Skip to content

Align public repo to Gate A receipt; remove migration-era files#64

Merged
Born14 merged 2 commits into
mainfrom
cleanup/gate-a-alignment-2026-05-02
May 2, 2026
Merged

Align public repo to Gate A receipt; remove migration-era files#64
Born14 merged 2 commits into
mainfrom
cleanup/gate-a-alignment-2026-05-02

Conversation

@Born14
Copy link
Copy Markdown
Owner

@Born14 Born14 commented May 2, 2026

Why

The public repo had drifted. Tracked files still referenced the old DM-18 migration product, a 26-gate pipeline, the private `verify-engine` repo (whose links 404 publicly), and a Postgres parser the receipt product doesn't use. README cross-repo links would fail when clicked. The top-level `calibration/` directory still held the migration-era ledger.

If we want to push Gate A in front of readers, the public surface should be Gate A end to end.

What changed

Untracked migration-era files (kept locally, removed from public surface):

  • `src/action/`, `src/types-migration.ts`
  • `scripts/mvp-migration/{MEASURED-CLAIMS.md, grounding-gate.ts, safety-gate.ts, schema-loader.ts, spec-from-ast.ts, reports/calibration-postfix-2026-04-12.jsonl}`
  • `dist/action/libpg-query.wasm` (Postgres parser; receipt product has no SQL)
  • top-level `calibration/{shapes.json, attempts.jsonl, corpora.json}` (DM-15/16/18 era)

Replaced stale top-level calibration ledger with Gate A data:

  • `calibration/shapes.json` and `calibration/attempts.jsonl` copied from `dist/action/calibration/` so the public ledger and the bundled ledger are the same data.
  • `calibration/corpora.json` rebuilt from the engine's source-of-truth, listing only the six corpora Gate A attempts reference (`iac-grafana-v1`, `iac-argo-cd-v1`, `iac-airflow-v1`, `iac-k8s-manifests-v1`, `gha-calcom-v1`, `gha-triggerdev-v1`).

Rewrote two orientation docs in plain language:

  • `CLAUDE.md` — this repo is the public release surface; development lives in the engine repo; do not restore migration-era files.
  • `METHODOLOGY.md` — surface-agnostic description of the receipt, calibration discipline, the three promotion paths, and how to reproduce a digest.

Fixed broken cross-repo links in README and the two docs files. The public ledger is now in this repo at calibration/; the docs no longer reference a private repo or a CLI script that lives only in the engine.

Updated `.gitignore` so the removed migration-era files cannot drift back into the public surface (broadened `scripts/mvp-migration/` to whole-tree ignore, added `src/action/`, `src/action-v2/`, `src/types-migration.ts`, and made the `dist/action/calibration/` carve-out explicit).

What did NOT change

  • The Action bundle (`dist/action/index.cjs`) is byte-identical (md5 `84dde349...`).
  • Receipt output is unchanged. The canonical demo digest still reproduces: `sha256:bceed6d396217a7ef677e2701c7a657b0f3721bc73b2b77eba378c5c172e39cc`.
  • `action.yml` is unchanged (already Gate A).
  • `docs/GITHUB-ACTION-MVP.md` and `docs/VERIFY-RECEIPT-SAMPLE.md` content is unchanged except for the cross-repo link / CLI-instruction fixes.
  • The `v1` tag is NOT moved by this PR. If we want to move `v1` after merge, that is a separate decision.

Test plan

  • Skim README, METHODOLOGY, CLAUDE for tone (plain language, no marketing voice, no DM-* / 26-gate references).
  • Skim docs/ for any remaining `verify-engine` URLs or CLI invocations that reference engine-only scripts.
  • Verify `calibration/attempts.jsonl` lists the 10 Gate A attempts (CONTAINER-ROOT-01, K8S-MISSING-LIMITS-01, K8S-MISSING-PROBES-01 ×2, GHA-SHA-PIN-01 ×2, K8S-MISSING-SECURITY-CONTEXT-01, K8S-IMAGE-TAG-LATEST-01, DOCKERFILE-BASE-IMAGE-DIGEST-UNPINNED-01 ×2).
  • Verify `calibration/corpora.json` lists exactly the six corpora referenced by attempts.
  • Confirm the Action bundle still produces the canonical `bceed6d3` digest against the demo fixture.
  • Decide whether to move `v1` after merge; if yes, smoke-test the new bundle on a real PR before tag move.

