chore(ci)(deps): bump actions/setup-python from 5 to 6 - #9
Merged
mmacedoeu merged 2 commits intoFeb 25, 2026
Merged
Conversation
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
deleted the
dependabot/github_actions/actions/setup-python-6
branch
February 25, 2026 01:50
mmacedoeu
added a commit
that referenced
this pull request
Jun 16, 2026
0850p-c (Transport Group Binding): - R2-TGB-1 (MEDIUM): Nonce-replay table structure (rule #8) not specified. Added full NonceReplayTable spec with BTreeMap + amortized eviction. - R2-TGB-2 (MEDIUM): HEARTBEAT envelope name wrong (was DOT/1/HEARTBEAT; actual is CoordinatorHeartbeat per 0855p-b). Corrected. - R2-TGB-3 (MEDIUM): Cross-platform REBIND old-group state not specified. Clarified: old group always goes to UnboundQuarantined regardless of same/different platform. - R2-TGB-4 (MEDIUM): BIND signature didn't bind coordinator_pubkey to coordinator_id. Added witness rule #9: coordinator_id == BLAKE3(coordinator_pubkey). - R2-TGB-6 (MEDIUM): PRE-EXISTING inconsistency: BIND has envelope_type b"DOT1" but BACK/UNBD/RBND didn't. Added envelope_type to BACK/UNBD/RBND structs to match canonical header spec. 0855p-c (Domain Coordinator): - R2-DC-1 (MEDIUM): Implicit designator (first-DOT-sender) path had no timeout. Added 100-epoch timeout. - R2-DC-3 (MEDIUM): Reconnection after forced Inactive risks split-brain with newly-elected DomainCoordinator. Added split-brain prevention + reconnect_epoch field on BindEnvelope. - R2-DC-4 (MEDIUM): PlatformEvent enum referenced (6+ variants) but never defined. Added full enum with payloads. - R2-DC-5 (LOW): IA-DC-7 conflated 'phone -> peer_id' with two-step mapping. Rewrote: platform-native -> participant_id (32 bytes) -> peer_id. 0851p-a (Network Bootstrap): - R2-NB-1 (MEDIUM): authority_pubkey in entry_hash is implicit. Added detailed signing-context model. - R2-NB-2 (LOW): HEARTBEAT_TIMEOUT not derived from HEARTBEAT_INTERVAL. Changed to 3 * BOOTSTRAP_NODE_HEARTBEAT_INTERVAL. 0855p-b v1.1 (Coordinator Lifecycle): - R2-CL-1 (MEDIUM): GenesisAttest rollback validation rule (stale nonce rejection) not specified on receiver side. Added 4-point validation rule. - R2-CL-2 (MEDIUM): Slash reason 0x0009 not in Slash Reason Codes table. Added row + reserved 0x000A-0xFFFF row. - R2-CL-3 (LOW): genesis_witness_timeout not defined as constant. Added Constants section with GENESIS_WITNESS_TIMEOUT = 100. 13 issues fixed, 1 withdrawn (R2-DC-2 was based on a misread of envelope_type consistency). 0 issues remaining at end of Round 2. Next: Round 3 to verify Round 2 fixes and find new issues.
