release(v1.30.0): ship complete desktop at-rest encryption authority and verify migration/recovery #926

Activity

1. qnbs

   added

   P0

   on Sep 30, 2026
2. qnbs commented on Sep 30, 2026

   

   qnbs

   on Sep 30, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   Linear control-plane mirror

   • Linear: QNB-172
   • Project: v1.30.0 — Complete Desktop At-Rest Encryption
   • Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

   GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.
3. qnbs commented on Oct 3, 2026

   

   qnbs

   on Oct 3, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   PR #953 final-head checkpoint — 3c118bc652210a5861fe408e9d89e4893a66a3a0.

   • 15 files / 1925 meaningful lines / 4 signed commits
   • final mid-capture publication/rebind race fixed in one-file commit fix(core): make snapshot publication rebind atomic (#445)
   • deterministic interleaving test proves N→N+1 external commit between state observation and anchor read cannot poison AuthorityCell.current; exact key usability and exact anchor equality are proven before publication; subsequent capture remains usable
   • earlier read/snapshot P2s remain closed
   • CodeAnt legacy-write observation is partially valid but explicitly deferred to Successor B mutation/writer-admission owner; it does not invalidate the immutable pinned read proof and does not admit mutation scope into feat(core): admit protected reads through pinned snapshots (#445) #953
   • CodeQL, CodeAnt gates, Vercel, CHANGELOG/Text guards are green exact-head
   • DeepSource Rust and CodeScene remain advisory reds for already-dispositioned test-fixture/test-method metrics; no suppression or proof weakening
   • CI/CD still converging (Node 22/24 currently running at this checkpoint)
   • fresh Codex review on exact 3c118bc6... still pending
   • MERGE_READY = NO until terminal CI + fresh exact-head reviewer convergence
   • no Successor B / 4C; production authority switch remains NO
4. qnbs commented on Oct 4, 2026

   

   qnbs

   on Oct 4, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   PR #953 continuation authorization — 2026-10-04.

   Fresh Codex exact-head review on 3c118bc652210a5861fe408e9d89e4893a66a3a0 produced three VALID Read/Rebind P2s:

   1. prepared-only anchor changes can currently lock/strand a reader even though committed read authority did not change;
   2. KeyState::Locked cannot distinguish explicit lock from a stale previously-unlocked session, so same-key forward auto-rebind can violate explicit-lock refusal;
   3. before first capture, current=None provides no baseline, so a stale previously-unlocked runtime cannot rebind after an external same-key advance.

   NEW EXECUTION POLICY: these findings are explicitly authorized for further correction on #953. Do NOT stop merely because another fixable same-slice P2 appears. Continue correction → local proof → signed push → fresh exact-head review/CI cycles until #953 genuinely converges and can be merged normally. Only an unfixable platform/auth/protection blocker or a scope change into Successor-B mutation/root-recovery/4C may stop execution.

   Preferred common design direction: preserve a non-secret provider session-binding witness (scope + committed root, or equivalent) that survives stale-root detection but is cleared by explicit lock. Use it to distinguish explicit lock from stale binding and to establish a safe pre-first-capture baseline. Prepared-root-only changes must not be treated as read-authority changes; compare/revalidate the committed read-authority projection rather than the whole AnchorState where appropriate.

   #360 / QNB-12 remain open. Successor B remains mutation/root-recovery/lifecycle. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.
5. qnbs commented on Oct 14, 2026

   

   qnbs

   on Oct 14, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   2026-10-14 ~10:15 UTC — maintainer-prioritized bounded Dependabot integration train AFTER #1041 + #1042 (release-first)

   Maintainer direction: all Dependabot PRs already open and newly arriving during the waiting period must be inventoried and disposed of promptly immediately after (a) GitHub Pages #1028/PR #1041 is safety-approved, merged and its first real pruning pass verified, and (b) separately owned #1042 has completed every provably safe Vercel-generated GitHub deployment metadata cleanup and documented protected/unknown residuals. Then execute this bounded dependency train, verify resulting main/Production/retention and return immediately to R-15 Gate4 W1. Read-only Dependabot triage is allowed in parallel while waiting. A technically unsafe unremovable old GitHub deployment record must be preserved/documented, not allowed to stall Gate4 or the train forever.

