Permit verified generated CSS in release validation #24

Merged

erik merged 1 commit from task-c6b1f7e6-release-css-policy into main

2026-10-13 17:10:43 -05:00

erik commented

2026-10-13 17:06:10 -05:00

Owner

Entry and post-check status must be empty or exactly that one modification; staged/deleted/renamed/untracked files and all other tracked changes block publication. Pre-existing CSS must match a fresh isolated build of the recorded commit byte-for-byte. Preserve generated output; do not commit CSS just to satisfy the old cleanliness rule. No executable release guard currently exists: this updates the project release skill and its reference instructions together. Dockerfile and publishing workflow are unchanged.

Validation: skill validator, whitespace check, lint and 459 CI-mode tests; an isolated archive of the policy commit with npm ci/build reproduces the preserved CSS byte-for-byte. Normal CI and independent review are required. This PR contains only the two policy documents; the preserved generated CSS remains unstaged. Merge and production publication require separate human approval.

Todu: task-c6b1f7e6 (approved release-policy follow-up).

Release validation blocked API adoption because a successful clean-install build regenerated tracked CSS, even though the Dockerfile builds CSS and copies that build output into production. Permit only the verified, unstaged `src/styles/public.css` build output while retaining the clean source commit and every existing release, validation, approval and rollback gate. Entry and post-check status must be empty or exactly that one modification; staged/deleted/renamed/untracked files and all other tracked changes block publication. Pre-existing CSS must match a fresh isolated build of the recorded commit byte-for-byte. Preserve generated output; do not commit CSS just to satisfy the old cleanliness rule. No executable release guard currently exists: this updates the project release skill and its reference instructions together. Dockerfile and publishing workflow are unchanged. Validation: skill validator, whitespace check, lint and 459 CI-mode tests; an isolated archive of the policy commit with npm ci/build reproduces the preserved CSS byte-for-byte. Normal CI and independent review are required. This PR contains only the two policy documents; the preserved generated CSS remains unstaged. Merge and production publication require separate human approval. Todu: task-c6b1f7e6 (approved release-policy follow-up).

erik added 1 commit

2026-10-13 17:06:10 -05:00

docs: permit verified generated CSS during release validation

CI / build-lint-test (push) Successful in 39s

Details

881b9f6877

erik commented

2026-10-13 17:10:05 -05:00

Author

Owner

Review update

PR: #24 — open.
Task: task-c6b1f7e6.
Reviewed SHA: 881b9f6877df1473e4f9faed74a159c2921f197f, against merged PR23/main 22db169a7c68269301273a56bba73db5fd21563c.
Result: approved for the release-policy PR review stage only. This is not human merge, production release/deployment, or task-closure approval.

Scope and verification

Only .pi/skills/web-release/SKILL.md and docs/web-release.md change. No implementation, Dockerfile, workflow, package, or CSS commit changes. Commit whitespace check passes.
Both documents require empty porcelain-v1 status or exactly the unstaged tracked regular-file modification M src/styles/public.css. Other source/configuration/lockfile/generated changes, staged changes, deletions, renames and untracked files remain blockers. The recorded source SHA must remain fixed and current with origin/main; SHA/status are rechecked before tagging.
Fresh CSS is accepted only as output of a successful build of that recorded commit. Preserved pre-existing CSS additionally requires successful npm ci/build in an isolated checkout/archive of the same commit with matching dependency/toolchain versions and byte-for-byte equality. Failure or mismatch blocks acceptance; overwriting preserved output cannot manufacture provenance. This is consistent across entry, validation and tag gates, not permission to publish arbitrary dirty-tree bytes.
The PR and parent-session evidence report preserved CSS reproduced in isolated work/policy-source-check; that build was not rerun by this reviewer. The local checkout initially had only the intentionally unstaged CSS modification; this review did not edit files, stage CSS or run a build in that checkout.
Inspected the unchanged artifact pipeline: Docker builds CSS and copies the built src tree into runtime; Forgejo checks out GITHUB_SHA and publishes the tagged commit rather than workstation artifacts. The policy remains an agent-operated gate, not a new executable guard.
Main/source identity, semantic-version/tag uniqueness, build/lint/tests, production-image health/version/homepage verification, deployment configuration, backup/rollback readiness, explicit production approval, and publish monitoring gates remain intact. No CSS-only commit is required or justified.
Exact-SHA CI passed: CI / build-lint-test (push), run 83, successful in 39s, for the full reviewed SHA. Verified via Forgejo commit status after a bounded tool-driven wait: https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/83/jobs/0 . No runtime/browser/federation CI expansion. PR-reported local lint/459-test/skill-validator evidence was not independently rerun.

Task acceptance criteria (stage-limited)

met — Dev metadata and authoritative packaged spec: inherited merged PR23 evidence and prior independent review; no API changes in PR24.
partial / pending production gate — Production must publish the same verified contract after the separately approved normal deployment; not completed by this review.
met — Metadata/spec match the official archived reference: inherited PR23 verification, unchanged by this policy-only diff.
partial / pending production gate — Installed Doctor/authentication evidence covers dev; production post-deployment contract/authentication verification remains required.
partial / pending production gate — Preservation evidence covers dev/no migrations; live production content/media/data/credential/identity baselines, persistence, backup and rollback verification remain required.
met (pre-rollout review stage) — Exact-SHA normal CI and independent policy review pass; API addresses/adoption steps remain documented. Release-specific validation and production evidence must still be repeated/recorded through the release gates.

Criteria: 6 total; 3 met; 3 not fully satisfied, all partial/pending production gates; none not-evident.
Blocking review issues: 0.
Non-blocking warnings: 0.
Final verdict: approved, limited to this policy commit and pre-rollout review stage.
Required next steps: obtain separate explicit human merge approval; on reviewed up-to-date main repeat the full release/provenance/image/rollback checks and obtain release-specific production deployment approval before tagging/publishing. Record production Doctor and preservation evidence, then request the separate task-close gate. Task remains in progress. No merge, release tag, deployment or task closure was performed or approved.

### Review update - PR: https://forge.caradoc.com/erik/erikvancraddock.com/pulls/24 — open. - Task: `task-c6b1f7e6`. - Reviewed SHA: `881b9f6877df1473e4f9faed74a159c2921f197f`, against merged PR23/main `22db169a7c68269301273a56bba73db5fd21563c`. - Result: **approved for the release-policy PR review stage only**. This is not human merge, production release/deployment, or task-closure approval. #### Scope and verification - Only `.pi/skills/web-release/SKILL.md` and `docs/web-release.md` change. No implementation, Dockerfile, workflow, package, or CSS commit changes. Commit whitespace check passes. - Both documents require empty porcelain-v1 status or exactly the unstaged tracked regular-file modification ` M src/styles/public.css`. Other source/configuration/lockfile/generated changes, staged changes, deletions, renames and untracked files remain blockers. The recorded source SHA must remain fixed and current with origin/main; SHA/status are rechecked before tagging. - Fresh CSS is accepted only as output of a successful build of that recorded commit. Preserved pre-existing CSS additionally requires successful npm ci/build in an isolated checkout/archive of the same commit with matching dependency/toolchain versions and byte-for-byte equality. Failure or mismatch blocks acceptance; overwriting preserved output cannot manufacture provenance. This is consistent across entry, validation and tag gates, not permission to publish arbitrary dirty-tree bytes. - The PR and parent-session evidence report preserved CSS reproduced in isolated `work/policy-source-check`; that build was not rerun by this reviewer. The local checkout initially had only the intentionally unstaged CSS modification; this review did not edit files, stage CSS or run a build in that checkout. - Inspected the unchanged artifact pipeline: Docker builds CSS and copies the built src tree into runtime; Forgejo checks out GITHUB_SHA and publishes the tagged commit rather than workstation artifacts. The policy remains an agent-operated gate, not a new executable guard. - Main/source identity, semantic-version/tag uniqueness, build/lint/tests, production-image health/version/homepage verification, deployment configuration, backup/rollback readiness, explicit production approval, and publish monitoring gates remain intact. No CSS-only commit is required or justified. - **Exact-SHA CI passed:** `CI / build-lint-test (push)`, run **83**, successful in 39s, for the full reviewed SHA. Verified via Forgejo commit status after a bounded tool-driven wait: https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/83/jobs/0 . No runtime/browser/federation CI expansion. PR-reported local lint/459-test/skill-validator evidence was not independently rerun. #### Task acceptance criteria (stage-limited) 1. **met** — Dev metadata and authoritative packaged spec: inherited merged PR23 evidence and prior independent review; no API changes in PR24. 2. **partial / pending production gate** — Production must publish the same verified contract after the separately approved normal deployment; not completed by this review. 3. **met** — Metadata/spec match the official archived reference: inherited PR23 verification, unchanged by this policy-only diff. 4. **partial / pending production gate** — Installed Doctor/authentication evidence covers dev; production post-deployment contract/authentication verification remains required. 5. **partial / pending production gate** — Preservation evidence covers dev/no migrations; live production content/media/data/credential/identity baselines, persistence, backup and rollback verification remain required. 6. **met (pre-rollout review stage)** — Exact-SHA normal CI and independent policy review pass; API addresses/adoption steps remain documented. Release-specific validation and production evidence must still be repeated/recorded through the release gates. - Criteria: **6 total; 3 met; 3 not fully satisfied**, all partial/pending production gates; none not-evident. - Blocking review issues: **0**. - Non-blocking warnings: **0**. - Final verdict: **approved**, limited to this policy commit and pre-rollout review stage. - Required next steps: obtain separate explicit human merge approval; on reviewed up-to-date main repeat the full release/provenance/image/rollback checks and obtain release-specific production deployment approval before tagging/publishing. Record production Doctor and preservation evidence, then request the separate task-close gate. Task remains in progress. No merge, release tag, deployment or task closure was performed or approved.

erik merged commit f295eb2b22 into main

2026-10-13 17:10:43 -05:00

erik deleted branch task-c6b1f7e6-release-css-policy

2026-10-13 17:10:43 -05:00

erik referenced this pull request from a commit

2026-10-13 17:10:44 -05:00

Merge pull request 'Permit verified generated CSS in release validation' (#24) from task-c6b1f7e6-release-css-policy into main