A Verifiable Source-Review Archive for Every Release
Deterministic source snapshots, license compliance, and signed checksums wired into the release.
2 milestones 10 sprints 24 agents
6 plan 11 execute 13 review
117k peak context
75k median execute
1h 26m total 5m 16s per sprint
8m 41s plan 43m 7s execute 16m 45s review
31 edits 231 commands
claude harness
17.6M tokens in 206.7k tokens out
$29.29 nominal cost
This job built the release materials a paying customer needs after downloading Gantry: a source-review archive tied to the shipped binary, generated third-party attribution, a dependency license policy, a checksum manifest, detached signature material, and documentation for verification. Its most durable decision was to keep archive assembly in a committed script with local tests, then let release publication call that tested boundary.
The delivery channel has changed since the run. The GitHub release workflow this job extended is gone, replaced by local release production and private hosting, but the source archive apparatus still stands in the current tree: the assembly script, policy workflow, notice generator, signing key, README verification text, and relocated integration tests remain part of Gantry's distribution story.
How this walkthrough is structured
Feature
What did the run build and ship?
Gantry still carries the source-review archive machinery, license guardrail, generated notices, signing material, and verification docs, while the original hosted release workflow has been superseded.
Build
How did Gantry structure the work?
The decomposition proved the compliance and archive contract locally before wiring publication around it, with replans confined to the source-archive digest contract rather than to failing gates.
Milestone 1
Source Review Archive
5 sprints 17 agents 51m 55s wall time 117k peak context $14.69 nominal cost
The foundation is still the core of the current source-review system. The live tree has the archive assembly script, generated notices configuration, permissive license policy, source archive tests relocated into the integration suite, and README and packaging docs that explain verification. Some original files were renamed or replaced, including the review-only license draft, but the tested archive contract remains present.
This milestone carried the locally testable foundation: license baseline, notice generation, archive assembly, archive tests, and consistency checks. That was a good boundary for clean-context workers because it kept release publication out of scope until the script and compliance inputs could be run from a checkout. The run stayed green, but the archive assembly and archive-test sprints both caused replans. The recorded stress was not shell failure; it was the self-referential digest rule that later work had to preserve.
Compliance Baseline
2 agents 5m 3s wall time 79k peak context
The baseline partly survives and partly changed under later licensing work. `deny.toml` still carries the permissive dependency allow-list and proprietary exceptions for Gantry-owned crates, and the current licensing tests still prevent copyleft identifiers from entering that policy. The separate review-license file is gone; the tree now uses the Gantry Source License at `LICENSE`, with tests checking that the shipped root text matches the served legal copy and permits the verification build.
This sprint established the legal and policy baseline every later artifact needed to assume. Its scope was narrow: add a review grant draft, align Gantry-owned crate metadata away from stale permissive claims, and pin the dependency license allow-list with native tests. That fit one worker because it did not touch archive mechanics or release publication. The sprint completed without recorded repair, giving later workers a stable compliance input.
Third-Party Notices
4 agents 13m 38s wall time 73k peak context 15.2k tokens out $2.09 nominal cost
Generated notices still exist as a maintained compliance input. The current tree keeps `about.toml`, `about.hbs`, `scripts/generate-third-party-notices.sh`, and `THIRD-PARTY-NOTICES.md`, with tests asserting target scope, license election, output markers, and attribution coverage. Later release work also packages the notices with binaries and the source archive, so this sprint's output remains more than a one-time report.
This sprint made attribution reproducible before any archive or tarball consumed it. The worker only had to configure the generator, preserve the explanatory preamble, scope the target set, and add dependency-free checks for the generated output shape. The run facts show no red gate or retry here. Its boundary was clean because release tooling could later regenerate the same file instead of reinterpreting license obligations.
Source Archive Assembly
3 agents 16m 26s wall time 117k peak context 63.3k tokens out $5.40 nominal cost 1 replan
`scripts/release/make-source-archive.sh` is still present and is still the source archive boundary. It now snapshots a stripped source tree handed to it, copies only allow-listed paths, embeds notices and an SBOM, writes release metadata, normalizes archive entries, and emits the canonical rebuild digest before sealing the final zip. Later work expanded its inputs and comments, but the durable feature is the same: archive behavior lives in a runnable script instead of hidden release configuration.
This was the central foundation sprint: implement the local script that turns tracked release inputs into the review archive and writes correspondence metadata. It was isolated from release YAML so one worker could focus on allow-listed inputs, excluded internal paths, deterministic bytes, and metadata arguments. Review triggered a replan after this unit, placing the difficulty at the archive's embedded digest rather than at file inclusion. That replan became the constraint later publication work had to read.
Source Archive Tests
3 agents 6m 34s wall time 90k peak context 24.3k tokens out $3.55 nominal cost 1 replan
The original test file has moved, not disappeared. The current `tests/integration/default/source_archive.rs` still runs the archive script against a hand-built stripped-tree fixture, checks the required compliance entries, asserts internal path families are absent, compares repeated builds, and verifies that metadata records the canonical digest while differing from the shipped zip hash. That live test suite is the main evidence that the archive script remains a contract rather than a convention.
This sprint was sequenced after the script because its job was to make the archive contract enforceable. The brief asked for native tests using stub SBOM and notice inputs, proving invocability, required contents, excluded path families, deterministic output, and metadata correctness. It also carried the subtle digest note forward: the recorded archive identity is the canonical rebuild digest, not the final zip hash. Review again produced a replan, so the digest distinction was now pinned by both implementation and tests.