   Live authenticated intake baseline (re-fetch before acting)

   Protected main=be3c875fac33bfdd628dce9c70c1fb0e42ac672d; 11 Dependabot PRs now OPEN/RFR:

   • #1043 Cargo tauri-deps 13-version group, includes prohibited tauri-plugin-updater 2.13.1 (repo src-tauri/Cargo.toml explicitly caps ~2.12.0 for Rust 1.77.2/MSRV; upstream 2.13 requires Rust 1.90), both Node Quality Gate failures and CI Success failed; Tauri Cargo/npm cross-surface parity must be established by actual pnpm run tauri-plugins:check, not bypassed. NOT MERGEABLE unchanged.
   • #1044 tokio 1.53.1 → 1.53.2 Tauri lockfile-only: PATCH, evaluate normal gates.
   • #1045 base64ct 1.6.0 → 1.8.3 Core: crates/worldscript-secure-storage/Cargo.toml explicitly documents 1.7+ requires Rust ≥1.81 vs 1.77.2 secure-store MSRV; Ubuntu Secure Store Platform Evidence FAIL. HOLD pending verified compatible alternative or formally separately admitted MSRV migration, never silently weaken 1.77.2 gate.
   • #1046 windows-sys 0.52.0 → 0.61.2: major crate-version change, require explicit Windows API/feature + MSRV review, real 3OS Secure Store and platform acceptance before merge; green partial CI insufficient.
   • #1047 dbus-secret-service 4.0.3 → 4.1.0: upstream minimum Rust 1.78 vs repo 1.77.2; Ubuntu Secure Store Platform Evidence FAIL. HOLD pending demonstrated compatible alternative or separately admitted MSRV migration.
   • #1048 GitHub Actions setup-node 6.5.0→7.1.0: requires immutable SHA pin/auth review; observed Reviewer Governance Trust Boundary FAIL and Core Rust Gate FAIL. Do not hide red by bundling.
   • #1049 GitHub Actions upload-artifact 7.0.1→7.0.2, same upstream references updated together.
   • #1050 already grouped 8 dev-tool updates including Storybook/Vitest: preserve this group and verify real Storybook, coverage/test-runner, prod build/E2E/lockfile integrity.
   • #1051 GitHub Actions download-artifact 8.0.1→8.0.2, group with other compatible Actions only if that reduces proven integration risk.
   • #1052 npm Tauri plugin-shell 2.3.6→2.4.0 across both package manifests and pnpm lockfile;
   • #1053 npm Tauri plugin-notification 2.4.0→2.5.1; both must honor independent Rust/npm tauri-plugins:check, and the Cargo matching version candidate may need fixing alongside build(deps): bump the tauri-deps group across 1 directory with 13 updates #1043.

   Merge-count optimization without diminishing merge protection

   No blanket 11-PR series is required. Dependabot has already grouped #1043 and #1050. Use conditional compatibility-driven composites only for tightly related changes:

   1. Actions integration: consider one small dedicated signed integration PR for build(deps): bump actions/setup-node from 6.5.0 to 7.1.0 #1048/build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #1049/build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #1051, all original immutable upstream SHAs/checks conserved. First resolve build(deps): bump actions/setup-node from 6.5.0 to 7.1.0 #1048's existing governance/Core failures and verify exact newest-head workflows; do not bundle to conceal a failure. Original Dependabot PRs must remain traceable; only close unmerged as superseded after the composite's protected merge + main proof.
   2. Tauri Cargo/npm integration: build(deps): bump the tauri-deps group across 1 directory with 13 updates #1043, build(deps): bump @tauri-apps/plugin-shell from 2.3.6 to 2.4.0 #1052, build(deps): bump @tauri-apps/plugin-notification from 2.4.0 to 2.5.1 #1053 (plus any additional matching npm updates arising) are a candidate atomic platform-version-parity slice, but updater stays pinned at ~2.12.0, Rust 1.77.2 gate intact; verify compatibility table first, test pnpm run tauri-plugins:check and genuine packaged desktop CI before adopting a composite. If not feasible in bounded scope, split/hold the affected updates without distorting W1/Gate5.
   3. Narrow independent patches: build(deps): bump tokio from 1.53.1 to 1.53.2 in /src-tauri #1044 Tokio and build(deps): bump windows-sys from 0.52.0 to 0.61.2 in /crates #1046 windows-sys may merit distinct merges; build(deps): bump windows-sys from 0.52.0 to 0.61.2 in /crates #1046 is not a trivial patch—Windows API/MSRV evidence mandatory. build(deps-dev): bump the dev-tooling group with 8 updates #1050 is already grouped: do not re-group unnecessarily. build(deps): bump base64ct from 1.6.0 to 1.8.3 in /crates #1045/build(deps): bump dbus-secret-service from 4.0.3 to 4.1.0 in /crates #1047 are verified policy-incompatible candidates and should be explicitly held rather than merged by disabling tests/pins.
   4. New arrivals: at the start of train and before each merge re-fetch all open dependabot[bot] PRs; import compatible items only if train budget, ownership, scope, lockfile/changelog requirements and exact-head checks permit. Otherwise assign explicit COMPATIBLE_NEXT_EPOCH / BLOCKED_MSRV / SUPERSEDED_CONFIRMED outcomes; never silently drop, reject/close or rubber-stamp every new PR. Freeze membership after a declared epoch so an unbounded bot stream cannot hold W1 hostage.

