From f832334abe510fd2ca334ee5902afbf9fec40e0e Mon Sep 17 00:00:00 2001 From: cndgrr <59120057+cndgrr@users.noreply.github.com> Date: Wed, 5 Aug 2026 09:14:55 +0000 Subject: [PATCH] drill 0.6.0: probes 5 and 6, the setup corrections, and the disposal state --- drills/0.6.0.md | 100 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 90 insertions(+), 10 deletions(-) diff --git a/drills/0.6.0.md b/drills/0.6.0.md index 2415dc2..3ba6704 100644 --- a/drills/0.6.0.md +++ b/drills/0.6.0.md @@ -1,12 +1,9 @@ # 0.6.0 — drill record -**IN PROGRESS — this record is being written as the rehearsal runs.** It is -committed early so the candidate carries evidence at every head rather than -appearing at the end; the release PR is a draft until it is complete, and no -probe row below is written before its run exists. - Run 2026-08-05 by `cndgrr` against the 0.6.0 release PR (Refs #249), -candidate branch `build/249-release-0-6-0`. +candidate branch `build/249-release-0-6-0`, canonical candidate SHA +`fb8f8282a9e7b317d4d028f8e8da50501a882d14`. All six probes ran; every row in +the table below was written from its own run. ## Scope ruling — a full rehearsal is owed, and doors-unchanged is refused @@ -53,8 +50,13 @@ verbatim (`version-source: file`) over a fragment-mode fixture armed at one fragment, and a non-blank `drills/0.6.0.md`. The `release` label was created there before the first ceremony PR, per the guide's prerequisite. -_Disposal state is written below when the rehearsal ends, as this record's -author observes it — never as an intention._ +**Disposal, as this record's author observed it**: the repository is +**archived** — `PATCH /repos/cndgrr/ceremony-drill-0.6.0` with +`archived: true` returned `true`, and a fresh read afterwards reported +`archived=true private=true`. It is **pending the operator's delete**, which +this builder cannot perform: `delete_repo` is absent from fleet tokens by +doctrine (#135). No delete was attempted and none is claimed. Cleanup gates +nothing — not this PR's ready-for-review, not the panel, not the merge. ## Candidate-ref deviation @@ -85,8 +87,40 @@ One row per probe, written from its run. Runs are in | 2 | mislabeled ordinary PR | 30991634654 | ✅ green NOTICE no-op; no tag, no release | | 3 | bare-version PR without `release` | 30991832001 | ✅ refused at decide; no tag, no release | | 4 | re-run completed ceremony | 30992108742 (attempt 2) | ✅ refused at the nothing-exists assert; the release count stayed one | -| 5 | manual matching tag | — | — | -| 6 | mismatched tag | — | — | +| 5 | manual matching tag | 30992258952 | ✅ `0.6.1` published from its own changelog section; main untouched | +| 6 | mismatched tag | 30992310031 | ✅ refused before publication; no `9.9.9` release, and the probe tag was removed afterwards | + +### Probe 5 — a manual tag matching its tree + +Branch `probe5-tag` carried `VERSION` at `0.6.1` and a +`## 0.6.1 — 2026-08-05` section; tag `0.6.1` was pushed at that commit +(`dfd0cfeaca772cf45bcb63a1a639829185510c60`) with a personal token, so it +fired the door — the anti-recursion property probe 1 relies on is exactly +what makes a hand-pushed tag the only way to reach this door. The +`release-on-merge` job skipped and `release-on-tag` ran: the version assert +passed, notes were extracted, the release published. + +The branch, not main, carried the tagged tree on purpose — the tag door +takes no bump step, and pointing it at a side branch proves that without a +bare version ever sitting on main. Observed afterwards: `0.6.1` published +with exactly its own section's bullet, and main still reading `0.6.1-dev`, +untouched by the publish. Two releases now exist, `0.6.0` and `0.6.1`, +neither a draft, neither carrying assets. + +### Probe 6 — a mismatched tag + +Tag `9.9.9` was pushed at the same `0.6.1` commit. The door refused at its +first assert, before notes and before publication: + +```text +tag '9.9.9' does not match the tree's version '0.6.1' — creating nothing. +``` + +Notes, the artifact hook and publish all skipped. `GET /releases` still +returned exactly `0.6.1` and `0.6.0`. The `9.9.9` ref was deleted afterwards +(`DELETE /git/refs/tags/9.9.9`); `GET /git/refs/tags` then listed `0.6.0` +and `0.6.1` only. The probe tag was the operator's artefact, never the +workflow's — the door created nothing, which is the whole assertion. ### Probe 1 — the merge-door ceremony @@ -190,3 +224,49 @@ this probe — an unlabeled ordinary merge proves less than a labeled one — so the probe was re-run as PR #2 with the label applied through the REST endpoint and verified before merging. Recorded here because the run exists in the repo's history and a reader will find it. + +## Setup, and the runs that are not probes + +The armed fixture was committed before the caller, so the first door run had +a real parent version to inspect: run **30962040469** is that green baseline +no-op. The probes then ran in the order 2, 3, 1, 4, 5, 6 — the refusals +first, against an armed tree, so the ceremony itself ran last against a +fixture the refusals had already proven intact. + +Three non-probe runs are on the board and are accounted for here rather than +left for a reader to guess at: + +- **30991571096** (green) — PR #1, the unlabeled first attempt at probe 2, + described above. +- **30991892212** (green) — restoring `VERSION` to `0.6.0-dev` after probe + 3's refusal, so the ceremony probe met an armed tree. Row 2 of the table: + the version changed and still ends `-dev`. +- **30991958967** (red) — **a builder error, not a door finding.** An + uncommitted `VERSION` bump left over from staging the ceremony branch rode + along into a setup commit that was meant to touch only the fragments, and + pushed bare `0.6.0` straight to main. The door refused it exactly as it + refused probe 3, by the same row-5 path, and created nothing: tags and + releases were both still empty when the failure was read. Main was re-armed + to `0.6.0-dev` (green run **30992046247**) before the ceremony probe. It is + written down because a red run on a drill repo that the record does not + explain is indistinguishable from a door that failed. + +The fixture's three fragments were also rewritten mid-setup to carry +terminal issue citations. The candidate's own `bin/changelog-assemble` +refused them without one — `fragment 'changelog.d/1.md' has an entry with no +issue citation` — which is #262's rule, one of the two commits on +`lib/changelog.sh` that make this release owe a rehearsal at all. The +fixture had been written before that rule existed. The refusal is the guard +working; the correction is recorded because the fragments the ceremony +consumed are not the fragments the repo was created with. + +## What the rehearsal establishes + +Both doors ran live against the 0.6.0 candidate's own machinery. The merge +door published exactly one release from a labeled ceremony PR, tagged the +reviewed merge commit, and re-armed main itself; it refused a bare push +without a label, refused a re-run of its own completed ceremony, and stayed +a green no-op under a label carried by ordinary work. The tag door published +from a matching manual tag without touching main, and refused a mismatched +one before creating anything. Every refusal created nothing — no tag, no +release, on any of the four refusal paths.