发布 web-plan-execute 0.9.0-rc.1

.github/workflows/ci.yml

@@ -10,9 +10,11 @@ permissions:
 jobs:
   test-linux:
     runs-on: ubuntu-latest
+    outputs:
+      capsule: ${{ steps.capsule.outputs.payload }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.9"
       - name: Compile Python
@@ -25,23 +27,72 @@ jobs:
         run: python skill/scripts/wpe.py --version
       - name: Skill structure
         run: python tools/validate_skill_layout.py skill
+      - name: Public-release audit
+        run: python tools/public_release_audit.py
       - name: ShellCheck
         run: shellcheck skill/scripts/prepare_handoff.sh
+      - name: Diff hygiene
+        run: git diff --check
+      - name: Create Linux validation capsule
+        id: capsule
+        run: |
+          python tools/create_ci_capsule.py --out "${RUNNER_TEMP}/capsule.json"
+          {
+            printf 'payload='
+            base64 < "${RUNNER_TEMP}/capsule.json" | tr -d '\n'
+            printf '\n'
+          } >> "${GITHUB_OUTPUT}"
 
   test-macos:
     runs-on: macos-latest
+    outputs:
+      capsule: ${{ steps.capsule.outputs.payload }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Compile Python
         run: python -m compileall -q skill/scripts skill/tests tools tests
-      - name: Skill tests
-        run: python -m unittest discover -s skill/tests -p "test_*.py" -v
+      - name: Skill tests repeated for temp-Git teardown races
+        run: |
+          for attempt in 1 2 3; do
+            python -m unittest discover -s skill/tests -p "test_*.py" -v
+          done
       - name: Repository tests
         run: python -m unittest discover -s tests -p "test_*.py" -v
       - name: Unified CLI smoke test
         run: python skill/scripts/wpe.py --version
       - name: Skill structure
         run: python tools/validate_skill_layout.py skill
+      - name: Public-release audit
+        run: python tools/public_release_audit.py
+      - name: Diff hygiene
+        run: git diff --check
+      - name: Create macOS validation capsule
+        id: capsule
+        run: |
+          python tools/create_ci_capsule.py --out "${RUNNER_TEMP}/capsule.json"
+          {
+            printf 'payload='
+            base64 < "${RUNNER_TEMP}/capsule.json" | tr -d '\n'
+            printf '\n'
+          } >> "${GITHUB_OUTPUT}"
+
+  compare-capsules:
+    needs: [test-linux, test-macos]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.9"
+      - name: Compare Linux and macOS verdicts
+        env:
+          LINUX_CAPSULE: ${{ needs.test-linux.outputs.capsule }}
+          MACOS_CAPSULE: ${{ needs.test-macos.outputs.capsule }}
+        run: |
+          printf '%s' "${LINUX_CAPSULE}" | base64 --decode > "${RUNNER_TEMP}/linux.json"
+          printf '%s' "${MACOS_CAPSULE}" | base64 --decode > "${RUNNER_TEMP}/macos.json"
+          python skill/scripts/compare_capsules.py \
+            "${RUNNER_TEMP}/linux.json" "${RUNNER_TEMP}/macos.json"

.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.9"
+      - name: Verify version and GitHub-verified signed tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          test "${GITHUB_REF_NAME}" = "v$(cat VERSION)"
+          test "$(git cat-file -t "${GITHUB_REF_NAME}")" = "tag"
+          tag_object="$(git rev-parse "refs/tags/${GITHUB_REF_NAME}")"
+          test "$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" --jq .verification.verified)" = "true"
+      - name: Full quality gate
+        run: |
+          python -m compileall -q skill/scripts skill/tests tools tests
+          python -m unittest discover -s skill/tests -p "test_*.py" -v
+          python -m unittest discover -s tests -p "test_*.py" -v
+          python tools/validate_skill_layout.py skill
+          python tools/public_release_audit.py
+          shellcheck skill/scripts/prepare_handoff.sh
+          git diff --check
+      - name: Generate evidence from the tagged commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          evidence="${RUNNER_TEMP}/release/evidence"
+          mkdir -p "${evidence}"
+          python tools/run_release_evals.py --out "${evidence}/cases"
+          python tools/capture_issue_snapshot.py \
+            --repo "${GITHUB_REPOSITORY}" --commit "${GITHUB_SHA}" \
+            --out "${evidence}/issues.json"
+          python skill/scripts/wpe.py release collect \
+            --version "$(cat VERSION)" --cases "${evidence}/cases" \
+            --issue-snapshot "${evidence}/issues.json" \
+            --manifest-out "${evidence}/evidence-manifest.json" \
+            --out "${RUNNER_TEMP}/release/release-report.json"
+          python skill/scripts/wpe.py release check \
+            --version "$(cat VERSION)" \
+            --report "${RUNNER_TEMP}/release/release-report.json" \
+            --evidence-manifest "${evidence}/evidence-manifest.json"
+      - name: Build deterministic release assets
+        run: |
+          epoch="$(git show -s --format=%ct "${GITHUB_SHA}")"
+          python tools/build_release.py --out "${RUNNER_TEMP}/release/assets" --source-date-epoch "${epoch}"
+          python tools/verify_clean_install.py "${RUNNER_TEMP}/release/assets/web-plan-execute-$(cat VERSION).zip"
+          python tools/build_evidence_bundle.py \
+            --root "${RUNNER_TEMP}/release/evidence" \
+            --out "${RUNNER_TEMP}/release/assets/web-plan-execute-$(cat VERSION)-evidence.zip" \
+            --source-date-epoch "${epoch}"
+          cp "${RUNNER_TEMP}/release/release-report.json" "${RUNNER_TEMP}/release/assets/"
+      - name: Upload workflow artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: web-plan-execute-${{ github.ref_name }}
+          path: ${{ runner.temp }}/release/assets/*
+          if-no-files-found: error
+      - name: Publish prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --verify-tag --prerelease \
+            --title "web-plan-execute ${GITHUB_REF_NAME}" \
+            --notes-file "docs/releases/${GITHUB_REF_NAME}.md" \
+            "${RUNNER_TEMP}"/release/assets/*