   Execution rules (binding): docs/DEPENDABOT-TRIAGE.md says NO Dependabot auto-merge, no blindly merged patches, one protected merge at a time, fully green PR suite (including advisory) + required CodeQL/security/reviewer census, followed by resulting-main full push CI before the next merge; genuine red main hard-stops the train. Signed maintainer commits, exact-head review and prior-change parity across Cargo/npm/workflows are required. No admin bypass, no preview/canonical alias or production promotion tricks. Normally Vercel SAFE retention is performed after each verified main merge unless an existing explicitly admitted Dependabot train batching policy allows a terminal once-per-train pass; always protect prod and preview aliases. No R-15 architecture/source scope on dependency composite. Respect ≤15 commits/≤3000 meaningful lines/≤30 files (and preferred smaller size). If any combo exceeds budget or needs unbounded review, use smaller successor(s) instead.

   Acceptance: Publish a dated 11+ PR census with each original number, compatibility verdict, composite/single mapping, exact SHAs, full reviews/CI, resulting-main CI+CodeQL/Production/retention proof, precise close/merged/superseded state; no false claims all updates shipped if MSRV-conflicting PRs remain. Train is finite; promptly resume #359 / QNB-168 W1. The user's marketing, approved Cosmic Indigo and broad product work remain post-v1.30. This decision does not authorize merging today while #1041/#1042 are pending.
6. qnbs commented on Oct 14, 2026

   

   qnbs

   on Oct 14, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   OVERRIDING MAINTAINER DECISION — 2026-10-14 ~13:14 CEST — 18 Dependabot PRs are POST-v1.30, not a pre-W1 train

   Supersedes this issue's earlier pre-W1 Dependabot train directive and GH #1042's prior train sequence. Maintainer explicitly requested "Dependabot post release soll erstmal alles so weiterlaufen". Do not merge, group into a new PR, rebase, recreate, close or auto-merge routine Dependabot PRs before v1.30.0 VERIFIED; leave them open with normal bot intake and no artificial workflow cancellation. Authenticated intake now 18 OPEN Dependabot PRs #1043–#1060; main a6ef4087270fb4ee014b73eae54bfefe33c3526b after #1041 with resulting-main CI/CD + CodeQL SUCCESS. One-off proven release-blocking security risk can go through the existing exception/admission process before release; an update being newer does not by itself qualify.

   Existing #1028 Pages-only automatic pruning is already enabled, but manual workflow_dispatch is read-only, no DELETE (run #38554851722 dry-run), next scheduled 2026-10-15 03:00Z writer opportunity. The maintainer also requests urgent immediate GitHub-Deployments UI reduction (143 reported, unverified exact count): GH #1042 now owns immediate, separately guarded GitHub API metadata cleanup of Vercel stale Preview records; do not wait for tomorrow's Pages schedule. Retain active Production, rollback and live Preview bindings; count 143 cannot be guaranteed to fall to single digits. If safe cleanup stalls on unprovable statuses, preserve them and resume R-15 W1 promptly instead of indefinite cleanup. Then Gate4→5→6→7→pre-tag truth→verified v1.30. No new workstreams or Source PRs for Dependabot now.

   The postrelease train is an existing #927/QNB-173 M8 P1 maintenance lane, after verified release: fresh bot-PR/graph inventory, immutable finite cohort, explicit MSRV/updater holds (#1043/#1045/#1047/#1056), parity checks, compatible bounded grouped integrations, independent reviews and full resulting-main gates between protected merges. Full maintained execution plan. Earlier comments are historical and do not authorize a pre-W1 train.
7. qnbs commented on Oct 14, 2026

   

   qnbs

   on Oct 14, 2026 – with ChatGPT Codex Connector

   Last edited by qnbs

   OwnerAuthor

   More actions

   2026-10-14 ~13:35 UTC — W1 #1061 MERGED; resulting-main required Security Audit FAIL (new rustls advisories)

   New live authority (supersedes any earlier W1 OPEN snapshot): W1 PR #1061 merged at 13:31:30 UTC into protected main=52776ad5f390d2d674bd9d4810f8d8fd21ddf569 from exact PR head 1e3afb3adfabbc6347f73866891725c1a65ef635. All 41 PR-head check runs completed without a failure. New main push CodeQL 38572508623 SUCCESS, but CI/CD 38572508634 FAILURE: job 🔒 Security Audit 115881353687 and downstream required ✅ CI Success 115881675794 failed. This is not postmerge terminal.

