carlos / platform Public

release: edge bakes zero — merged to main is picked up as it lands

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VioXzogWf1Xi4Rswz2B6EK

Paul Campbell 2 months ago 9991d6c0a42d8e18029ba6ba5df42c7c146c8bec parent 3840e96

2 files changed, +13 −1

diff --git a/internal/release/bake.go b/internal/release/bake.go

index ed87fbc43..85b2cac26 100644

--- a/internal/release/bake.go

+++ b/internal/release/bake.go

@@ -13,7 +13,8 @@

// promote`). beta's 24h absorbs the caught-within-a-day mass of real

// supply-chain incidents; stable's 72h additionally spans a weekend, so a

// Friday-night malicious publish is seen by a human on Monday with margin to

-// pull it back.

+// pull it back. edge has no window either — merged to main is picked up as it

+// lands (pipelines spec §3).

// There is deliberately NO publisher-side bypass ("critical fix, skip the

// hold") — that flag is the first thing an attacker sets. The bypass is

@@ -35,6 +36,7 @@ import (

// overrides come from host config as a replacement map passed by the caller.

var DefaultHolds = map[string]time.Duration{

"canary/*": 0,

+ "edge": 0,

"beta": 24 * time.Hour,

"stable": 72 * time.Hour,

}

diff --git a/internal/release/bake_test.go b/internal/release/bake_test.go

index 90077ebf6..4b66e0004 100644

--- a/internal/release/bake_test.go

+++ b/internal/release/bake_test.go

@@ -356,3 +356,13 @@ func TestFirstSeenSaveReplacesFileItCannotWriteInPlace(t *testing.T) {

t.Fatal("observation missing after Save")

}

+// The pipelines spec defines edge as "picked up as it lands — no human in

+// the loop, by definition". Without its own entry, HoldFor fail-closes edge

+// to 72h — longer than beta, and a spec violation (2026-08-04 console bake

+// controls spec, §1/§8).

+func TestHoldForEdgeIsZero(t *testing.T) {

+ if d := HoldFor(DefaultHolds, "edge"); d != 0 {

+ t.Fatalf("edge hold = %v, want 0", d)

+ }