feat: pin the iss-35 crosscheck gate's scope and depth#141
Open
REPPL wants to merge 4 commits into
Open
Conversation
The iss-35 brief-surface crosscheck ran at a maintainer-chosen scope, so two honest runs of the same gate could disagree by two orders of magnitude and the receipt's promptHash was the literal "no-pinned-prompt" admission. Add a committed input manifest (manifest.json) that pins the 17 brief docs, the two directions, the checker count (22), and the prompt (with its own sha256). The crosscheck detector consumes the manifest instead of composing an ad-hoc list. The receipt gains two additive fields, tier and manifestHash, and receipt_gate adds three procedural refusals, all era-gated on the manifest's presence in the armed content tree: 1. manifestHash must equal the committed manifest's actual sha256; 2. tier (full/shallow) must be sufficient for the release's impact class; 3. every recorded finding must carry a disposition. The impact class is derived at gate time from the shipped records' impact frontmatter (changelog-driven versioning), not the version number: pre-1.0 an additive feature and a fix both bump the patch component, so only the records distinguish a feature release from a patch one. Every fallback (no CHANGELOG, git error, no prior tag, unclassifiable cut) falls back to the strict full tier. The refusals are procedural only and never judge a finding's content or severity; confirmed findings route to the maintainer whose PROMOTE with recorded dispositions is the gate. The refusals arm only when the manifest exists in the armed tree, so receipts committed for pre-manifest releases stay valid for their own commits. No existing receipt field is renamed, removed, or re-gated. Assisted-by: Claude:claude-opus-4-8
The pinned-crosscheck gate shipped, so iss-122's residue is closed. Impact internal: the manifest and its supporting docs live under .abcd/development/release-gate/ (excluded from the release artifact) and the receipt_gate change is era-gated on a manifest path that exists only in this repo, so it is invisible to other repos running record-lint — matching the iss-35 gate family (iss-35 and iss-121 both resolved internal). Assisted-by: Claude:claude-opus-4-8
The iss-122 review flagged that removing the committed manifest reverts the gate to pre-manifest rules by design (era marker). The backstop is a release.yml check — CI config, maintainer-gated — so the residue is recorded rather than fixed here. Assisted-by: Claude:claude-fable-5
Non-blocking review observations recorded behind the armed detector discipline: the ReadGuarded sibling divergence on the manifest read, the un-pinned example hash, and duplicate-key tolerance in the receipt parse. Assisted-by: Claude:claude-fable-5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the pinned crosscheck gate (ledger issue iss-122, tech-debt): the iss-35 brief-surface crosscheck's scope and depth are now committed, hashed, and tiered, so a PROMOTE means the same thing every release — v0.3.0's zero-findings receipt versus the full-depth run's 102 can no longer be two honest readings of one gate.
Chained PR: base is
chore/iss-35-ledger-resolve(#140). Merge order #136 → #137 → #138 → #139 → #140 → this; GitHub retargets automatically.What changed (the 2026-07-24 grill design, implemented exactly)
.abcd/development/release-gate/manifest.json: the 17 brief docs, both directions, the 22 checkers, and the sha256 of the pinned prompt (replacing the receipt's literalno-pinned-promptadmission). The crosscheck script consumes the manifest rather than choosing scope per run.full(both directions) required for additive/breaking releases;shallow(Direction-B only) sufficient for fix/internal. The release's class is derived from the shipped records (ShippedSince(base).Impact()), not the version delta — at 0.x the version folds additive into patch, so the records are the only honest source. Every ambiguity path fails closed tofull, including unlabelled added records.tierandmanifestHashonly; no existing field renamed, removed, or re-gated. Findings dispositions read a field already in the schema.Verification
shasumand the Go implementation.make preflightexit 0,record-lintexit 0.impact: internal(matches the gate family's precedents;.abcd/development/**is excluded from the release artifact, so no CHANGELOG entry).