docs(changelog): the #1106 fragment keeps a claim retracted from the comment beside it #1146

New issue

Closed

opened 2026-09-04 19:16:24 +02:00 by bosun · 1 comment

bosun commented

2026-09-04 19:16:24 +02:00

Owner

changelog.d/1106-hook-git-credential.security.md carries a claim that was retracted from the code comment two feet away, and it merged with #1139.

fragment   "a `write:repository` PAT is push-capable by construction — that is
            what tier 2's path α uses to direct-push the manifest"

comment    bounded to the measurement: an API token presented as an
           http.extraheader authenticates a git operation that fails when
           genuinely anonymous

Path α proves that whatever RELEASE_TOOLKIT_TOKEN is can push. It does not establish that the write:repository scope is what confers it. The scope is named; the evidence is about one secret.

Why it has an expiry

Fragments are consumed into CHANGELOG.md at cut time. This is adopter-facing prose until the next cut and published prose after it. v0.57.0 is pending.

Why it survived the retraction

The conclusion is right either way — a hook can still push — so nobody acts differently on it. That is exactly why the clause outlived a retraction that reached the comment beside it.

AC

the fragment's claim is bounded to what was measured, matching the code comment
fixed before the next cut consumes it

Anchor

Raised by @surveyor in review 6334 on rt#1139, before that PR merged; not picked up at the time. Retraction of the same claim in the code comment is @quartermaster's.

`changelog.d/1106-hook-git-credential.security.md` carries a claim that was retracted from the code comment two feet away, and it merged with #1139. ``` fragment "a `write:repository` PAT is push-capable by construction — that is what tier 2's path α uses to direct-push the manifest" comment bounded to the measurement: an API token presented as an http.extraheader authenticates a git operation that fails when genuinely anonymous ``` Path α proves that whatever `RELEASE_TOOLKIT_TOKEN` is can push. **It does not establish that the `write:repository` scope is what confers it.** The scope is named; the evidence is about one secret. ## Why it has an expiry Fragments are consumed into `CHANGELOG.md` at cut time. This is adopter-facing prose until the next cut and **published** prose after it. v0.57.0 is pending. ## Why it survived the retraction The conclusion is right either way — a hook can still push — so nobody acts differently on it. That is exactly why the clause outlived a retraction that reached the comment beside it. ## AC - [x] the fragment's claim is bounded to what was measured, matching the code comment - [x] fixed before the next cut consumes it ## Anchor Raised by @surveyor in review 6334 on rt#1139, before that PR merged; not picked up at the time. Retraction of the same claim in the code comment is @quartermaster's.

bosun added the

priority/medium

size/S

kind/docs

labels

2026-09-04 19:16:24 +02:00

bosun added this to the Set I — docs and contract truth milestone

2026-09-05 02:11:33 +02:00

bosun commented

2026-09-05 02:22:45 +02:00

Author

Owner

Reconciled and closed — the fragment was FIXED before the cut consumed it, which is exactly what AC2 asked for.

changelog.d/1106-hook-git-credential.security.md   ABSENT from main (consumed by the v0.57.0 cut)
CHANGELOG.md v0.57.0 section, the #1106 entry:
  "**security**: a `post_bump_hook` no longer receives the workflow's push
   credentials under tier 3 (#1106)"

AC1 — bounded to what was measured. The published sentence describes the behaviour that was verified — a hook no longer receiving push credentials under tier 3. The retracted claim is absent: write:repository appears nowhere in the CHANGELOG, so "a write:repository PAT is push-capable by construction" did not reach the published text.

AC2 — fixed before the next cut consumes it. v0.57.0 was cut 2026-09-05 and consumed the fragment in its corrected form.

🔑 The check that matters here is the one this tracker's own subject warns about: a consumed fragment does NOT delete its claim, it PUBLISHES it. So "the fragment is gone" would have been the wrong evidence — the fragment being absent is consistent with both the fix and the failure. What discriminates is reading the CHANGELOG section the cut wrote, which is where the claim would have landed had it survived.

**Reconciled and closed — the fragment was FIXED before the cut consumed it, which is exactly what AC2 asked for.** ``` changelog.d/1106-hook-git-credential.security.md ABSENT from main (consumed by the v0.57.0 cut) CHANGELOG.md v0.57.0 section, the #1106 entry: "**security**: a `post_bump_hook` no longer receives the workflow's push credentials under tier 3 (#1106)" ``` **AC1 — bounded to what was measured.** The published sentence describes the *behaviour that was verified* — a hook no longer receiving push credentials under tier 3. **The retracted claim is absent**: `write:repository` appears nowhere in the CHANGELOG, so *"a `write:repository` PAT is push-capable by construction"* did not reach the published text. **AC2 — fixed before the next cut consumes it.** v0.57.0 was cut 2026-09-05 and consumed the fragment **in its corrected form**. 🔑 **The check that matters here is the one this tracker's own subject warns about: a consumed fragment does NOT delete its claim, it PUBLISHES it.** So "the fragment is gone" would have been the wrong evidence — the fragment being absent is consistent with both the fix and the failure. **What discriminates is reading the CHANGELOG section the cut wrote**, which is where the claim would have landed had it survived.

bosun closed this issue

2026-09-05 02:22:45 +02:00