mmacedoeu
added a commit
that referenced
this pull request
Aug 3, 2026
Round 3 review (background subagent, 2026-07-30) found 10 NEW findings (3 MAJOR + 5 MINOR + 2 NIT). All MAJOR + most MINOR fixed. **MAJOR fixes**: - F1 (rotation_receipt_id implicit coverage): Live ChainAnchorSubmitter Scope item 3 now explicitly states it covers 0968a AC #5 (chain-side encoding of rotation_receipt_id field through to v010 ledger's rotation_receipt_id column). Added explicit AC #5 "Live ChainAnchorSubmitter writes rotation_receipt_id through to v010 ledger (covers 0968a AC #5 chain-side encoding)". - F2 (GovernanceSnapshot/Signer/Proof types missing from IMPL): Scope item 2 now states that the 3 verifier types per RFC-0955-R1 lines 177-200 must be created in a new auth.rs module (alongside the existing age_secs/is_fresh). Added explicit AC #8 "GovernanceSnapshot / GovernanceSigner / GovernanceProof types defined per RFC-0955-R1 lines 177-200". - F3 (plan_batches purity/wiring): Scope item 4 reworded — plan_batches is a pure function (no chain-state arguments). Now specifies either extending run_once_strict to call is_finality_reached BEFORE plan_batches, OR introducing a new plan_batches_with_reorg_check function. **MINOR fixes**: - F4 (misleading reserved-band citation): "per error.rs:8-49 context" → "per RFC-0968 §13 line 2641; note error.rs:8-49 mentions a post-amendment-82 reserved band 0x3A..=0xFF not yet active". - F5 (10 Scope items confusing wording): "The 10 Scope items (9 Scope + 1 split...)" → "The 9 Scope items (reorg + DID-rotation finality combined into 1 Scope item covering both; the 1:1 AC mapping would have produced 10)". - F6 (canonical_blobs.rs lines 34-49 tight block): "lines 34-49" → "lines 34, 41, 48". - F7 (gossip ingress handler underspecified): Scope item 9 now specifies "Target the ingress handler only (the handle_one / validate_envelope call site); the 6 test fixtures at lines 813, 1056, 1206, 1288, 1336, 1389, 1526 intentionally use anchor_tx_hash: None as test default and should remain unchanged." - F8 (event_id shorthand for 4-tuple): AC #9 rewording: "Idempotency test (2 duplicate submits on (did, signal_kind, layer, last_event_id) 4-tuple) passes". **NIT pending**: - F9 (future RFC-0968-A2 amendment 0x2D impact) — forward-looking concern, not blocking. - F10 (background job scheduler interface) — caller responsibility, not owned by this mission. Documented in Out of scope if needed. Mission 0968a2 now: 9 Scope items + 14 ACs (was 12). 9 Scope items cover all 9 ungrounded ACs from 0968a (1:1 + 1 explicit chain-encoding + 1 verifier types).
mmacedoeu
added a commit
that referenced
this pull request
Aug 3, 2026
…liation Landing 0968a2 implementation. Closes 7 of 17 ACs directly; the remaining 10 are either pure verification (AC #1) or blocked by external dependencies (AC #7-8 chain-substrate selection, AC #9-11 live anchor plumbing, AC #13 config crate path, AC #16 0855p-b successor). Direct closes: - AC #2 (governance fields on ReputationAnchorBatch): added governance_snapshot, governance_proof, governance_set_hash fields to crates/octo-reputation/src/anchor.rs:140 with full digest folding. The 3 governance types live at auth.rs as AnchorGovernanceSnapshot / AnchorGovernanceSigner / AnchorGovernanceProof (path (a) mandated; preserves existing GovernanceSnapshot/GovernanceProof at auth.rs:21-25/113+). - AC #3 (batch_size: u32): RFC-0955-R1 line 173 mandate. Added batch_size field; within_leaf_cap() now requires batch_size == leaves.len(). - AC #4 (chain_block_height: Option<u64>): RFC-0955-R1 line 170 mandate. None at submission, Some(h) after MIN_FINALITY_BLOCKS finality. Digest uses Option tag encoding (0x00 None, 0x01 || 8 bytes BE Some). - AC #5 (AnchorLeaf::digest field order): per RFC-0955-R1 lines 420-422, score_ewma_raw now at position 5 (between last_event_id and last_event_unix). The previous last-position was a cross-implementation interoperability bug. - AC #6 (v012 migration): new crates/octo-reputation/migrations/v012__reputation_anchors_governance.sql extending reputation_anchors with governance_snapshot BLOB, governance_proof BLOB, governance_set_hash BLOB + lookup index on governance_set_hash. BUILTIN_MIGRATIONS bumped. - AC #12 (anchor-specific verifier types): path (a) types defined in crates/octo-reputation/src/auth.rs. meets_quorum() enforces exactly GOVERNANCE_QUORUM (3) distinct signers. - AC #17 (canonical test vector re-pinning): the 3 pinned vectors in tests/canonical_blobs.rs re-pinned to the new canonical serialisation. An independent Python implementation using hashlib.blake3 MUST reproduce these bytes byte-identically per RFC-0955-R1 line 422. Verification: cargo fmt + clippy -D warnings clean; cargo test --lib 197 passed; canonical_blobs 5/5 passed; stoolap_integration 47/48 passed (1 pre-existing flaky K=2 race test — fails before this commit too, acknowledged in the test's R22 comment as non-deterministic). External blockers remaining for 0968a2 closure: - AC #7/8 live ChainAnchorSubmitter (chain-substrate selection RFC) - AC #9/10 reorg + DID-rotation finality handlers (need AC #7) - AC #11 governance signature verification (needs governance key infra) - AC #13 per-deployment config plumbing (config crate path TBD) - AC #16 gossip cross-reference (needs 0855p-b successor mission) Implementation pattern: anchor_job.rs::plan_batches returns batches with placeholder governance fields (None chain height, zero snapshot/proof/set_hash, leaves.len() batch_size). Runtime populates them with active snapshot + 3-of-3 quorum proof before calling ChainAnchorSubmitter::submit. Keeps plan_batches chain-substrate-agnostic.