   Exact OSV log evidence: src-tauri/Cargo.lock resolves rustls 0.23.45, with RUSTSEC-2026-0346 (CVSS 4.0), -0347 (2.3), -0348 (3.7), -0349 (3.7); scanner recommends rustls 0.23.46, exits 1. Totals: 0 Critical / 0 High / 1 Medium / 3 Low. This is a real deterministic required security gate failure, not a transient test failure or authorization to suppress OSV. Upstream rustls 0.23.46 includes security fixes; test the smallest strictly scoped lockfile update compatible with existing Rust toolchain/MSRV and dependent platforms, not a general pre-release Dependabot train or broad Cargo updates. If incompatible, document the technical blocker and evaluate an equally narrow admissible alternative; no exemptions without established policy.

   Production ahead of qualification: Vercel dpl_6o9bUdGhu2a8MJTuKtU2Fw1GcuHM is READY on exact new SHA, with the three canonical aliases mapped, authenticated canonical HTTP 200. That is runtime availability, NOT a successful CI/security/release gate. Do not mark W1 postmerge terminal, trigger ordinary #627 Active-mode retention for this newly failed epoch, admit Gate5, switch storage authority, or tag v1.30 while current-main required CI is red. Protect all current/rollback/preview deployments and evidence. There is also a postmerge CodeAnt nitpick about a Busy recovery event mapped to Ok(None) in operations.rs:476–480; independently classify as follow-up or valid contract defect, do not silently declare it fixed.

   Next smallest action: Claude local, obeying signing/hooks/PR policy, inspects exactly rustls transitive dependency and Rust/MSRV compatibility, produces the smallest necessary security-correction PR if needed, gets complete exact-head reviews/CI/CodeQL, merges through protected workflow only when admitted, and verifies a new resulting-main successful CI/CD+CodeQL before Vercel Active-mode SAFE retention and terminal receipt. Avoid a repeat of the unchanged failed job. #1042 GitHub metadata operator cleanup remains independent but destructive operations require their own preserved safety proofs; #1028 Pages cron is separate. Routine Dependabot #1043–#1060 stays POST-v1.30, except this proven narrow security/release exception.

   Gates remain: GATE_4_TERMINAL=NO (W1 postmerge + remaining R1/I1/Q1/H1), GATE_5_IMPLEMENTATION_ADMITTED=NO, PRODUCTION_AUTHORITY_SWITCH_ALLOWED=NO, RELEASE_ALLOWED=NO.

   ---

   Actual admitted security exception now running — PR #1062 (2026-10-14 ~13:44 UTC)

   The issue's earlier rustls finding is now covered by PR #1062, OPEN/Ready head 87047e49782ab73f5b629c9db871a7cd97d53df3 against red main=52776ad5f390d2d674bd9d4810f8d8fd21ddf569. Independent diff readback: one commit, two files only (src-tauri/Cargo.lock updates only rustls 0.23.45 → 0.23.46 and checksum; plus CHANGELOG.md entry). No manifest or toolchain change; this is a narrow proven security blocker fix, not the pre-release Dependabot train.

   At check re-read: 37 registered; no failed; 🔒 Security Audit SUCCESS, CodeQL SUCCESS, CodeAnt Quality Gate PASS, Codex review completed, CodeScene approved and zero unresolved inline threads. 🦀 Tauri Rust Gate and Node22/24 Quality Gates IN PROGRESS; not merge-authorized until all exact-head checks finish and complete current substantive reviewer disposition. Sourcery's Needs a human reviewer assessment is advisory and calls for a genuine source/impact assessment, not false auto-approval. Maintain signing/hooks, current PR review policy, no --admin/auto/bypass or unverified merge.

   Once exact-head admission is genuinely complete, follow the repository's standard protected merge process, verify resulting-main push CI/CD and CodeQL SUCCESS on its new SHA, Pages deploy and current production exact SHA / all three aliases + canonical HTTP 200, then run only a new SAFE Vercel platform preview-retention epoch and publish #627 receipt. Do not retroactively label red 52776ad5 CI as SUCCESS; W1 source merge is fact, W1 postmerge terminal is still NO until recovered and remaining semantic review disposed.