🤖 Generated with Claude Code

The public repo had drifted: tracked files still referenced the old
DM-18 migration product, the 26-gate pipeline, and a private
verify-engine repo whose links would 404 for any reader.

This commit aligns the entire public surface to the Gate A receipt
product:

- Untracks migration-era source: src/action/, src/types-migration.ts,
  scripts/mvp-migration/{MEASURED-CLAIMS.md, grounding-gate.ts,
  safety-gate.ts, schema-loader.ts, spec-from-ast.ts,
  reports/calibration-postfix-2026-04-12.jsonl}, and the
  dist/action/libpg-query.wasm Postgres parser the receipt product
  does not use.

- Untracks the stale top-level calibration/ files (DM-15/16/18 era)
  and replaces them with the Gate A ledger: shapes.json and
  attempts.jsonl copied from dist/action/calibration/, plus a fresh
  corpora.json built from the engine's source-of-truth listing only
  the six corpora Gate A attempts reference.

- Rewrites CLAUDE.md with a Gate A-aligned orientation: this repo is
  the public release surface, development happens in the engine repo,
  do not restore migration-era files.

- Rewrites METHODOLOGY.md as a surface-agnostic, plain-language
  description of the receipt, calibration discipline, and the three
  promotion paths.

- Fixes README cross-repo links that pointed at the private
  verify-engine repo. The public ledger is now in this repo at
  calibration/.

- Fixes the docs' "reproducing a receipt" instructions to describe
  the deterministic-input guarantee instead of pointing at a CLI
  script that lives only in the engine repo.

- Updates .gitignore so the removed migration-era files cannot drift
  back into the public surface.

The Action bundle (dist/action/index.cjs) is unchanged. Receipt
output is unchanged. The canonical demo digest still reproduces:
sha256:bceed6d396217a7ef677e2701c7a657b0f3721bc73b2b77eba378c5c172e39cc.

Net: 21 files changed, 676 insertions, 3489 deletions.
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 2, 2026

VERIFY CHANGE RECEIPT
Kubernetes / Dockerfile / GitHub Actions
----------------------------------------------------------------
scope:   K8s 0 / Dockerfile 0 / GHA 0
checks:  7 calibrated
result:  CLEAR
digest:  sha256:8e85e0e742f8ba1bf0f2998eb524bc7735ab22a250a0497558f59d0bf0c9c216

Checks with no findings

  • [CLEAR] CONTAINER-ROOT-01
  • [CLEAR] K8S-MISSING-LIMITS-01
  • [CLEAR] K8S-MISSING-PROBES-01
  • [CLEAR] K8S-MISSING-SECURITY-CONTEXT-01
  • [CLEAR] K8S-IMAGE-TAG-LATEST-01
  • [CLEAR] GHA-SHA-PIN-01
  • [CLEAR] DOCKERFILE-BASE-IMAGE-DIGEST-UNPINNED-01

Not checked

Terraform, CloudFormation, Helm-templated YAML, Kustomize overlays, runtime cloud state, business logic, intent, recall, uncalibrated shapes.

Receipt artifacts: verify-receipt.md, verify-receipt.json. Digest: sha256:8e85e0e742f8ba1bf0f2998eb524bc7735ab22a250a0497558f59d0bf0c9c216.

action.yml description leads with the artifact (PR change receipt) and
names what the human gets, instead of overloading "calibrated" up front:

  Posts a PR change receipt showing what was checked, what was found,
  and what was not checked. Covers Kubernetes, Dockerfile, and
  GitHub Actions.

Also updates the lead sentences in README.md, CLAUDE.md, and
docs/GITHUB-ACTION-MVP.md so the public-facing copy doesn't echo the
old "calibrated K8s/Dockerfile/GHA change receipt" phrasing in its
first sentence. The claim is unchanged: same scope (K8s/Dockerfile/GHA),
same calibration discipline (mentioned later, not in the lead), same
honest "Not checked" framing.

action.yml inputs/outputs/runs unchanged. dist/action/index.cjs not
rebuilt — no behaviour change.
@Born14 Born14 merged commit 8d97ed4 into main May 2, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant