---
namespace: bt6-maintainer
name: bt6-release-validation
platforms: [all]
description: Validate an exact tagged BT6 release with the repository's exhaustive suite before artifacts are promoted.
triggers:
  - bt6 release validation
  - validate a tagged BT6 release
  - run the full BT6 release gate
requires:
  - tagged-reference: an existing tag resolvable to an exact commit
  - repository-context: canonical repository, CI remote, and validation profile resolvable from project state
ensures:
  - exact-tag-validated: report binds every check to the resolved tag and commit
  - full-suite-required: profile full commands and applicable release checks pass
  - no-promotion-on-failure: failed or incomplete validation blocks release artifacts
commandHint:
  argumentHint: "<tag> [--report-only]"
  allowedTools: Bash, Read, Grep
  model: sonnet
  category: release-management
  modelRole: reasoning
  modelTier: standard
---

# BT6 Release Validation

Validate an existing tag before publishing or promoting release artifacts. Apply
`bt6-maintainer-guardrails`. This workflow does not create, move, or delete tags
and does not publish a release without separate explicit authorization.

## Required context

1. Resolve the canonical repository, CI remote, base branch, profile, expected
   actor, and release authority from project configuration and live state.
2. Resolve the requested tag to an immutable commit and record whether the tag
   is signed or annotated when repository policy requires it.
3. Refuse an ambiguous, missing, moving, or policy-disallowed tag. Never validate
   the working tree as a substitute for the exact tagged commit.
4. Use an isolated checkout or worktree so validation does not overwrite local
   work.

## Required validation

1. Run every repository-profile `validation.full` command at the exact tagged
   commit.
2. Run applicable `documentation`, `researchIntegrity`, and risk-surface checks.
3. Run repository-defined source-snapshot integrity, compatibility, and
   supported-platform checks. Verify the release ZIP comes from the tagged
   source rather than an unrelated checkout; do not require a compiled package.
4. Compare local evidence with CI for the same tag and commit. Record missing or
   stale evidence as incomplete, not passing.
5. Treat warnings, flakes, skips, coverage changes, and conditional-gate gaps
   according to repository release policy; do not inherit the relaxed PR
   turnaround budget as a release exemption.
6. When `releaseEvidence` is configured, verify every artifact against the
   canonical checksum manifest, authenticate its SLSA/in-toto attestation,
   validate the source-SBOM binding, and prove promotion uses the tested
   snapshot-once ZIP bytes. A checksum without authenticated provenance is
   incomplete evidence.

## Decision

- `pass` only when every required check succeeds for the exact tag commit.
- `fail` for any failed required check or artifact/source mismatch.
- `hold` when the tag, authority, profile, platform evidence, or required command
  cannot be resolved safely.

Do not promote artifacts or describe the tag as released after `fail` or `hold`.
Use `templates/bt6-release-validation-report.md` and record the event that makes
the evidence stale.
