[Abiorh001]

Workstream PR Trust Bundle

Change

WS-CLI-001-47 — Reject administrator bypass of CLI release approval.

Goal

Fail closed unless the release environment explicitly disables administrator
protection-rule bypass. Refs #562; this does not publish binaries or close that issue.

Intent And Planning Context

Change record contains the
bounded intent, allowed/prohibited paths, L1 routing, acceptance criteria and
remaining operational boundary. Fresh focused pre-code plan review passed.

What Changed

• The existing validate_environment requires can_admins_bypass is False.
• Existing valid controls still pass; true, null, missing, strings and numeric
  zero reject with an administrator-bypass error.
• The runbook documents the UI control and read-only GET verification.

Why It Changed

Required reviewers and self-review prevention do not prevent an administrator
from bypassing environment protection. The merged guard accepted that unsafe
configuration and unknown field values.

Design Chosen

Extend the existing guard, called before native dispatch builds and before
publication. Literal identity distinguishes Boolean false from numeric zero.
No new service, token, permission or write parameter is introduced.

Alternatives Rejected

Equality/truthiness admits unknown values or zero. A manual-only check leaves
the machine guard permissive. GitHub's documented environment update parameters
do not expose this setting; the runbook uses its documented UI control.

Scope Control

Allowed Files Changed

• scripts/check_cli_release_controls.py
• scripts/test_cli_release_controls.py
• docs/engineering/cli-release.md
• .commitrail/initiatives/WS-CLI-001/WS-CLI-001-47.md

Files Outside Stated Scope

None. Workflows, dependencies, permissions and GitHub settings are unchanged.

Product Behavior

• No Workstream product behavior changed.

Roadmap assessment: no capability/exposure/completion/next-dependency change.
The existing summary, CLI section, traces and dependency diagram already retain
protected-environment verification and first publication as outstanding. No
roadmap, overview or index edit is needed. No local sheet exports are present.

Evidence

Commands Run

python3 scripts/test_cli_release_controls.py
python3 scripts/test_cli_release_smoke.py
python3 scripts/test_package_cli_release.py
ruff check scripts/check_cli_release_controls.py scripts/test_cli_release_controls.py
ruff format --check scripts/check_cli_release_controls.py scripts/test_cli_release_controls.py
python3 scripts/check_markdown_links.py
python3 scripts/check_stale_workstream_wording.py
python3 scripts/check_stale_authorization_docs.py
python3 scripts/check_stale_artifact_contracts.py
python3 scripts/check_commitrail_records.py --base-ref origin/main
python3 scripts/reviewer_contracts.py
python3 scripts/check_stale_review_contracts.py
python3 -m unittest -v scripts.test_reviewer_contracts scripts.test_reviewer_instruction_composition scripts.test_review_claim_boundaries scripts.test_review_target scripts.test_commitrail_contracts scripts.test_commitrail_contribution_paths scripts.test_commitrail_archive_batch scripts.test_commitrail_markdown_structure scripts.test_lightweight_agent_gates scripts.test_stale_review_contracts
git diff --check

Result Summary

Replayed on clean candidate d634e19dc5d178758afd50a56071b09010cfc152, based on merged main a64ebf4257b972140ca0cf7f54a1e3fdb90103e4: 8 release-control, 2 exact-version, 7 archive tests and 218 canonical gate regressions pass, alongside Ruff, canonical static checks, links and diff checks. The exact negative tests detect six pre-fix assertion failures and the numeric-zero equality mutant. No backend/database delta remains relative to current main.

Acceptance Criteria Proof

• Literal false plus valid existing controls passes.
• Six negative cases fail against the unchanged merged guard at the new
  expected-ValueError assertions, then pass with the repair.
• An in-memory equality mutant is rejected by the numeric-zero subtest.
• Existing reviewer, branch and tag protections retain their tests.
• Only the four allowed files change; no publication or GitHub policy write.

Test Delta

Two tests added, with six negative cases. The valid environment fixture now
declares literal false. Existing tests remain; none removed, skipped or weakened.

Impact-Routed Reviewer Results

Current code SHA: d634e19dc5d178758afd50a56071b09010cfc152.

Fresh grouped review by /root/tui_native_plan_ci on this exact head: security PASS; CI integrity PASS; documentation PASS; no findings. This is one independent reviewer applying three explicit lenses, not three independent reviewers. Start/end target snapshots matched and were clean. The reviewer executed the 8-test release-control module and a numeric-zero equality mutant; inspected unchanged workflow call sites, permissions, source continuity, current roadmap and official GitHub UI/GET contracts. Compatible proof boundaries are executed pure-result allow/deny, negative workflow structure and document consistency. Exact-head hosted preview/full Backend and the unavailable live release environment remain outside that review's proof. The merged main repairs are preserved unchanged, and the PR delta remains the same four allowed paths, with only the reconciliation note updated.

