feat: already-published PyPI staging and Flow 1.34.0 until-revoked objects - #30
Merged
Conversation
validate_staging still required a draft GitHub Release and a missing tag, so Flow 1.34.0 could not be admitted after the tag and PyPI files were already live. Add publication_mode already-published-pypi as a closed alternate: the tag may exist, a draft is not required, and observed PyPI sha256s must match the pypi-destination artifacts. Keep draft-before-tag for future versions.
Rebuild the remote-safe-synthetic receipts, workflow admission, and qualification-release/v2 with expires_at JSON null. Staging uses already-published-pypi against live PyPI 1.34.0 and the existing v1.34.0 tag. The campaign is a synthetic 1x3 summary, not MockMed production_acceptance. Objects stay under local-candidates/. They are not in the public evidence-registry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flow 1.34.0 is already on PyPI and the GitHub tag exists. The old staging check required a draft GitHub Release and a missing tag, so this version could not be admitted without inventing a draft.
This change adds
publication_modealready-published-pypi. That path lets the tag exist, does not require a draft GitHub Release, and requires the observed PyPI sha256s to match the admitted artifacts.draft-before-tagstays for later versions.The same PR rebuilds the unpublished Flow 1.34.0 remote-safe-synthetic objects with
expires_atJSON null (until revoked). The campaign is a synthetic 1 cell x 3 trials summary. It isn't the MockMed evals set, and it isn'tproduction_acceptance. The signedqualification-release/v2verifies against the new staging path.Objects stay under
local-candidates/. They are not inevidence-registry.json. Don't append a ledger row here. That belongs in a follow-up after CI is green.Opened by an agent session, not the founder.