From d9bbca43cb62c43938c9a91528de30f6d32e0326 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 13 Oct 2026 14:24:49 -0400 Subject: [PATCH 1/2] docs(source-control): record the promotion seam state after #4588 phases The resolver passes credential roots when the option is set. Name the remaining gaps: no host has an operator-owned bootstrap, the publisher's deployment and the resolver's freshness check on its sidecar wait on the merge-authority decision, and WSL and Windows lanes running as the operator are refused. Refs: #4588 Co-Authored-By: Claude Opus 5.5 --- .../docs-4588-seam-state-closeout-b231a2cb.md | 7 +++++++ .../promotion-evidence-implementation-plan.md | 7 +++++-- .../promotion-evidence-resolution.md | 19 +++++++++++-------- prompts/loops/loop-lane-prompts.md | 7 ++++--- 4 files changed, 27 insertions(+), 13 deletions(-) create mode 100644 .changes/source-control/docs-4588-seam-state-closeout-b231a2cb.md diff --git a/.changes/source-control/docs-4588-seam-state-closeout-b231a2cb.md b/.changes/source-control/docs-4588-seam-state-closeout-b231a2cb.md new file mode 100644 index 0000000000..240d9b509d --- /dev/null +++ b/.changes/source-control/docs-4588-seam-state-closeout-b231a2cb.md @@ -0,0 +1,7 @@ +--- +bump: patch +--- + +### Changed + +- babysit-loop promotion-evidence references record the seam state: the resolver passes credential roots when set, and the remaining gaps are an operator-owned bootstrap, the publisher's deployment and sidecar freshness check, and refused WSL and Windows lanes. diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md index b7fbd95e6f..515f2be42a 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md @@ -1,7 +1,10 @@ # Promotion-evidence trusted seam. Implementation plan (#4588) -Status: Phases 1 and 2 approved by the owner; Phase 2 is implemented. Phase 3 is unapproved and is -decided again after Phase 2 lands. Phase 3 is not implemented. +Status: Phases 1 and 2 are implemented. Phase 3 shipped in parts: the argv and e2e tests, the eval +cases, `--credential-roots` support, the resolver's writability check and win32 refusal, and the +evidence publisher in report mode. Remaining: an operator-owned bootstrap on a host, the +publisher's deployment, and the resolver's freshness check on its sidecar (the last two wait on the +merge-authority decision). Each phase needs the owner's approval before its code changes. This document sets scope and phases; Phase 1 does not wire the seam, and Phase 2 does. diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md index 67bea45885..8fd5c9d177 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md @@ -45,12 +45,15 @@ how a cell resolves effective-promoted or demoted. With no compliant bootstrap, any fail-closed reason, or a helper failure, **every promotable cell resolves effective-unpromoted** and autonomous merge stays off for C2/C3 classes regardless of tracked rung. Operators keep `--merge human-only` on launch lines; lifting it is the owner's call after Phase 3. -The resolver runs the checker with a fixed argv and passes no `--credential-roots` -(`resolve-promotion-evidence.mjs`), so a binding whose L2 proof rests on a filesystem credential -probe (for example a `$HOME/.netrc` path in the probe transcript) fails closed even with a -compliant bootstrap; [`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md) lists a -`--credential-roots` surface as out of scope -([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)). The unattended +The resolver passes `--credential-roots` to the checker when the operator sets +`promotion_evidence_credential_roots`; unset, a binding whose L2 proof rests on a filesystem +credential probe fails closed even with a compliant bootstrap. Three gaps remain open +([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)): no host has an +operator-owned bootstrap; the evidence publisher (`scripts/publish-promotion-evidence.mjs`) +exists, but its deployment and the resolver's freshness check on its sidecar are not done and wait +on the merge-authority decision; and a WSL or Windows lane running as the operator is refused under +the per-host requirements in +[`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md). The unattended merge path (`babysit_merge_policy.read_promotion`) additionally refuses any option value or settings file the lane can write, so on a single-user host user-scope settings never qualify there; only managed settings and surfaces owned by someone @@ -59,8 +62,8 @@ What an operator supplies for the seam is in [`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md), and the lane-start preflight in [`cycle-shape.md`](cycle-shape.md) step 0 reports each missing or non-compliant surface by option name. The implementation checklist and phased plan are in -[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md), Phase 2 -implemented and Phase 3 unapproved +[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md), status of +each phase ([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)). Whether the repository's evidence predicates ([`loop-lane-prompts.md`](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/prompts/loops/loop-lane-prompts.md) diff --git a/prompts/loops/loop-lane-prompts.md b/prompts/loops/loop-lane-prompts.md index 