reseed: auditable seed rebuild as a workflow (#14) #78

Merged

plat merged 3 commits from feat/reseed-workflow into main 2026-07-02 18:25:08 +00:00

Conversation 0 Commits 3 Files changed 2 +149

plat commented 2026-07-02 18:25:05 +00:00

Owner

Copy link

Closes #14. Dispatch → bin/seed on the runner (PLAT_PAT secret, optional gitops_ref) → scripts/reseed-verify.sh (V1 manifest incl. durable createdFrom, V2 bundle integrity, V3 authenticated origin-head refs, V4/V5 release content markers + agents pin) → automated reseed PR, which the coldstart gate validates by germinating from the new seed.

Substance validated manually on the runner host end-to-end: seed built from origin, full verify table PASS (2.2M). The workflow YAML gets its live proof from the first dispatch on main (workflow_dispatch cannot target branch-only workflows — Forgejo 500s; discovered here).

🤖 Generated with Claude Code

Closes #14. Dispatch → bin/seed on the runner (PLAT_PAT secret, optional gitops_ref) → scripts/reseed-verify.sh (V1 manifest incl. durable createdFrom, V2 bundle integrity, V3 authenticated origin-head refs, V4/V5 release content markers + agents pin) → automated reseed PR, which the coldstart gate validates by germinating from the new seed. Substance validated manually on the runner host end-to-end: seed built from origin, full verify table PASS (2.2M). The workflow YAML gets its live proof from the first dispatch on main (workflow_dispatch cannot target branch-only workflows — Forgejo 500s; discovered here). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

plat added 3 commits 2026-07-02 18:25:05 +00:00

reseed: auditable seed rebuild as a workflow (#14) ... bdeea8e3a3

bin/seed's output was a hand-committed blob; now: dispatch the reseed
workflow -> it builds the seed on the runner (PLAT_PAT secret, optional
gitops_ref for coordinated releases), verifies it with the new
scripts/reseed-verify.sh (manifest fields incl. durable createdFrom (#76),
bundle integrity, code-repo refs == origin heads, release content markers
for #61/#64/#68/#70 + the mirror capfix, agents pin printed), and opens a
reseed PR — which the coldstart gate then validates by GERMINATING from the
new seed. One dispatch, zero manual seed handling, two layers of proof.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

reseed-verify: V3 lookups must fail into the comparison, not abort via set -e ... 39cb84fe84

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

reseed-verify: authenticated V3 head lookups (mcp/agents/hello are private) ... 2fd85a1632

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plat merged commit ee2bc746d4 into main 2026-07-02 18:25:08 +00:00

plat referenced this pull request from a commit 2026-07-02 18:25:10 +00:00

Merge pull request 'reseed: auditable seed rebuild as a workflow (#14)' (#78) from feat/reseed-workflow into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

discussion

An idea that is still being discussed

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

goal

  

help wanted

Need some help

  

horizon:backlog

  

horizon:governance

  

horizon:mvp

  

invalid

Something is wrong

  

operator-decision

Blocked on the owner's call — no agent work until decided

  

question

More information is needed

  

roadmap

  

wontfix

This won't be fixed

No labels

bug

discussion

duplicate

enhancement

goal

help wanted

horizon:backlog

horizon:governance

horizon:mvp

invalid

operator-decision

question

roadmap

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-platform/mitosis!78

No description provided.