Skip to content

Require blessed python-backend SHA for desktop stable promotion#9400

Draft
Git-on-my-level wants to merge 2 commits into
mainfrom
codex/desktop-requires-backend-blessing-v2
Draft

Require blessed python-backend SHA for desktop stable promotion#9400
Git-on-my-level wants to merge 2 commits into
mainfrom
codex/desktop-requires-backend-blessing-v2

Conversation

@Git-on-my-level

@Git-on-my-level Git-on-my-level commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • Require python_backend_sha on desktop_promote_prod.yml and validate the matching python-backend-bless-<sha> attestation (ancestor of the desktop release SHA)
  • Extract coupling logic into .github/scripts/check-desktop-python-backend-coupling.py with hermetic tests wired in repo-checks.yml
  • On audited desktop break-glass (I-ACCEPT-STABLE-PROMOTION-RISK + reason), skip the entire python coupling gate — no I-ACCEPT-UNBLESSED-PROD-RISK / --override-unblessed bridge, no fake release JSON
  • Workflow always records live_prod_check: NOT_RUN (attestation ≠ live prod; short-SHA Cloud Run tags stay runbook-only)
  • Terminology allowlist for protocol IDs (python-backend-bless-, bless-python-backend.sh, check-python-backend-blessing.py); operator language uses attestation/attested
  • Policy ratchet requires the coupling script + --desktop-target-sha / --python-backend-sha and forbids hardcoded unblessed override phrase in the promote workflow

Supersedes #9204

Rebuilt on current main after #9380 (qualification / stable-candidate lifecycle). Committee Improve-then-ship consensus applied on top of the initial gate.

Backend prod deploy blessing gate is a separate PR (successor to #9203); this PR stays independent because the python-backend blessing checker scripts are already on main.

Test plan

  • python3 .github/scripts/test_check_desktop_python_backend_coupling.py
  • python3 .github/scripts/check-desktop-prod-promotion-policy.py
  • python3 .github/scripts/check-desktop-release-terminology.py
  • python3 .github/scripts/test_check_desktop_release_promotion.py
  • python3 .github/scripts/test_check_python_backend_blessing.py
  • actionlint .github/workflows/desktop_promote_prod.yml
  • Dry-run review of workflow inputs in GitHub Actions UI after merge

@Git-on-my-level Git-on-my-level mentioned this pull request Jul 10, 2026
Closed
@Git-on-my-level

Git-on-my-level commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cursor address merge conflict

@cursor

cursor Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Merge conflict resolved and pushed.

Conflict: AGENTS.md — the desktop release pipeline bullet diverged between this branch and main.

Resolution: Combined both sides:

  • From main: daily build candidates, automatic digest/static/T2/fault-suite gates, automatic beta promotion, and DESKTOP_AUTO_BETA_ENABLED=false
  • From this branch: python_backend_sha requirement, runbook reference, and stable promotion details

Verification: All four policy/test scripts passed.

Status: PR #9400 is now MERGEABLE (no conflicts). mergeStateStatus: BLOCKED is likely from pending CI or review requirements, not merge conflicts.

Commit: 98480b3ad on codex/desktop-requires-backend-blessing-v2

Open in Web Open in Cursor 

Git-on-my-level and others added 2 commits July 11, 2026 07:30
@Git-on-my-level @cursoragent
Require attested python-backend SHA for desktop stable promotion
9dedde3 
Stable promotion now takes python_backend_sha, validates the
python-backend-bless release plus ancestry, and reuses audited
break-glass to bypass those checks after the #9380 lifecycle.

Co-authored-by: Cursor <cursoragent@cursor.com>
@Git-on-my-level @cursoragent
Extract desktop↔python-backend coupling gate with break-glass skip
03f1402 
Committee Improve-then-ship: move attestation+ancestry checks into a hermetic
script, skip the entire coupling gate on desktop break-glass (no unblessed
phrase bridge), and record live_prod_check: NOT_RUN honesty in the promote
workflow summary.

Co-authored-by: Cursor <cursoragent@cursor.com>
@Git-on-my-level
Git-on-my-level force-pushed the codex/desktop-requires-backend-blessing-v2 branch from 49d0831 to 03f1402 Compare July 11, 2026 00:31
@Git-on-my-level

Git-on-my-level commented Jul 11, 2026

Copy link
Copy Markdown
Collaborator Author

Monitor summary — rebased onto latest main

The branch was 3 commits behind origin/main after #9411 landed. The monitor's auto-rebase aborted on an AGENTS.md conflict (desktop release pipeline bullet diverged between this branch and main).

What changed: Resolved the AGENTS.md conflict by combining both sides — kept upstream's improved release pipeline description (daily batching, signed-smoke evidence, automatic beta promotion, DESKTOP_AUTO_BETA_ENABLED) and folded in this PR's additions (python_backend_sha attestation requirement, runbook reference, attestation≠live-prod nuance). No functional code changed; the diff stat is identical (452 insertions, 6 deletions across 10 files).

Verification (all pass):

  • python3 .github/scripts/test_check_desktop_python_backend_coupling.py — OK
  • python3 .github/scripts/check-desktop-prod-promotion-policy.py — OK
  • python3 .github/scripts/check-desktop-release-terminology.py — OK
  • python3 .github/scripts/test_check_desktop_release_promotion.py — OK
  • python3 .github/scripts/test_check_python_backend_blessing.py — OK
  • actionlint .github/workflows/desktop_promote_prod.yml — clean
  • All 13 CI checks green (Detect Changes, Hygiene, Static Contracts, Rust Backend, Desktop Swift Build & Tests, Desktop Swift Release Compile, Agent Runtime, Generated Files, Android Compile Smoke)

No review comments to address (zero reviews, zero inline comments on this PR). Branch is now current with origin/main and MERGEABLE.

@Git-on-my-level
Git-on-my-level marked this pull request as draft July 12, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Git-on-my-level