   Keep #1042 independent: GitHub Deployment metadata safe pilot/batches require local authenticated status/inactive/DELETE and fresh mapping, not an unverified claim. #1028 first scheduled Pages writer remains 2026-10-15 03:00 UTC, distinct from #1042. Routine Dependabot #1043–1060 remains POST-v1.30 by maintainer override; this one patch is the documented genuine blocker exception.

   This paragraph supersedes the prior prompt's statement that the fix PR had not yet been opened, but preserves its initial forensic OSV evidence.

   ---

   Merge update 2026-10-14 ~14:15 UTC — #1062 MERGED; resulting-main requalification still RUNNING

   This supersedes the preceding #1062 OPEN snapshot only. Security PR #1062 has MERGED at 14:09:07 UTC (reviewed head 87047e49782ab73f5b629c9db871a7cd97d53df3) into protected main=53dee55c161aff804e56ce5a73ffb94949f5df21, fixing the reported rustls lockfile resolution. Exact new resulting-main CodeQL SAST #38577966012 is SUCCESS. Required CI/CD #38577966081 remains IN_PROGRESS; latest job readback: Security Audit SUCCESS, Tauri Rust + Node22/24 Quality Gates still in progress (no false all-green claim).

   Vercel Production dpl_7oSLmN8gNLrpe56yJeT1UUZR2hBM READY matches new exact main SHA, all three canonical aliases match and canonical HTTP 200 verified; this does not make postmerge CI terminal. Do not run the new W1/#1062 Active-mode Vercel platform retention until resulting-main required CI/CD and CodeQL are both SUCCESS; then check Pages actual publication/production+rollback and run only current epoch dry-run → SAFE reconcile → post-proof → #627 receipt. Earlier #1041 epoch stays terminal (do not repeat).

   #1042 remains a separate, incomplete Vercel-owned GitHub deployment record cleanup requiring Claude's fresh authenticated GitHub GET/status/Vercel checks and bounded verified pilot/batches, protecting Production/rollback/evidence/live Preview. No #1042 DELETE was performed by this checkpoint. #1028 first scheduled Pages-only writer is due 2026-10-15 03:00 UTC, its earlier manual success was read-only. Once postmerge terminal and bounded operator cleanup either safe-terminal or objectively blocked, continue Gate4 R1 → I1 → Q1 → H1 → Gate5/6/7 → release verification. Routine Dependabot 18 PRs remain post-v1.30. GATE_4_TERMINAL=NO, GATE_5_IMPLEMENTATION_ADMITTED=NO, RELEASE_ALLOWED=NO.
8. qnbs commented on Oct 14, 2026

   

   qnbs

   on Oct 14, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   LIVE release-path / review-capacity checkpoint — 2026-10-14 23:06 UTC

   Protected main 53dee55c remains exact-main CI/CD+CodeQL GREEN, Vercel production READY. Gate4 R1 PR #1063 remains OPEN/RFR at signed head 16f0f1f6 (14/15 commits, 26/26 inline threads resolved, latest 2 Node Quality Gates still IN_PROGRESS on exact SHA; final substantive Codex review not evidenced at latest SHA). Three latest Codex P2s fixed as a coherent correction at 16f0f1f6; further cosmetic review cycles are undesirable at the hard budget. Normal protected merge and independent substantive security review criteria still apply; under quota exhaustion, mark REVIEW_PENDING_QUOTA/NO_SIGNAL rather than manufacture PASS or weaken branch rules. Continue nondestructive proof/planning while high-risk merge is blocked, rather than pause the full sprint for days.

   R1_TEST_ONLY_FOUNDATION != R1_PRODUCTION_ENABLED: current Cargo-lock zero-dependents/test-support isolation prevents packaged reachability only in this repository graph, not future legitimate Gate5 production Cargo feature wiring. Known root/intermediate directory TOCTOU persists when test feature enabled; H1 handle-relative proof and R1 production enabler remain gating. GATE4_TERMINAL=NO, GATE5_ADMITTED=NO, PRODUCTION_AUTHORITY_SWITCH_ALLOWED=NO, RELEASE_ALLOWED=NO. Gate4 I1 must handle inherited-generation GC and stored-inventory 65,536-capacity concern; Q1-D1 remains pre-decided with separate source admission. Do not mistake a safe test-only merge for completion of all functional R1 acceptance.

   Ops: #1042 GitHub vercel[bot] deployment metadata lacks documented safe delete pilot; #1028 scheduled Pages write first opportunity 2026-10-15 03:00Z (future at this note); #627 Vercel-platform retention for main 53dee55c terminal, don't replay. Routine 18 Dependabot PRs remain POST-v1.30.0 VERIFIED per earlier supersession, never a pre-R1 train. Full current R-15 owner GH #359, QNB-145.