# SecOps Codemark 0.4.1 release tooling review

Date: 2026-10-16 UTC. Qualified source and test code: `239cc2ecc0e3c114769978a87bd70730e3cb383d`. The release recipe was separately reproduced at `f72371ae987ad2299778d0f8a637bda85740c38f`.

## Scope and method

Focused review of source staging, generated output preservation, local instruction exclusions, native archiver preflight, website report routes and their regression tests. Reproductions used synthetic private-directory fixtures in a networkless namespace. No real private user files or keys were used. A separate review checked the final packaging patch; this is not an independent external audit or certification.

| Confirmed defect | Correction and regression |
| --- | --- |
| Selected source directory replaced by a symlink | Reject each selected source root before traversing it; outside-tree fixture contents are not packaged |
| Existing generated target or output symlink overwritten | Check every generated target before artifact writes, including dangling links; create portable and checksums exclusively; preserve existing bytes and modes |
| Nested local instruction files included | Screen path components and private instruction names consistently; ordinary public source remains included |
| Missing requested archiver reported after output creation | Check required native Zupt before creating output; missing-tool regression leaves no output directory |
| Reports with different extensions sharing one readable route | Validate report filenames and route stems before writing the site; rejected existing and new output trees remain unchanged |
| Strict website validation attempted before download staging | Bilingual release guide stages checksum-checked artifacts first; the complete documented workflow passed with a fresh output |

## Verification

**183 tests passed, zero failed or skipped**, in 7.276 seconds. **11 portable checks passed** outside the source tree with isolated Python. Real OpenSSL 3.5.7 and Zupt 5.2.10 were available for the native fixtures. Ruff, formatting, Pyright and bounded selected-source secret screening passed. Read the [qualification](0.4.1-validation.json), [test log](0.4.1-tests.txt) and [portable record](0.4.1-self-test.json) for exact scope.

The [first candidate CI run](https://github.com/cristiancmoises/secops-codemark/actions/runs/38887558358) exposed an unresolved temporary root in the new Windows website test fixture. The fixture now resolves that root as production does; publication path validation and assertions were preserved. The complete GNU/Linux suite passed after this correction. The exact final-source six-job matrix remains a publication gate and is linked from the release.

## Preserved contracts and limits

Runtime CLI arguments, snapshot and attestation schemas, mandatory hybrid authentication, private bundle format, deterministic ZIP metadata and staged executable intent are preserved. This patch changes release-tooling validation and the version identifier.

Build output must be new for every attempt. Later filesystem, compression or archive-test failures can leave incomplete output and are not a successful release. The builder is not host containment against a concurrent privileged process. Filename screening does not certify the absence of source-embedded secrets.

Native Zupt 5.2.10 qualifies extracted file bytes but does not restore POSIX modes or ACLs. Never refresh an integrity snapshot to hide a permission mismatch. Historical similarity and pipeline figures remain tied to their original 0.4.0 experiments; no new accuracy or speed ranking is claimed.

## Resumo em português brasileiro

Foram corrigidas a travessia por links nas raízes de fontes, sobrescritas de destinos, inclusão de instruções privadas aninhadas, detecção tardia da ausência do compressor e colisões de rotas dos relatórios. O guia novo prepara os downloads antes da validação estrita. Passaram 183 testes e 11 verificações do portátil; os resultados têm o escopo e a revisão acima. A revisão é focal e não representa auditoria externa independente. Falhas posteriores do compressor exigem nova saída, e o limite de permissões do Zupt permanece documentado.