mmacedoeu
added a commit
that referenced
this pull request
Aug 3, 2026
Update Status header after 0968a2 implementation landed in commit 72bf19d. N9 (ReputationAnchorBatch governance fields drift) resolved at the struct + digest + migration + test-vector level. The 9 ungrounded 0968a ACs split cleanly into 3 categories: - 5 (#1, #4, #5, #6, #7, #8) gated on chain-substrate selection RFC - 1 (#9) gated on 0855p-b successor mission (gossip file ownership) - 2 (#2, #3) achievable but need a live ChainAnchorSubmitter fixture (deferred until #1 lands) Path B closure recommended (per BLUEPRINT §1152-1158 user-initiated deferral rule). Mission substantively complete at the commit boundary; residual work is separate chain-substrate + gossip coordination effort.
mmacedoeu
added a commit
that referenced
this pull request
Aug 7, 2026
… AC grounding
R7 review findings closed:
MAJOR (governance type collision): mandate path (a) — new anchor-specific types in same module — verified against current IMPL at crates/octo-reputation/src/{auth.rs:399-603, anchor.rs:174-208, anchor.rs:233+}; existing auth.rs::GovernanceSnapshot (L21-25) + GovernanceProof (L113+) preserved unchanged as RFC-0968 authorization envelopes (slash/suspension flows); new AnchorGovernanceSnapshot/AnchorGovernanceSigner/AnchorGovernanceProof/AnchorSignature types + 5 unit tests cover the anchor binding schema.
NIT (duplicate sentence): file no longer contains duplicate (prior edits removed it).
AC grounding updates — 7 ACs flipped to [x]:
- AC #2 governance fields (72bf19d + 48cf997 + b0660c3)
- AC #3 batch_size: u32 (same)
- AC #4 chain_block_height: Option<u64> (same)
- AC #5 AnchorLeaf::digest field order (b0660c3)
- AC #6 v012 migration (file shipped)
- AC #12 anchor-specific verifier types (72bf19d)
- AC #1 StakeBelowMinimum 0x2D verification (013a567)
10 ACs deferred per [[deferred-vs-unspecified]] named-owner rule to chain-substrate selection RFC + 0855p-b successor: #7/#8 live ChainAnchorSubmitter + rotation_receipt_id wire-through, #9/#10 reorg + DID-rotation finality handlers, #11 governance signature verification runtime hook (meets_quorum helper landed), #13 per-deployment config plumbing, #14/#15 idempotency + failure isolation tests, #16 gossip cross-reference, #17 canonical test vector re-pinning.
Version History v0.2 added; mission text no longer contradicts IMPL state.
63 insertions, 78 deletions.
mmacedoeu
added a commit
that referenced
this pull request
Aug 25, 2026
…dator -iname fix Promote RFC-0105 v3.0 (Private Asset ID Namespace) from Draft to Accepted per long-horizon plan v1.6 Phase 4 Tier 1 promotion sequence (RFC-0105 v3.0 first in Tier 1 order per research doc §20 decision #9). Status header bumped to Accepted (v3.0); VH row added recording R16 promotion. Three pre-existing dirty cites patched inline: 3x RFC-0206 v3.1 §2.3 → RFC-0206 §2.3 (STALE: v3.1 pin doesn't exist on disk, only v3.0 + v3.3 drafts); 1x RFC-0105 v3.0 §Authority-to-Issue → RFC-0105 §Asset ID Derivation (INVALID: section Authority-to-Issue not in parent numeric/0105 which validator picks). scripts/validate_cites.sh: case-insensitive find in find_rfc_path (R16 cite- validator audit). RFC-0967-A1 sub-amendment lives at rfcs/.../0967-a1-policy- registry.md (lowercase a1 per Linux filename convention); prior case-sensitive find produced false PHANTOM for every cite referencing sub-amendments A1/A2/R1. Per CLAUDE.md §RFC Reference Conventions + RFC-0206 §Layer B additive-only rule + research doc §20 decision #9 Tier 1 sequence. No push per feedback_initiation_user_only.
