secret checks with those replacements. + +## Delivered candidate + +[PR #25](https://github.com/harrisonoconnorhover/druff/pull/25) merged as +`eabceb21d7b1b38fcbccdf34f07772e89ea52f6a` through normal protection. Its final RC34-paired +head passed CI `36876247454`; [exact-main CI](https://github.com/harrisonoconnorhover/druff/actions/runs/36877515144) +also passed all frontend, browser, artifact and secret checks. + +Published `ghcr.io/harrisonoconnorhover/druff:0.2.0-rc.1` by copying the locally verified OCI +artifact without rebuilding. Anonymous fetch verified the exact public index: + +- Index: `sha256:6aade12c399a67c604577e4a022af6dff22db7764626dd9a7a4f5cea1a2ceac1` +- Linux/AMD64: `sha256:c03f82349d1f66d0f6b48c2c9db3b0d8b597953f1b387ca0191637a1b4573eea` +- Linux/ARM64: `sha256:d60a5383e07887ab5f071ce0cb1afc0e100fdbd797b25677e4f5792ca6ffac16` + +Both architectures passed non-root/source-free runtime, callback/probe/header/cache checks, +reproducible static-layer comparison, SBOM/provenance validation and high/critical vulnerability +and secret scans. Active `sha256:5ab559fe0c637407dd3398304d0480c73477cd770c073c92de4f8f2cda023eb9` +and rollback `sha256:bd1228bbe30a7f17ce3d0d9f9f4967e271a9b6fb9d010c8ffb648b2a8c19175d` +were unchanged. Task-owned local release builder/registry were removed. + +The real production-client observer passed at 14:34:17 UTC on October 1 against RC34 Control and +accepted native run `run-ec3ecadaeb48d3cca4ccf537`: September 10–12 window, zero extracted rows, +two output rows written and four affected. Dander's separate native proof used the verified RC33 +runtime, confirmed unchanged outside-window rows/raw/watermark and restored Job arguments, and +verified cloud/local cleanup by 14:37:02 UTC. This narrow proof does not promote the RC20 public +beta or qualify other provider profiles; browser OIDC/API journeys remain synthetic evidence.