v0.30.0: CHANGELOG and version bump - #117
Merged
Merged
Conversation
The release notes lead with defects rather than features, because that is what this cycle produced. A design concept went to five reviewers -- a security architect, an STPA-Sec analysis, a ceremony operator, an adopting engineer and an independent certification assessor -- and all five dissented. The useful half of what they found was not about the design: it was live defects in shipped code, several in the exact failure class varve exists to close. A command that returned a value no script could use. A signing key written to /tmp on a shared runner, against this project's own published rule. An installer that reported success while a different varve won the PATH lookup. Output identifying a layer without saying which realm it belonged to. Two of thirteen requirements in scope reach `verified`. The rest are `implemented`, and the notes say why for each rather than leaving someone to discover it: the producer port is partial and the shell pipeline still runs the real deposits; carry-forward's gate needs the orchestrator that does not exist yet; payload smoke-running is deliberately unimplemented in favour of the architecture check, which covers all four platforms instead of one; and two requirements are verified by shell gates with negative controls that rivet cannot see, because it does not read markers from .sh files (rivet#870). The notes also record what this project cannot claim. Its own realm has one operator and cannot staff the two-person rule its documentation prescribed, and the provisional root has no backup at all -- it was generated straight into CI and its secret half exists only as a write-only Actions secret.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v0.30.0 work merged in #114; this is the bump and release notes.
The notes lead with defects rather than features, because that is what the cycle produced. A design concept went to five reviewers — a security architect, an STPA-Sec analysis, a ceremony operator, an adopting engineer and an independent certification assessor — and all five dissented. The useful half of what they found was not about the design at all:
varve whichreturned a two-line stdout, so$(…)yielded a non-path — the root cause of rolling layers lag the toolchain they pin: newest (2026.08.3) carries meld 0.42.0 / witness 0.39.0, four releases behind — adopting the pin would regress a consumer #102/tmp/rolling.keyon a shared runner, against this project's own published ruleinstall.shreported success while a different varve won the PATH lookupvarve inspectidentified a layer without ever naming its realmHonest scope
2 of 13 requirements reach
verified. The rest areimplemented, each with a stated reason in the notes:REQ-PRODUCER-002REQ-CARRYFORWARD-001REQ-PAYLOADSMOKE-001REQ-NOKEYDISK-001,REQ-INSTALLSHADOW-001rivetcannot see (rivet#870)Also recorded: this realm has one operator and cannot staff the two-person rule its own docs prescribed, and the provisional root has no backup at all.
Verified locally:
--lockedbuild, workspace tests, claim-check, docs coverage--strict,rivet validate, andvarve --versionreporting 0.30.0.