docs: add creating-release-vote-mail skill - #1836
Merged
Merged
Conversation
Specifies a sibling to creating-version-notes that drafts the [VOTE] Apache Struts X.Y.Z mail once the Version Notes page, GitHub release and staged artifacts are published. Derived from the 7.2.1 and 6.10.0 vote mails: the body is a plain-text rendering of the Version Notes page, the ASF vote boilerplate is frozen in a template, and the mail goes to dev@ only with private@ in Bcc. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three baseline agents drafted the 7.3.0 vote mail with no skill present. Two-thirds of the specified content taught nothing - rendering from the page, precondition checks, security truncation, checkboxes, subject and Bcc were all done correctly unassisted, so they become cross-references. Reverses two decisions on the evidence: Rejected requests are included (3/3 agents reproduced them, as does the page's own framing) and the staging URL aligns on content/groups/staging/ with the page and the [TEST] mail. Adds the rule that a vote carries no security information on any channel, after a baseline kept dev@ neutral and then routed severities, bulletin ids and reporter detail into a private@ companion mail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Drafts the [VOTE] Apache Struts X.Y.Z mail as a rendering of the published Version Notes page. Scoped to the five failures three baseline agents actually made without it: security detail routed through a private companion mail, a body grown beyond the page, user@ on Cc, sending rather than drafting, and a paragraph inserted into the frozen vote boilerplate. Everything the baselines already got right - rendering from the page, precondition checks, security truncation, checkboxes, subject, Bcc - is cross-referenced to creating-version-notes and creating-security-bulletins rather than restated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Template now states that a page section's own introductory sentence comes with it, after a verification run kept the Rejected requests preamble on judgement the skeleton did not support. Chains creating-version-notes to the vote as its next step, and replaces the pre-testing plan with the record of the RED/GREEN/REFACTOR cycle - including the contamination lesson: baselines must run in a worktree that does not contain the design document. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
It is there for reach - not every PMC member follows dev@ and PMC votes are the binding ones - not for confidentiality. Stating this closes the loophole where an agent reads private@ as a confidential channel and routes advisory detail through it, which is what the disclosure baseline did. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
creating-release-vote-mailskill that drafts the[VOTE] Apache Struts X.Y.Zmail as a plain-text rendering of the already-published Version Notes page.It is the step after
creating-version-notes: that skill ends at the[TEST]announcement, this one opens the vote. A handoff paragraph chains the two.Contents
SKILL.md— the judgement: the six-part body recipe, the rule that a vote carries no security information on any channel,dev@-only recipients, draft-never-send, and the frozen boilerplate.vote-mail-template.md— the artifact: slots, the authored shape sentence, the skeleton, the ASF vote boilerplate reproduced byte-identical to the archived 6.10.0 and 7.2.1 mails, and a pre-draft checklist.How it was scoped
Built test-first per
superpowers:writing-skills. Three agents drafted the 7.3.0 vote mail with no skill present, in a worktree that did not contain the design document.They already rendered the body from the cwiki page rather than JIRA, verified all four links live, kept security summaries truncated, left the checkboxes empty, used the exact subject, and authored a fresh opening sentence — so roughly two-thirds of the originally specified content was documenting what agents already do correctly. That became cross-references to
creating-version-notesandcreating-security-bulletinsrather than prose.The skill teaches only what the baselines got wrong:
private@companion mailuser@added to recipientsTwo design decisions were reversed by the evidence:
Rejected requestsare included (3/3 agents reproduced them, as does the page's own framing), and the staging URL aligns oncontent/groups/staging/with the Version Notes page and the[TEST]mail.Verified by re-running all three scenarios with the skill present, plus a fourth targeting the
private@-as-confidential-channel loophole. All pass: exactly one mail, nouser@in any header, no severity/CVE/S2-XXX/reporter detail, boilerplate byte-identical, draft not send.Design and implementation record are under
docs/superpowers/.No JIRA ticket — process documentation, consistent with the
creating-version-notesandcreating-security-bulletinsskill commits.🤖 Generated with Claude Code