Skip to main content

​
Posted 0.1.0 release sign-off

Reviewed on 14 October 2026. Local candidate preparation is signed off. Public release approval remains pending the publication gates below. No repository publication, application release, deployment or real social post was performed.

​
Verified local gates

The local production evidence and sanitized scan reports are in artifacts/release-readiness/. Documentation is previewable with pnpm docs:dev at http://localhost:4177. The prepared site uses the shared Mintlify kit, Posted branding and sample data, with product guides, configuration, provider setup, security, operations, upgrades and backup/recovery.

​
Unresolved release gates

​
Native AMD64 and exact-commit CI

Local AMD64 emulation on this ARM Mac failed twice during dependency installation with the same Node/libuv assertion: errno == EEXIST in uv__io_poll. It is recorded as a failed verification attempt, not a passing platform check. The cause has not been established. Native Linux AMD64 and ARM64 installation/restore jobs are prepared in CI and are mandatory before publication. Local ARM64 proof does not substitute for native AMD64 proof. The checkout has no initial commit or Git remote, and avgeek-oss/posted was not found during repository verification. GitHub Actions, CodeQL and branch protection have therefore not been exercised for this candidate. The release workflow requires the latest Required CI success for the exact source commit; it cannot accept an earlier success after a later failure.

​
Public artifacts and hosted documentation

https://posted.cc redirects to https://www.posted.cc and currently displays the Mintlify starter kit. The prepared Posted documentation has been validated locally but is not deployed there. The three GHCR packages and GitHub release are not published. Anonymous pulls, immutable platform manifests, SBOM/provenance and release asset verification run in the prepared publication workflow after the repository and packages exist. Installation instructions apply to a published release containing posted-images.json; they do not assert that 0.1.0 is already available.

​
Publication sequence

  1. Publish the reviewed source to the intended repository with main as the release branch.
  2. Require Required CI, covering source/tests, documentation, security/CodeQL and native AMD64/ARM64 production verification, on the exact release commit.
  3. Enable private vulnerability reporting and connect Mintlify to the repository’s docs directory. Verify the production site after deployment finishes.
  4. Create v0.1.0 on that verified commit and run Publish release images from main.
  5. Make all three GHCR packages public. The workflow refuses release publication until anonymous immutable-image inspection succeeds.
  6. Let the workflow scan all platform images, validate both platforms and aliases, verify installation/restore from pulled images, and attach posted-images.json with matching Compose/environment assets before publishing the GitHub release.
Provider application approvals, production credentials and a separately authorized real-account publishing smoke test remain operator acceptance gates. Contract tests exercise real provider request shapes through strict local transports; they do not establish provider approval, quota availability or real publication. Account email verification sends only to local Mailpit. The existing preview installation and its content were retained.