Skip to content

Stable 1.2.0 — Separate production publication authorization

This governance record is distinct from the published 1.2.0rc2 approval. It governs only stable 1.2.0.

Verified source qualification

  • Source PR #478: 33/33 exact-head workflows passed, with zero failures; head 53396c2a126a844962daf29419cc12ce17c94b4e.
  • Protected-main source merge: 2d9fe5886ea0c36e619a302d6a6237ce446a18e2.
  • Literal 1.2.0 performance run #40121535785, original artifact ID 12572080532, member SHA256 022c5f3d30b336d9769c1afcbb5dc902a61ecfbf36011e7c7fca4fd70c894872.
  • Frozen API, ten W1–W4 workflows, twelve explicitly experimental/unqualified E1–E4 helpers and scientific issue holds #289 / #296 remain unchanged.
  • 1.2.0rc2 release assets and ledgers remain immutable with their original prerelease labels.

Required governance sequence

  1. [x] Protected-main source commit 2d9fe5886ea0c36e619a302d6a6237ce446a18e2 passed all 33/33 specifically REQUIRED release-governance check runs on 24 October 2026. The additional replicated Bayesian FPCA sensitivity workflow was still running at authorization, but is not in the production REQUIRED_CHECKS list. Never count it as passed until complete.
  2. [x] Explicit owner authorization for stable 1.2.0 in this conversation on 24 October 2026. No separate independent human peer review is claimed.
  3. [x] Jointly arm github_release_ready and production_release_ready in a distinct governance PR; retain testpypi_publication_ready=false. Tie ledger to the previously qualified main source SHA.
  4. [ ] Qualify the arming PR head on GitHub Actions; no failed or missing required checks.
  5. [ ] Merge the governance PR to protected main and requalify the new exact main SHA using required check-run names.
  6. [ ] The repository owner manually dispatches release.yml from main with target=production. Preserve the protected pypi environment required reviewer and OIDC trusted publishing. No release should be triggered by pushes or merge events.
  7. [ ] Verify tag v1.2.0 (not prerelease), wheel/sdist and SHA256SUMS, PyPI version 1.2.0, and fresh clean-environment installation.
  8. [ ] Update published stable version, website and changelog after successful publication; disarm release flags.

The production readiness flags in this PR authorize only the separately validated manual production workflow from the eventual qualified protected-main head, with authenticated repository-owner workflow dispatch and protected PyPI environment approval. This document is not a claim that production publication or remaining PR/main CI steps have completed.