From 906ef7df604115bb86e4b5d262e048a519005a1b Mon Sep 17 00:00:00 2001 From: garrytan Date: Wed, 28 Oct 2026 00:29:42 +0000 Subject: [PATCH] docs: FLOOR_UNKNOWN wording names the security exception; sanitizer and outcome rows match the code Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- docs/releases.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/releases.md b/docs/releases.md index 3b02706f5..f5ab43550 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -95,7 +95,8 @@ missing) is not a new move, and a run without `ref` finishes that cut before it considers anything newer. The floor fails closed when it cannot date the move. Three cases are -`FLOOR_UNKNOWN`, red on every trigger. They are a `stable` that no annotated tag dates +`FLOOR_UNKNOWN`, red on every trigger, and only a verified security cut gets +past them, as it gets past the floor. They are a `stable` that no annotated tag dates (only this tool moves `stable` and it tags first, so that state means someone moved it by hand), a release that cannot be read (a GitHub API error is not "no release"), and a `ref` cut while `stable`'s own release is still @@ -145,8 +146,8 @@ and the fix still ships with it (there are no cherry-picks); the plan's `RIDING_ALONG:` line counts them. The reason is public. It goes, as one line of at most 300 characters (control -characters and backticks stripped), into the tag message and the release -notes: `**Security release:** (verified: )`. For an +characters become spaces and backticks become apostrophes), into the tag +message and the release notes: ``**Security release:** `` (verified: )``. For an embargoed fix, use path 2 with a neutral commit subject and a labelled issue whose title says no more than the fix does, and keep advisory details out of the reason until disclosure. @@ -261,6 +262,6 @@ is exercised against real check runs before it merges. | `NEXT_ALLOWED: