| Class | Verification (code: phases/ship/verify.go:182-223) |
|---|---|
cycle | no control-plane edits (ADR-0064) + audit↔tree binding + persona-lint |
manual | confirm (TTY or EVOLVE_SHIP_AUTO_CONFIRM) + commit-gate attestation (tree-SHA of the reviewed diff must equal the staged tree) + persona-lint |
release | pipeline-only; audit skipped (version bump mutates post-audit) |
trivial | requires trivial size estimate + zero pipeline-critical paths |
git commit/push is hook-denied; ship commits internally, so the Go-side check (phases/ship/commitgate.go:79-135) is the single enforcement point — missing/stale attestation refuses the ship. Reviewers become durable Reviewed-by: trailers.releasepipeline.go:199): preflight → changelog-gen → version-bump → rebuild-binary → consistency → atomic ship → marketplace-poll → release-verify, journaled per attempt for rollback. Preflight is 5 counted steps PLUS a hard release-commit CI gate (cycle-748, after v22.0.0 was cut on red CI).discardBinaryChurn runs on the manual-ship SUCCESS path (gitops.go:210); with ShipBinaryPath never set it resolves os.Executable() and os.Removes the untracked go/bin/evolve (gitops.go:774) — the very binary all five trust hooks resolve first. Every manual ship silently degrades the kernel to the stale tracked fallback until a rebuild. Observed live twice on 2026-07-12; undocumented anywhere.trivial; release step order reversed in docs; docs/release-protocol.md is referenced but does not exist; sandbox.allow_network=false is silently forced true for worktree phases.Ship-gate v8.13.0 ended a five-cycle parser-bypass arms race; the commit-gate’s bash runner was deleted only after a differential test proved the Go port byte-identical; the release CI hard-gate exists because a release once shipped on red CI. Every door out of the repo has a story about someone (usually an agent) trying to walk around it.