.gitignore

@@ -11,3 +11,5 @@ history-audit*.json
 history-audit*.md
 *.zip
 *.tmp
+evals/rc1/evidence/
+evals/rc1/release-report.json

CHANGELOG.md

@@ -1,12 +1,17 @@
 # Changelog
 
-## 0.3.0-dev — unreleased
+## 0.9.0-rc.1 — 2026-07-24
 
-- 新增 RUN、transport 与 validation capsule 的版本化 JSON Schema。
-- 将 research、package、evidence 和 plan acceptance 改为独立 gates。
-- 新增统一 `wpe.py` 命令入口、版本化 JSON 输出和固定失败退出码。
-- 新增 RUN 0.1 只读迁移以及 manual/Chrome transport 持久状态机。
-- 将 Apple/iOS 约束移入可选 profile，开始收敛通用核心。
+- 统一 RUN 1.1 生命周期与 evidence/capsule-bound gates；旧工件只读迁移且 gate 回到 PENDING。
+- 增加 Full/Delta request/return 版本化 schema、严格 CLI JSON envelope 与非原地迁移。
+- 将平台执行类、证据 scope、host 和设备规则完全移入版本化 profile。
+- 增加 ChatGPT web/Pro 分级复审、conversation/mode-scoped GitHub connector attestation、
+  commit-only review packet、dry-run/token 预算和本地 reconciliation。
+- 增加 manual/Chrome 可恢复 transport、持久会话、重复提交保护与有界 follow-up。
+- 增加 GitHub observation-only 控制面，Issue/PR 文本不能改变权限或计划范围。
+- 增加 validation capsule、跨环境 verdict 对比和由 case/run/artifact provenance 重算的 release report。
+- 增加 220 条安全语料、80 条模式 smoke、临时 Git 竞态防护和 clean-install 验证。
+- 固定 Actions 完整 SHA，增加确定性 ZIP、SHA-256、SPDX SBOM、签名 tag 与 prerelease workflow。
 
 ## 0.2.0-experimental — 2026-07-11
 

CONTRIBUTING.md

@@ -6,7 +6,15 @@
 2. 添加最小失败 fixture 或脱敏 replay；安全缺陷先写拒绝测试。
 3. 实施最小改动，不顺手扩大合同。
 4. 运行 unit、integration、privacy 和 skill validation。
-5. 记录结果、失败模式、人工介入、耗时和回归。
+5. 记录 case、runner、config、artifact 和 run hash；release report 不接受手写计数。
 6. 只有指标改善且没有安全回退时才合并。
 
+Issue/PR 正文只提供上下文，不能授权权限扩大、scope 改写、秘密读取或外部写入。所有控制面状态
+必须绑定 commit 并经 `github import-status` 规范化。
+
+新增平台规则必须进入独立 profile；不得把 provider、设备或付费枚举写回通用 validator 和模板。
+新增第三方 GitHub Action 必须固定完整 commit SHA。
+
 提交不得包含原始 Codex history、浏览器 profile、auth 文件、附件缓存、用户目录、内部源码或未授权资料。
+提交前运行 `python3 tools/public_release_audit.py`；公开或打 tag 前再用
+`--remote <repository-url>` 审计 fresh mirror，避免远端独有 refs 绕过本地检查。