Let a release read the guard evidence the commit already carries #63

Merged

PerishFire merged 1 commit from canonical-guard into main

2026-08-02 06:48:53 +00:00

PerishFire commented

2026-08-02 06:44:13 +00:00

Owner

The first stable attempt failed before it built anything.

The shared release workflow re-runs guard when the caller declares no guard
contexts. That fresh guard runs plumb doctor, and doctor had gone out of true:
Plumb shipped 0.18.10 and 0.18.11 between landing the candidate and promoting it.

out of true: cargo plumb resolves to 0.18.9, stable latest is 0.18.11

A release should not re-decide whether a commit is sound. That was decided when
the commit landed, and the answer is recorded against it — guard / guard (push)
is green on c081017. Declaring guard_contexts sends the shared workflow down
its canonical path, which requires that recorded evidence instead of recomputing
it. concord adopted this alongside its wrapperless profile, after these callers
were copied from it.

Without this, every release races the substrate's release cadence, and the race
is not winnable in general: a promotion takes longer than the gap between two
Plumb stables has been today.

Plumb follows to 0.18.11 in the same cut, because landing this needed a guard
that was itself in true.

The first stable attempt failed before it built anything. The shared release workflow re-runs guard when the caller declares no guard contexts. That fresh guard runs `plumb doctor`, and doctor had gone out of true: Plumb shipped 0.18.10 and 0.18.11 between landing the candidate and promoting it. ``` out of true: cargo plumb resolves to 0.18.9, stable latest is 0.18.11 ``` A release should not re-decide whether a commit is sound. That was decided when the commit landed, and the answer is recorded against it — `guard / guard (push)` is green on `c081017`. Declaring `guard_contexts` sends the shared workflow down its canonical path, which requires that recorded evidence instead of recomputing it. concord adopted this alongside its wrapperless profile, after these callers were copied from it. Without this, every release races the substrate's release cadence, and the race is not winnable in general: a promotion takes longer than the gap between two Plumb stables has been today. Plumb follows to 0.18.11 in the same cut, because landing this needed a guard that was itself in true.

PerishFire added 1 commit

2026-08-02 06:44:13 +00:00

Let a release read the guard evidence the commit already carries

guard / guard (pull_request) Successful in 3m43s

Details

guard / guard (push) Successful in 3m32s

Details

e271c1eb3e

The first stable attempt failed before it built anything: the shared release
workflow re-runs guard when the caller declares no guard contexts, that fresh
guard runs plumb doctor, and doctor had gone out of true because Plumb shipped
0.18.10 and 0.18.11 in the time between landing the candidate and promoting it.

A release should not re-decide whether a commit is sound. It already decided
that when the commit landed, and the answer is recorded against the commit.
Declaring guard_contexts sends the shared workflow down its canonical path,
where it requires that recorded evidence instead of recomputing it. This is
what concord adopted alongside its wrapperless profile, after these callers
were copied from it.

Plumb follows to 0.18.11 in the same cut, because landing this needed a guard
that was itself in true.

PerishFire merged commit e271c1eb3e into main

2026-08-02 06:48:53 +00:00

PerishFire deleted branch canonical-guard

2026-08-02 06:48:53 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

PerishLab/ensign!63

No description provided.

Rows
Columns