Foundation Consistency
2 agents 5m 28s wall time 91k peak context 18.2k tokens out $2.68 nominal cost
The consistency checks are still visible through relocated integration tests and the current packaging documentation. The tree checks that notice generation and the license allow-list share the same permissive universe, that the archive allow-list remains paired with the stripped-tree include list, and that verification prose keeps the canonical digest separate from the shipped artifact hash. The original milestone test files are absent at their old paths, but their assertions have been folded into the current integration suite.
The final foundation sprint was an integration pass over already-built pieces. Its job was to align target sets, notice scope, license policy, archive inputs, and verification expectations before release publication consumed them. That made it a small handoff unit for a fresh agent: inspect and tighten the contracts, not invent a new subsystem. It completed green, and the top ledger carried its main historical plan-impact note into the next milestone.
Milestone 2
Verified Release Publishing
5 sprints 13 agents 22m 21s wall time 115k peak context $13.64 nominal cost
The original hosted publication mechanism is no longer in the live tree. `.github/workflows/release.yml` and its old config tests are absent because Gantry later moved release production to local tooling and private hosting. The features that outlived that workflow are the ones with independent value: notices in release packaging, license policy CI, source archive production logic, checksum and signature documentation, and the public signing key.
This milestone consumed the foundation in release order: binary tarball attribution first, ordinary CI policy next, release artifact generation, cryptographic publication, and finally README documentation. Because the archive script and digest contract were already established, the workers could make additive workflow and prose changes without reopening archive design. The milestone completed without recorded failures or replans. Its main build fact is therefore compositional: each sprint leaned on the foundation rather than carrying it again.
Tarball Notice Packaging
2 agents 1m 46s wall time 63k peak context 4.2k tokens out $1.45 nominal cost
The specific GitHub workflow edit is gone with the hosted release pipeline. The behavior survives in the current local release producer, which packages README, the binary EULA, the third-party notices, and the SBOM beside the executable in each tarball. Current release tests assert that these compliance files travel with binary artifacts, so the sprint's contribution is now represented through the replacement producer rather than its original YAML.
This sprint was deliberately small: copy the generated notices into each binary tarball and assert the workflow referenced a real file. It was a useful first publication unit because it touched the binary packaging steps but not source archives, checksums, signing, or upload lists. The run stayed green, showing that the generated notices from the foundation were ready to be consumed by packaging. Its boundary was mechanical and intentionally thin.
License Policy CI
2 agents 1m 33s wall time 71k peak context 5.7k tokens out $1.50 nominal cost
`.github/workflows/license.yml` still runs on push and pull request events. It installs the license and notice tools, runs the permissive policy check, regenerates `THIRD-PARTY-NOTICES.md`, and fails if the committed notices drift. The `deny.toml` allow-list remains in the root, and current tests still pin its scope.
This sprint activated the compliance policy on ordinary development traffic instead of waiting for a tagged release. The work was independent of release artifact generation: add a separate workflow, install the needed license tools there, run the policy check, regenerate notices, and assert the workflow shape in native tests. It completed without repair, which matched the cut: the worker was wiring an already-defined policy rather than deciding its contents.
Release Artifact Generation
2 agents 3m 41s wall time 81k peak context 14.7k tokens out $2.25 nominal cost
The original release job that staged these artifacts has been removed. The capability is now expressed in `scripts/release/build-local-release.sh`, which regenerates notices, builds the SBOM, calls `make-source-archive.sh` with the stripped tree, and stages the source-review zip beside release outputs. The sprint's exact YAML is not isolateable today, but its artifact production sequence is present in the replacement release producer.
This sprint connected the foundation to the tag-triggered release job without touching checksums or signing. Its brief was to install generator tools, produce the SBOM, regenerate notices, call the archive script with release context, and stage the resulting files. That was the broadest workflow edit so far, but still bounded by a clear stop line before publication integrity. It landed green, with the digest caution already written into the brief.
Cryptographic Verification
2 agents 5m 50s wall time 99k peak context 18.1k tokens out $2.66 nominal cost
`SIGNING.pub` is still committed, and the current README and packaging docs still describe verification through a signed checksum manifest. The GitHub upload list and secret-guarded workflow step are gone with the hosted release workflow, but the local release builder now signs the checksum manifest, self-verifies it, and records the source-review zip by its own shipped hash. The public verification path remains a live part of distribution, even though the delivery mechanism changed.
This sprint finished the publication path over the artifacts the previous sprint staged. The worker had to extend the checksum manifest, add detached signing under a secret guard, commit public verification material, and update the upload list while keeping the archive's two digest meanings separate. It completed without recorded repair, so the earlier replan had done its job: the hard distinction arrived as an input, not as a late surprise.
Distribution Documentation
2 agents 2m 38s wall time 75k peak context 8.3k tokens out $1.96 nominal cost
The README still has verification prose for signed releases and points readers to the packaging documentation for archive contents, licensing, and no-history behavior. That prose has been expanded since the job to cover reproducible builds and the current local release path, and it now reflects the final Gantry Source License rather than the earlier review-only draft. The load-bearing idea remains intact: downloaded artifacts are checked against the signed manifest, while the archive metadata digest is for reproduction.
This final sprint was documentation after the machinery existed. Its brief was narrow but correctness-sensitive: explain the source-review archive, review license boundary, no-history stance, and customer verification flow, while avoiding any claim that the metadata digest is the download hash. The sprint completed green. It closed the run by translating the pipeline contract into customer-facing instructions.