From 072ac3e76fce100ff8e3e043d47a50a02f822ed2 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Tue, 18 Aug 2026 15:47:17 +0200 Subject: [PATCH 1/3] :lock: build(go): pin toolchain go1.26.6 so builds ship a patched stdlib SEC-01 (agent-context/PROJECT-AUDIT-2026-08-18.md): release.yaml resolves the Go version from go.mod, which pinned only the go 1.25.0 language level - so shipped binaries embedded the unpatched go1.25.0 stdlib while verify.yaml ran govulncheck on "stable", scanning a stdlib the artifacts never contained. The toolchain directive converges release, verify, and local dev on go1.26.6 (govulncheck clean; language level unchanged). --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index 4ff9ee3..02e79ee 100644 --- a/go.mod +++ b/go.mod @@ -3,6 +3,8 @@ module github.com/PlatformRelay/assent go 1.25.0 +toolchain go1.26.6 + require ( github.com/google/cel-go v0.31.0 github.com/hashicorp/hcl/v2 v2.24.0 From 00a72ea3ea4fd04fb52e80c69f6fd2b44a6b3fef Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Tue, 18 Aug 2026 15:47:41 +0200 Subject: [PATCH 2/3] :memo: docs(backlog): track the D-145 writes-gate lane as WG-S01 ARCH-01/DOC-01 (agent-context/PROJECT-AUDIT-2026-08-18.md): D-145 ordered a dedicated, independently-reviewed lane to enforce writes:false on the run path, but no backlog row existed - the one open commitment from the 2026-08-10 audit P1 was untracked. Spec-first; escalates back to P1 if unlanded at the next tag after the upcoming release. --- openspec/specs/backlog.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md index d076d9b..d4f0008 100644 --- a/openspec/specs/backlog.md +++ b/openspec/specs/backlog.md @@ -681,6 +681,21 @@ S02 cannot start until the operator creates the bestpractices.dev project (INBOX | SEC-SC-S01 | Native Go fuzz targets on YAML/JSON/HCL differ (+ CI smoke) | **[autonomous]** | none | **do first** — Scorecard Fuzzing (#3); untrusted-byte crash/fail-open fence | | SEC-SC-S02 | OpenSSF Best Practices passing badge + honest evidence page | **[operator-gated]** | operator creates the bestpractices.dev project | Scorecard CII-Best-Practices (#6); no fake README badge | +## Phase 5 — WG `writes: false` runtime gate (D-145) + +No spec yet — decompose spec-first (`openspec/` change proposal) before implementation, per +AGENTS.md rule 4. D-145 resolved OQ-29 as option (a): `PolicyProfile.spec.writes: false` becomes +runtime-enforced on `assent run`, as a third zero-write arm of the existing write switch +(`cmd/assent/run.go`), refusing `forge.Reconcile` when `aggregate.CoverWithProfile` yields +`Result.WriteAllowed == false`. The published stopgap annotation on +`docs/architecture/policy-profiles.md` is removed by this lane and no earlier. Tracked here per +PROJECT-AUDIT-2026-08-18 ARCH-01/DOC-01: the D-145 commitment previously existed in no backlog +row. **Escalates back to P1 if unlanded at the next tag after v0.2.0's successor.** + +| ID | Story | Execution | Depends on | Gate contribution | +| --- | --- | --- | --- | --- | +| WG-S01 | ⚠️ D-145: load covering profile on the run path; refuse `forge.Reconcile` when `WriteAllowed=false`; remove the docs stopgap annotation | **[autonomous · engine-grade · LGTM]** | spec-first proposal | published safety guarantee becomes true; verification target = zero forge writes against the fake under a `writes: false` profile (shape: `run_self_vouch_test.go`) | + ## Phases 3–5 Epic paragraphs (goal, ADR constraints, exit gate, story seeds) in From 0063f0da3193774caf74ef8e78a4c89e81be68f3 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Tue, 18 Aug 2026 15:47:55 +0200 Subject: [PATCH 3/3] :memo: docs(changelog): regenerate CHANGELOG.md for the dependabot bumps and audit fixes --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91ce609..ac04644 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -90,6 +90,11 @@ repository still gets a decision, never by following the link; no release carrie - build(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 - build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3 - :fire: chore(deps): drop dormant Renovate; Dependabot is the updater +- build(deps): bump github/codeql-action/upload-sarif +- build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 +- build(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7 +- build(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7 +- build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 ### Documentation - :memo: docs(decisions): record D-126 (D-031 domain deferred) and D-127 (SEC-05 PAT rotation scheduled) @@ -136,6 +141,8 @@ repository still gets a decision, never by following the link; no release carrie - :memo: docs(changelog): regenerate CHANGELOG.md for the AUD-S18 CHECK_STAGES fix - :memo: docs(changelog): regenerate CHANGELOG.md for the check_coverage_bar narrowing fix - :memo: docs(changelog): regenerate CHANGELOG.md for the stale-'15' cosmetic fix +- :memo: docs(backlog): track the D-145 writes-gate lane as WG-S01 +- :memo: docs(changelog): regenerate CHANGELOG.md for the dependabot bumps and audit fixes ### Features - :sparkles: feat(docs): gate example pack and format claims against dogfood @@ -162,6 +169,9 @@ repository still gets a decision, never by following the link; no release carrie - :recycle: refactor(examples): discover dogfood packs instead of a hardcoded 3-name loop - :art: style(audit): de-stale hardcoded '15 stages' literals in AUD-S18 gate +### Security +- :lock: build(go): pin toolchain go1.26.6 so builds ship a patched stdlib + ### Testing - :white_check_mark: test(release): anchor the D-120 note check on its header sentence, not the bare token - :white_check_mark: test(release): key the merge-skip proof on commit shape, not subject prefix