Historical reviewed code SHA: 0c8bb5999132b06bc0cad8b30925eb1153e35c1f. The prior results below are historical after the new push, not current-head passing evidence.

These are advisory summaries, not private receipt custody. Start/end targets
matched and were clean for all tracks; no findings or repairs were required.

Reviewer / run	Result	Proof boundary and uncertainty
Security / release-security-20261023-0c8bb599	PASS	Executed pure allow/deny proof and equality-mutant rejection; inspected syntax-aware workflow/permissions. Eventual environment response remains unverified.
CI integrity / release-ci-20261023-0c8bb599	PASS	Parsed unchanged trigger/dependency/fail-fast/check placement and token split; independent truthiness-mutant rejection. Hosted preview/dispatch not inferred.
Documentation / docs-release-20261023-0c8bb599	PASS	Compatible document-consistency/contract-inspection proof against owner, current roadmap and official GitHub UI/GET contracts; equality mutant detected. Future environment-token visibility remains external.

All proof is compatible with its claimed boundary: executed pure_result for
the predicate, syntax/registry inspection for negative workflow structure, and
source comparison for document consistency. This does not claim hosted runtime
or publication custody. Those historical sessions are closed; fresh current-head grouped review is recorded above.

External Review

Current head: d634e19dc5d178758afd50a56071b09010cfc152; reconciled base: a64ebf4257b972140ca0cf7f54a1e3fdb90103e4.

Fresh exact-head proof: Agent Gates PASS; CLI preview all four native platforms and assembly PASS. The downloaded four archives plus SHA256SUMS pass package_cli_release.py verify for preview tag cli-v0.0.0 and merge-preview source 4d2e81adfe13b2d2d411473b78a6e7d93d159752, bound to this head/base. This is preview proof, not publication. Complete Backend remains pending; metadata-only skipped runs are not proof. Internal review has passed; this PR stays draft until fresh complete CI passes. CodeRabbit is not fresh until a substantive review of this head is confirmed; draft skips do not count. Eligible human review remains unavailable; no review request or approver contact is made.

Historical evidence at 0c8bb5999132b06bc0cad8b30925eb1153e35c1f, not proof for the current head:

• Agent Gates: PASS on the old head.
• CLI preview: four native platforms and assembly PASS; downloaded archives plus SHA256SUMS passed verification for preview tag cli-v0.0.0, PR merge commit 948b6c4bd6117c3eaa502b05adfaa75a6f13c44f (base 7f6a71a69, old head above). This was preview proof, not publication; dispatch-only guard and publish jobs were intentionally skipped.
• Backend: FAIL. Four execution lanes failed; full-suite failed its required-lane gate, so its final API drill, union validation and complete-execution evidence did not run. The API assertion, Celery isolation, fingerprint and Omni repairs were consolidated in Repair checker-only guide setup runtime and regression proof #670, whose exact-head Backend passed before it merged as the current base. That dependency proof does not replace this PR's fresh full-suite run.
• Metadata-only Backend: skipped, not full-suite proof.

This PR is not approved for merge or publication.

CI And Gate Integrity

• No workflow, lint/test, package script or dependency weakening.
• No action, permission, checkout or credential-path changes.
• Tests protect the failure boundary; no coverage-percentage gate.

Remaining Risks

cli-release still returns 404; its configuration must be verified separately.
Administrators can change repository policy later. Independent human approval
and immediate inspection of the environment and immutable-tag ruleset remain
required. An omitted GET field now safely refuses release preparation.

Follow-Up Work

#562 remains open until actual protected publication and public-asset audit.
No tag, release or workflow dispatch is created here. Approver coordination
remains with the product owner; no review request or contact is made here.

Human Review Focus

Inspect literal-false semantics (especially zero), unchanged read-token/job
boundaries, and UI configuration plus read-only verification instructions.

Human Merge Ownership

• I can explain what changed.
• I can explain why it changed.
• I know what could break.
• I accept the remaining risks.
• The user explicitly approved this specific PR for merge.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: afae41a1-86c0-4158-8341-95d330f5c476

📥 Commits

Reviewing files that changed from the base of the PR and between a64ebf4 and d634e19.

📒 Files selected for processing: 4

• .commitrail/initiatives/WS-CLI-001/WS-CLI-001-47.md
• docs/engineering/cli-release.md
• scripts/check_cli_release_controls.py
• scripts/test_cli_release_controls.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Abiorh001]

Fresh ready-state required Backend run 39998916314 completed successfully on unchanged head d634e19. Native release proof 39988829252 previously passed all four supported platforms and assembly. Final recheck: open, not draft, mergeable, no unresolved review threads. Ready for independent human review/approval; no merge, release publication, tag, deployment-setting change, or approver contact performed.