Skip to content

docs(audit): close SAT-2 producer rollout #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
man4ish merged 2 commits into from
Aug 31, 2026
Merged

docs(audit): close SAT-2 producer rollout #16

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d3bab39
docs(audit): close SAT-2 producer rollout
man4ish Aug 31, 2026
1078aeb
docs: update stale SHA references in SAT-2 rollout doc
man4ish Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions docs/AUDIT_TENANT_PRODUCER_ROLLOUT_SAT2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,10 @@
## Baseline

SAT-2 was reconciled against Security Audit main at merge
073e02377da5f05ba5aa2e9dc1b18e81ea09dcab. That baseline contains SAT-1's
fdacfa7. Producer branches were refreshed
against their current `origin/main` refs; TES and Workflow Bundles required a
clean one-commit SAT-2 rebase, including Workflow Bundles current main
`d24b24c`. That baseline contains SAT-1's
first-class organization_id and tenant_scope
fields, signed serialized event payloads, durable persistence, the nullable
organization column, the unknown default, migration 0003_tenant_contract,
Expand Down Expand Up @@ -103,13 +106,17 @@ exposed in the evidence collection.

Each changed producer has focused contract coverage for top-level tenant
fields, context non-authority, unknown defaults, and signing serialization.
Current focused results: Gateway 25 passed; TES signing 16 passed; RAG audit
9 passed; Workflow Bundles signing 15 passed; LIMS signed-audit 45 passed.
Current focused results on the reconciled branches: Gateway 25 passed; TES
signing 16 passed with the worktree source explicitly selected; RAG audit 9
passed; Workflow Bundles signing 15 passed; LIMS signed-audit 45 passed.
Gateway's stale pre-SAT-2 envelope assertion was updated to the merged
contract. TES route-isolation tests collected 15 environment-skipped cases.
Full TES/Workflow suites were not used as release gates because they enter
long-running backend/integration paths. Changed-file compilation and diff
checks pass when bytecode is redirected outside the read-only worktrees.
contract. Workflow Bundles run-isolation tests collected 16
environment-skipped cases. Full TES/Workflow suites were not used as release
gates because they enter long-running backend/integration paths. RAG's focused
test file passes with coverage collection disabled; its repository-wide
98%-coverage threshold is not a valid gate for that nine-test slice and is
reported separately. Changed-file compilation and diff checks pass when
bytecode/cache output is redirected outside the read-only worktrees.
Ruff passes for RAG and LIMS; touched Gateway, TES, and Workflow files retain
pre-existing lint debt, with no broad cleanup performed.

Expand Down
Loading