373eaa1888..ab8e36e135 100644 --- a/prompts/loops/loop-lane-prompts.md +++ b/prompts/loops/loop-lane-prompts.md @@ -76,9 +76,10 @@ Leave `{{MERGE}}` at `--merge human-only` unless the target repository's rung question has been decided the other way. This repository's tracked rung is `c2-mechanical` (unattended auto-merge launches at C2 only, #6202). Keep the override -until #4588 closes its remaining gaps (the checker gets no credential roots, -no host has an operator-owned bootstrap, and no publisher writes the evidence) -and the evidence predicate is met (see "C2 auto-merge may lack its +until #4588 closes its remaining gaps (no host has an operator-owned +bootstrap, the evidence publisher is not deployed and the resolver does not yet +check its sidecar's freshness, and WSL or Windows lanes running as the operator +are refused) and the evidence predicate is met (see "C2 auto-merge may lack its promotion evidence" under Known gaps). ## Per-repository profile From d0c7036a59cd37103bbf42841913ee73f405e445 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Tue, 13 Oct 2026 14:30:09 -0400 Subject: [PATCH 2/2] docs(source-control): drop the phase-status snapshot from the promotion docs Point to #4588 for which phases shipped and what remains, and keep only current behavior in the seam-state paragraph. Co-Authored-By: Claude Opus 5.5 --- .../promotion-evidence-implementation-plan.md | 6 +----- .../reference/promotion-evidence-resolution.md | 15 ++++----------- 2 files changed, 5 insertions(+), 16 deletions(-) diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md index 515f2be42a..4a561559ab 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-implementation-plan.md @@ -1,10 +1,6 @@ # Promotion-evidence trusted seam. Implementation plan (#4588) -Status: Phases 1 and 2 are implemented. Phase 3 shipped in parts: the argv and e2e tests, the eval -cases, `--credential-roots` support, the resolver's writability check and win32 refusal, and the -evidence publisher in report mode. Remaining: an operator-owned bootstrap on a host, the -publisher's deployment, and the resolver's freshness check on its sidecar (the last two wait on the -merge-authority decision). +Which phases have shipped and what remains: [#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588). Each phase needs the owner's approval before its code changes. This document sets scope and phases; Phase 1 does not wire the seam, and Phase 2 does. diff --git a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md index 8fd5c9d177..d630b3c559 100644 --- a/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md +++ b/plugins/source-control/skills/babysit-loop/reference/promotion-evidence-resolution.md @@ -44,16 +44,10 @@ reports each promotable cell's bound and effective state as the checker printed how a cell resolves effective-promoted or demoted. With no compliant bootstrap, a step 0 problem, any fail-closed reason, or a helper failure, **every promotable cell resolves effective-unpromoted** and autonomous merge stays off for C2/C3 classes regardless of tracked rung. -Operators keep `--merge human-only` on launch lines; lifting it is the owner's call after Phase 3. +Operators keep `--merge human-only` on launch lines; lifting it is the owner's call. The resolver passes `--credential-roots` to the checker when the operator sets `promotion_evidence_credential_roots`; unset, a binding whose L2 proof rests on a filesystem -credential probe fails closed even with a compliant bootstrap. Three gaps remain open -([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)): no host has an -operator-owned bootstrap; the evidence publisher (`scripts/publish-promotion-evidence.mjs`) -exists, but its deployment and the resolver's freshness check on its sidecar are not done and wait -on the merge-authority decision; and a WSL or Windows lane running as the operator is refused under -the per-host requirements in -[`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md). The unattended +credential probe fails closed even with a compliant bootstrap. Remaining work is tracked in [#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588). The unattended merge path (`babysit_merge_policy.read_promotion`) additionally refuses any option value or settings file the lane can write, so on a single-user host user-scope settings never qualify there; only managed settings and surfaces owned by someone @@ -62,9 +56,8 @@ What an operator supplies for the seam is in [`promotion-evidence-bootstrap.md`](promotion-evidence-bootstrap.md), and the lane-start preflight in [`cycle-shape.md`](cycle-shape.md) step 0 reports each missing or non-compliant surface by option name. The implementation checklist and phased plan are in -[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md), status of -each phase -([#4588](https://github.com/melodic-software/claude-code-plugins/issues/4588)). Whether the +[`promotion-evidence-implementation-plan.md`](promotion-evidence-implementation-plan.md). +Whether the repository's evidence predicates ([`loop-lane-prompts.md`](https://raw.githubusercontent.com/melodic-software/claude-code-plugins/main/prompts/loops/loop-lane-prompts.md) merge-lane copy-blocks) are met is not settled here; the fail-closed table below is how this