DispatchAtlasRelease Readiness
DispatchAtlas release readiness — public-safe gate status across code, packages, documentation, security, supply chain, and deployment channels.
The release page reports public-safe gate status across code, packages, docs, portal data, presentation materials, security, and deployment. Production deployment remains blocked until the complete green-card set passes.
✅ Gate Status
| Gate | Current status | Evidence policy |
|---|---|---|
| Lint and format | Verification required | uv run ruff format --check . and uv run ruff check . must pass with no findings. |
| Type check | Verification required | uv run mypy packages tests tools examples must pass under the locked environment. |
| Prose register | Verification required | uv run python tools/check_prose_register.py must pass on every public surface. |
| Code-first derivation | Verification required | uv run python tools/check_code_first.py must pass. |
| License headers | Verification required | uv run reuse lint and uv run python tools/license_header.py check must both pass. |
| Secret scan | Verification required | gitleaks detect --source . --redact --config .gitleaks.toml must report no leaks. |
| Docs build | Verification required | npm --prefix site run build and npm --prefix site run check must complete for the current workspace. |
| Portal data | Verification required | uv run pytest tests/site must pass and record the run before promotion. |
| Coverage | Verification required | uv run coverage run -m pytest and uv run coverage report must record a passing threshold result. |
| Accessibility baseline | Verification required | SVG metadata, alt text, labeled controls, and responsive layout must be checked by the site tests or accessibility audit. |
| Link check | Verification required | The site build must resolve the documented navigation and page links for the current workspace. |
| Package build | Verification required | uv run python tools/build_packages.py must emit build artifacts and hashes before package promotion. |
| Package install smoke | Verification required | Built wheels must install in a fresh virtual environment and import each public namespace. |
| Evidence bundle export | Verification required | Tables, figures, and supplement must regenerate from a disclosure-filtered campaign. |
| Pilot campaign replay | Verification required | Bounded pilot campaigns must resume, replay from recorded seeds, and reproduce deterministic analysis exports. |
| Candidate full campaigns | Verification required | tools/build_campaign_evidence.py must materialize 30 problems per profile, run comparative/ablation/sensitivity campaigns, and export disclosure-filtered bundles. |
| Dependency audit | Verification required | uv run pip-audit --path <site-packages> --progress-spinner off must complete with no release-blocking findings. |
| SBOM | Verification required | CycloneDX JSON must be generated from the audited Python environment, enriched with component licenses, hashes, package URLs, and dependency edges. |
| Hosted CI | Gated by runner availability | .github/workflows/ci.yml must pass on Ubuntu, Windows, macOS, and Python 3.12-3.14 before public claims. |
| Release artifacts | Manual workflow | .github/workflows/release.yml builds distributions, hashes, Sigstore signature bundles, GitHub artifact attestations, and SBOM evidence; GitHub release and PyPI publication require explicit inputs. |
| Deployment | Manual workflow | .github/workflows/pages.yml deploys site/out only after the approved domain confirmation is entered. |
The public gate bundle is available as gate-summary.json.
📦 Publication Channels
DispatchAtlas is designed for multiple publication channels, but each channel has a different readiness state:
| Channel | Current state | Promotion evidence |
|---|---|---|
| Local wheels and sdists | Active for smoke checks | Package build plus fresh-venv import smoke. |
| Python package index | Gated | Versioning, metadata, release workflow success, trusted publishing, and explicit release approval. |
| Documentation website | Build-ready | Site build and type check, site contract tests, link checks, public-safe data bundles, and manual Pages approval. |
| Static portal datasets | Preview-ready | Disclosure-filtered JSON/CSV bundles with evidence labels and no private inputs. |
| Evidence bundles | Candidate-ready | Manifest, tables, figures, supplement, and deterministic replay over candidate campaign evidence. Body claims remain gated by non-tied and feasibility sufficiency. |
| Security artifacts | Active locally | Dependency audit, enriched SBOM, secret scan, workflow-permission review, and OpenSSF Scorecard. |
No channel should be promoted by copying generated files manually. Promote by rerunning the owning command or workflow and keeping the corresponding gate evidence green.