Skip to content

Audit 2026-08-18 fixes: changelog regen, go1.26.6 toolchain pin, D-145 backlog row #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
konih merged 3 commits into from
Aug 18, 2026
Merged

Audit 2026-08-18 fixes: changelog regen, go1.26.6 toolchain pin, D-145 backlog row #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
072ac3e
:lock: build(go): pin toolchain go1.26.6 so builds ship a patched stdlib
konih Aug 18, 2026
00a72ea
:memo: docs(backlog): track the D-145 writes-gate lane as WG-S01
konih Aug 18, 2026
0063f0d
:memo: docs(changelog): regenerate CHANGELOG.md for the dependabot bu…
konih Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,11 @@ repository still gets a decision, never by following the link; no release carrie
- build(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0
- build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.2.3
- :fire: chore(deps): drop dormant Renovate; Dependabot is the updater
- build(deps): bump github/codeql-action/upload-sarif
- build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0
- build(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7
- build(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7
- build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1

### Documentation
- :memo: docs(decisions): record D-126 (D-031 domain deferred) and D-127 (SEC-05 PAT rotation scheduled)
Expand Down Expand Up @@ -136,6 +141,8 @@ repository still gets a decision, never by following the link; no release carrie
- :memo: docs(changelog): regenerate CHANGELOG.md for the AUD-S18 CHECK_STAGES fix
- :memo: docs(changelog): regenerate CHANGELOG.md for the check_coverage_bar narrowing fix
- :memo: docs(changelog): regenerate CHANGELOG.md for the stale-'15' cosmetic fix
- :memo: docs(backlog): track the D-145 writes-gate lane as WG-S01
- :memo: docs(changelog): regenerate CHANGELOG.md for the dependabot bumps and audit fixes

### Features
- :sparkles: feat(docs): gate example pack and format claims against dogfood
Expand All @@ -162,6 +169,9 @@ repository still gets a decision, never by following the link; no release carrie
- :recycle: refactor(examples): discover dogfood packs instead of a hardcoded 3-name loop
- :art: style(audit): de-stale hardcoded '15 stages' literals in AUD-S18 gate

### Security
- :lock: build(go): pin toolchain go1.26.6 so builds ship a patched stdlib

### Testing
- :white_check_mark: test(release): anchor the D-120 note check on its header sentence, not the bare token
- :white_check_mark: test(release): key the merge-skip proof on commit shape, not subject prefix
Expand Down
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ module github.com/PlatformRelay/assent

go 1.25.0

toolchain go1.26.6

require (
github.com/google/cel-go v0.31.0
github.com/hashicorp/hcl/v2 v2.24.0
Expand Down
15 changes: 15 additions & 0 deletions openspec/specs/backlog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -681,6 +681,21 @@ S02 cannot start until the operator creates the bestpractices.dev project (INBOX
| SEC-SC-S01 | Native Go fuzz targets on YAML/JSON/HCL differ (+ CI smoke) | **[autonomous]** | none | **do first** — Scorecard Fuzzing (#3); untrusted-byte crash/fail-open fence |
| SEC-SC-S02 | OpenSSF Best Practices passing badge + honest evidence page | **[operator-gated]** | operator creates the bestpractices.dev project | Scorecard CII-Best-Practices (#6); no fake README badge |

## Phase 5 — WG `writes: false` runtime gate (D-145)

No spec yet — decompose spec-first (`openspec/` change proposal) before implementation, per
AGENTS.md rule 4. D-145 resolved OQ-29 as option (a): `PolicyProfile.spec.writes: false` becomes
runtime-enforced on `assent run`, as a third zero-write arm of the existing write switch
(`cmd/assent/run.go`), refusing `forge.Reconcile` when `aggregate.CoverWithProfile` yields
`Result.WriteAllowed == false`. The published stopgap annotation on
`docs/architecture/policy-profiles.md` is removed by this lane and no earlier. Tracked here per
PROJECT-AUDIT-2026-08-18 ARCH-01/DOC-01: the D-145 commitment previously existed in no backlog
row. **Escalates back to P1 if unlanded at the next tag after v0.2.0's successor.**

| ID | Story | Execution | Depends on | Gate contribution |
| --- | --- | --- | --- | --- |
| WG-S01 | ⚠️ D-145: load covering profile on the run path; refuse `forge.Reconcile` when `WriteAllowed=false`; remove the docs stopgap annotation | **[autonomous · engine-grade · LGTM]** | spec-first proposal | published safety guarantee becomes true; verification target = zero forge writes against the fake under a `writes: false` profile (shape: `run_self_vouch_test.go`) |

## Phases 3–5

Epic paragraphs (goal, ADR constraints, exit gate, story seeds) in
Expand Down