publish.yml github-release job now signs the wheel + sdist via
sigstore/gh-action-sigstore-python (pinned v3.3.0 / 04cffa1d), keyless OIDC,
and attaches the .sigstore.json bundles to the GitHub Release through the
existing dist/* glob. Added id-token: write to the job for OIDC.
PyPI uploads were already attested (Trusted Publishing); Scorecard's
Signed-Releases check inspects GitHub Releases, which only carried bare wheels
-> score 0. .sigstore.json is in Scorecard's recognized signatureExtensions.
Verified: action globs ./dist/*.whl ./dist/*.tar.gz (action.py:202), auto-attach
gated on release-event (we trigger on push:tags) so we upload via dist/* and set
release-signing-artifacts:false. First live proof = next v* tag.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
e2e-wheel.yml was the only workflow missing a top-level permissions: block
(added during cross-OS work after PR #624 hardened the rest), so it ran with
default broad GITHUB_TOKEN scopes -> OpenSSF Scorecard Token-Permissions = 0.
Add 'permissions: contents: read' to match the other 7 workflows. CHANGELOG
W24 entry.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windows Test + macOS Test only triggered on changes to setup.sh / drone/cli.py
/ handlers/__init__.py / pyproject.toml, but branch protection requires their
checks (windows-setup / macos-setup). On any PR not touching those paths the
workflows never ran, so GitHub parked the required checks as 'Expected —
waiting for status' forever, blocking merge — exactly what happened to PR #631
(the tests last ran + passed yesterday on the version-bump commit; tonight's
commits didn't match the filter so they never fired). The OS code is fine:
e2e-wheel's windows-latest + macos-latest passed on the same commits.
Fix: drop the paths filter; run on every push/PR to main/dev like the other
required lanes (CI/lint/coverage/security/e2e are none of them path-filtered).
A required status check must never be path-filtered or it stalls PRs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dependency-scan (pip-audit) was red: it scans the whole env, and the runner's
bundled pip 26.1.1 carries PYSEC-2026-196 (fixed in 26.1.2). The job was the
only CI job not upgrading pip. Now runs 'python -m pip install --upgrade pip'
before auditing — removes the vulnerable version outright instead of
suppressing it.
pip 26.1.2 also fixes CVE-2026-3219 and CVE-2026-6357 (both were pip vulns, per
pip-audit attributing them to the pip package), so the two now-stale
--ignore-vuln entries are removed — stale security ignores mask the exact CVEs
they name if those reappear elsewhere.
Verified in a clean reproduction of the job env (fresh venv, upgrade pip, pip
install -e ., pip-audit --skip-editable with NO ignores): 'No known
vulnerabilities found', exit 0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Final straggler: memory scored 98% (diagnostics 55% = 9 pyright errors) in CI
while 100% locally. Proven cause: the diagnostics standard runs pyright over
every branch; memory's handlers import chromadb/numpy at module level. These
are declared in the 'memory' optional-dependencies group, NOT 'dev' — and the
audit job installed only '.[dev]', so pyright flagged them unresolved
(reportMissingImports=error) → 9 false errors. My local .venv happens to have
chromadb, which is why local audits read 100%.
Fix: audit job installs '.[dev,memory]'. pyright now resolves memory's real,
declared deps and the standard measures actual type-correctness (and matches a
local audit). api imports openai (llm extra) but guards it lazily, so it stays
100% without that extra — only memory needed this.
12/13 were already green after the readme check-ignore fix; this clears the
13th.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The last 1%: 7 branches scored 99% in CI while 100% locally. Root cause proven
by reproducing CI's exact path (tracked-only tree + real .git): .gitignore
dir-only patterns (trailing slash — logs/, **/*_json/, .trinity/) do NOT match
via 'git check-ignore <bare-path>' when the path is absent from disk (clean
checkout), because git cannot infer 'directory' to apply a dir-only pattern.
The working tree has those dirs on disk, so it matched there — the exact
working-tree-vs-clean-checkout divergence.
_is_gitignored now also tests the trailing-slash form; all 7 readme failures
(cli_json/logs/artifacts/.trinity/ etc flagged 'missing on disk') clear.
Regression test builds a real git repo with dir-only patterns + non-existent
paths. CI gate also now prints failing standards + check messages (says WHY).
Verified: clean tree w/ real .git 13/13 100%; working tree 13/13 100%; seedgo
1053 tests green; pyright 0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The seedgo-audit gate passed everything at >=80% while all branches sit
at 99-100%, so it caught nothing. 100% is the floor: any drift names the
branch and reds the build. Expected to fail until the 6 branches at 99%
(aipass/api/drone/flow/prax/seedgo) reach a genuine 100%.
Fix dashboard plan-count zeroing + aipass bare-command introspection
Two verified bug fixes:
1. fix(flow): dashboard refresh no longer zeroes non-flow branch plan counts.
PLANS.central.json now comprehensive (all branches grouped per-branch).
Devpulse shows its 12 open plans again. +1 regression test, 734 pass.
2. fix(aipass): bare 'aipass <command>' runs instead of showing introspection
banner. All 7 modules fixed; 'aipass doctor' runs the health check.
Introspection moved to --info. seedgo standard bypassed for binary-invoked
modules. 424 tests pass.
Both verified independently: dashboard refresh writes active_plans=12 (was 0);
bare 'aipass doctor' runs the full check.
The real T1 Windows bug (diagnosed via the now-reverted error-surfacing
probe): aipass init scaffolds fine, then crashes printing its success
banner — Rich writes the success glyphs through a cp1252 stdout
(UnicodeEncodeError 'charmap'). Same class as the drone fix. The aipass
entry point now reconfigure()s stdout/stderr to UTF-8 in place on Windows.
Also: ci.yml's broad 'pytest --rootdir=.' swept in tests/e2e (which build
a wheel via the dedicated e2e-wheel.yml), failing the unit lane since the
harness landed; now --ignore=tests/e2e in both pytest jobs.
route_command error-surfacing probe reverted to honor 'no function change'
(the masked-error mislabel is noted as a separate @aipass recommendation).
Local: e2e 14/14 green, aipass units 24/24, ruff clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- publish.yml: new github-release job runs after PyPI publish, extracts the
top CHANGELOG section as release notes, attaches dist, creates the Release
via gh. Same v* tag now drives PyPI + GitHub Release.
- CHANGELOG W22 entry
* feat(system): fix(windows-ci): combine pip bootstrap fix + venv activation in Verify step
Combines both fixes needed to get windows-test.yml actually passing:
1. setup.sh: stop swallowing ensurepip errors (quiet + 2>/dev/null + || true was
hiding real failures — pip was silently not installed). Add get-pip.py fallback
and hard pip verification.
2. windows-test.yml: add 'source .venv/Scripts/activate' to Verify step. Each CI
step gets a fresh shell — setup.sh's venv activation doesn't carry over, so
drone wasn't on PATH in the subsequent step.
Together, these should take Windows CI from the 'silent failure every run since
creation' state to actually green. Supersedes PRs #330 and #331 which had the
fixes on separate branches (neither green alone).
Co-Authored-By: @devpulse <devpulse@aipass>
* feat(system): chore(lint): ruff auto-fix sweep — 303 errors across 178 files (F401 unused imports + F541 f-string placeholders + F811 redefined); restored report_error re-export + added logger call in errors.py
Co-Authored-By: @devpulse <devpulse@aipass>
---------
Co-authored-by: @devpulse <devpulse@aipass>
* feat(system): ci: add Windows setup test workflow — runs setup.sh + drone CLI verification on windows-latest GitHub Actions runner. Triggers on changes to setup.sh, handler __init__.py files, cli.py, or pyproject.toml. Closes the 'we never tested on Windows' gap.
Co-Authored-By: @devpulse <devpulse@aipass>
* feat(system): fix(windows): SIGPIPE guard in flow.py (#301) + fcntl platform guards in trigger/config.py and watchdog/registry.py (#302) — lazy import fcntl on Unix only, no-op on Windows. inbox_lock.py already cross-platform (msvcrt). ai_mail.py already guarded (hasattr check).
Co-Authored-By: @devpulse <devpulse@aipass>
* feat(system): fix(windows): handler guard backslash path fix — all 11 __init__.py files (#304). caller_file.replace('\\', '/') normalizes Windows paths before the same-branch check. This is the actual fix for #293 which was incorrectly closed. drone is completely broken on Windows without this.
Co-Authored-By: @devpulse <devpulse@aipass>
---------
Co-authored-by: @devpulse <devpulse@aipass>
- README with project overview
- pyproject.toml with trinity-pattern dependency
- src/aipass/ package with version
- Basic CI workflow (Python 3.10-3.13, ruff, pytest)
- MIT license
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
AIPass