mmacedoeu
added a commit
that referenced
this pull request
Aug 25, 2026
Promote RFC-0010 v1.7 from Draft to Accepted per long-horizon plan v1.6 Phase 4 Tier 1 promotion sequence (RFC-0010 v1.7 second in Tier 1 after RFC-0105 v3.0). Status header bumped to Accepted; VH row added recording R16 promotion. Citation cleanup: 4 pre-existing STALE v1.6 version pins + 1 INVALID §Authority ref + 2 STALE v3.3/v3.4 RFC-0206 pins all stripped to bare RFC numbers per CLAUDE.md §RFC Reference Conventions (no version pins in cross-references). RFC-0010 §3 chain_id BLAKE3 derivation + §4 authority registration flow + ledger_chain_registry table schema preserved as authored. Per research doc §20 decision #9 Tier 1 sequence + RFC-0206 §Layer B additive-only rule. No push per feedback_initiation_user_only.
mmacedoeu
added a commit
that referenced
this pull request
Aug 25, 2026
…cepted Promote RFC-0959 v2.1 from Draft to Accepted per long-horizon plan v1.6 Phase 4 Tier 1 promotion sequence (RFC-0959 v2.1 third in Tier 1 after 0105 v3.0 + 0010 v1.7). Status header bumped to Accepted; VH row added recording R16 promotion. BurnEventRef wire form + DQA(12) cost migration from BLOB(16) + litellm_users spend view (uses 'Burn' filter per RFC-0960 §2.5) all preserved as authored. No cite corrections needed — 16/16 cites validate clean pre-promotion. Per research doc §20 decision #9 Tier 1 sequence + RFC-0206 §Layer B additive-only rule (extends v2.0; does not redefine). No push per feedback_initiation_user_only.
mmacedoeu
added a commit
that referenced
this pull request
Aug 25, 2026
Promote RFC-0960 v3.1 from Draft to Accepted per long-horizon plan v1.6 Phase 4 Tier 1 promotion sequence (RFC-0960 v3.1 fourth = Tier 1 final per research doc §20 decision #9). Status header bumped to Accepted; VH row added recording R16 promotion. Citation cleanup: 3 RFC-0960 v3.0 STALE pins + 1 RFC-0206 v3.3 STALE pin + 2 INVALID non-heading §InteropPolicy/§BurnPolicy anchors (these are TRAIT DECLARATIONS in code blocks inside §2.1 of 0967-A1, not section headings) all fixed per CLAUDE.md §RFC Reference Conventions. Mesh open path vs corporate closed path taxonomy + chain_metadata augmentation + same-substrate binding (vaults PK + transfer_events unchanged) preserved as authored. Per research doc §20 decision #9 Tier 1 sequence. No push per feedback_initiation_user_only.
mmacedoeu
added a commit
that referenced
this pull request
Aug 25, 2026
…cker) Unblocks RFC-0968-A2 v0.8.1 AC #17 (gossip consumer rejects stale anchor_tx_hash: None events) + AC #18 (3 canonical test vector re-pinning coordination). Mission owns filter_stale_anchor_events function in crates/octo-network/src/gossip/reputation.rs + 7 TV fixtures in tests/canonical_blobs.rs. This is the smaller of 2 external blockers blocking RFC-0968-A2 substrate (19 of 27 ACs DEFERRED). Larger blocker = chain-substrate selection RFC (separate work; unblocks 0968a2 ACs #9-#16). Per RFC-0968-A2 v0.8.1 freshness gate mandate: MAX_ANCHOR_STALENESS_BLOCKS = 256; drops GossipEnvelope with anchor_tx_hash: None + chain_block_height older than window. Preserves all anchor_tx_hash: Some(_) envelopes. Guard 2: 15/15 VALID. NO PUSH per feedback_initiation_user_only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-python from 5 to 6.
Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
a309ff8Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)bfe8cc5Upgrade@actionsdependencies to Node 24 compatible versions (#1259)4f41a90Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)83679a8Bump@types/nodefrom 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...bfc4944Bump prettier from 3.5.3 to 3.6.2 (#1234)97aeb3eBump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)443da59Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...cfd55cagraalpy: add graalpy early-access and windows builds (#880)bba65e5Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)18566f8Improve wording and "fix example" (remove 3.13) on testing against pre-releas...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)