mirror of
https://github.com/apache/struts.git
synced 2026-08-11 01:27:14 +00:00
Lukasz Lenart
f2f3a9d3ba
* docs: design for a creating-release-vote-mail skill Specifies a sibling to creating-version-notes that drafts the [VOTE] Apache Struts X.Y.Z mail once the Version Notes page, GitHub release and staged artifacts are published. Derived from the 7.2.1 and 6.10.0 vote mails: the body is a plain-text rendering of the Version Notes page, the ASF vote boilerplate is frozen in a template, and the mail goes to dev@ only with private@ in Bcc. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: implementation plan for creating-release-vote-mail Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: revise vote-mail spec from baseline testing Three baseline agents drafted the 7.3.0 vote mail with no skill present. Two-thirds of the specified content taught nothing - rendering from the page, precondition checks, security truncation, checkboxes, subject and Bcc were all done correctly unassisted, so they become cross-references. Reverses two decisions on the evidence: Rejected requests are included (3/3 agents reproduced them, as does the page's own framing) and the staging URL aligns on content/groups/staging/ with the page and the [TEST] mail. Adds the rule that a vote carries no security information on any channel, after a baseline kept dev@ neutral and then routed severities, bulletin ids and reporter detail into a private@ companion mail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: add creating-release-vote-mail skill Drafts the [VOTE] Apache Struts X.Y.Z mail as a rendering of the published Version Notes page. Scoped to the five failures three baseline agents actually made without it: security detail routed through a private companion mail, a body grown beyond the page, user@ on Cc, sending rather than drafting, and a paragraph inserted into the frozen vote boilerplate. Everything the baselines already got right - rendering from the page, precondition checks, security truncation, checkboxes, subject, Bcc - is cross-referenced to creating-version-notes and creating-security-bulletins rather than restated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: close the vote-mail skill loop after GREEN runs Template now states that a page section's own introductory sentence comes with it, after a verification run kept the Rejected requests preamble on judgement the skeleton did not support. Chains creating-version-notes to the vote as its next step, and replaces the pre-testing plan with the record of the RED/GREEN/REFACTOR cycle - including the contamination lesson: baselines must run in a worktree that does not contain the design document. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: record why private@ is on the vote mail It is there for reach - not every PMC member follows dev@ and PMC votes are the binding ones - not for confidentiality. Stating this closes the loophole where an agent reads private@ as a confidential channel and routes advisory detail through it, which is what the disclosure baseline did. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>