Harden release dependency policy gates

Author: eldryoth

CHANGELOG.md

@@ -57,6 +57,12 @@ behavior when the change improves security or project direction.
 - Refresh `ROADMAP.md` so `1.6.x` is consistently documented as the
   Pingora-exit line, shared Wasm extensibility is moved to `1.7`, and HTTP/3
   remains after the runtime boundary is stable.
+- Harden `scripts/validate-pingora-dependency-policy.sh` so documented
+  Pingora removal targets are enforced against the current Fluxheim version
+  instead of acting as a set-membership inventory only.
+- Tighten release-gate scripts by requiring modularity exceptions to be listed
+  as structured table rows and by giving the UDP smoke negative assertion a
+  longer observation window.
 
 ## 1.5.23 - 2026-06-14
 

docs/runtime-baseline.md

@@ -50,6 +50,15 @@ by:
 scripts/validate-pingora-dependency-policy.sh check
 ```
 
+That gate fails when a Pingora crate is present without an exception, when an
+exception is stale, or when the current Fluxheim version has reached the
+exception's `removal_target`. Maintainers can test an upcoming release bump
+before editing `Cargo.toml` with:
+
+```bash
+FLUXHEIM_PINGORA_POLICY_VERSION=1.6.1 scripts/validate-pingora-dependency-policy.sh check
+```
+
 Release mode invokes the performance baseline automatically. To skip it for a
 local emergency run, set:
 
@@ -87,4 +96,6 @@ and macOS developer builds.
 Temporary compatibility shims are acceptable only while an old and new runtime
 path are being compared. New internal APIs should not introduce fresh Pingora
 types unless the same release documents the exception and target removal
-release.
+release. If a removal slips, the exception file must be updated explicitly with
+a new target and release-note rationale; the gate must not stay green by
+accident.

release-notes/RELEASE_NOTES_1.6.0.md

@@ -54,6 +54,12 @@ remove Pingora safely in later 1.6.x releases.
 - Refreshed `ROADMAP.md` so `1.6.x` is consistently documented as the
   Pingora-exit line, shared Wasm extensibility is moved to `1.7`, and HTTP/3
   remains after the runtime boundary is stable.
+- Hardened `scripts/validate-pingora-dependency-policy.sh` so documented
+  Pingora removal targets are enforced against the current Fluxheim version
+  instead of acting as a set-membership inventory only.
+- Tightened release-gate scripts by requiring modularity exceptions to be
+  listed as structured table rows and by giving the UDP smoke negative
+  assertion a longer observation window.
 
 ## Notes
 

scripts/smoke_udp_proxy.sh

@@ -214,7 +214,7 @@ import time
 
 path = pathlib.Path(sys.argv[1])
 forbidden = sys.argv[2].encode("ascii")
-deadline = time.monotonic() + 1.0
+deadline = time.monotonic() + 3.0
 
 while time.monotonic() < deadline:
     if path.exists() and forbidden in path.read_bytes():

scripts/validate-modularity-policy.sh

@@ -35,7 +35,7 @@ git ls-files '*.rs' | while IFS= read -r path; do
         continue
     fi
     printf 'modularity policy: %s lines %s\n' "$lines" "$path"
-    if [ "$mode" = "check" ] && ! grep -Fq "\`$path\`" "$exceptions"; then
+    if [ "$mode" = "check" ] && ! grep -Fq "| \`$path\` |" "$exceptions"; then
         echo "modularity policy: $path exceeds $limit lines and is not listed in $exceptions" >&2
         printf '%s\n' "$path" >> "$tmp"
     fi

scripts/validate-pingora-dependency-policy.sh

@@ -14,6 +14,7 @@ esac
 
 exceptions="docs/pingora-dependency-exceptions.tsv"
 out_dir="${FLUXHEIM_PINGORA_POLICY_DIR:-target/release-evidence/pingora-dependency-policy}"
+current_version="${FLUXHEIM_PINGORA_POLICY_VERSION:-$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | sed -n '1p')}"
 
 if [ ! -f "$exceptions" ]; then
     echo "pingora dependency policy: missing $exceptions" >&2
@@ -55,24 +56,40 @@ capture_tree() {
     esac
 }
 
+extract_pingora_crates() {
+    profile="$1"
+    tree_file="$out_dir/cargo-tree/$profile.txt"
+    matches_file="$out_dir/cargo-tree/$profile.pingora-matches.txt"
+
+    if grep -Eo 'pingora[-_a-z]* v[0-9][^ )]*' "$tree_file" >"$matches_file"; then
+        sed 's/ v/\t/' "$matches_file" \
+            | sort -u \
+            | while IFS="$(printf '\t')" read -r crate version; do
+                printf '%s\t%s\t%s\n' "$profile" "$crate" "$version"
+            done
+    else
+        status="$?"
+        if [ "$status" -ne 1 ]; then
+            echo "pingora dependency policy: failed to inspect $tree_file" >&2
+            exit "$status"
+        fi
+    fi
+}
+
 profiles="default full cache-edge proxy-edge load-balancer-edge php privacy"
 current_tsv="$out_dir/current.tsv"
 current_keys="$out_dir/current.keys"
 exception_keys="$out_dir/exceptions.keys"
 unexpected="$out_dir/unexpected.keys"
 stale="$out_dir/stale-exceptions.keys"
+expired="$out_dir/expired-exceptions.tsv"
 
 {
     printf 'profile\tcrate\tversion\n'
     for profile in $profiles; do
         echo "pingora dependency policy: cargo tree $profile" >&2
         capture_tree "$profile"
-        grep -Eo 'pingora[-_a-z]* v[0-9][^ )]*' "$out_dir/cargo-tree/$profile.txt" \
-            | sed 's/ v/\t/' \
-            | sort -u \
-            | while IFS="$(printf '\t')" read -r crate version; do
-                printf '%s\t%s\t%s\n' "$profile" "$crate" "$version"
-            done || true
+        extract_pingora_crates "$profile"
     done
 } >"$current_tsv"
 
@@ -93,6 +110,54 @@ awk -F '\t' '
 comm -23 "$current_keys" "$exception_keys" >"$unexpected"
 comm -13 "$current_keys" "$exception_keys" >"$stale"
 
+awk -F '\t' -v current_version="$current_version" -v current_keys="$current_keys" '
+    function compare_version(left, right, left_parts, right_parts, i) {
+        sub(/^v/, "", left)
+        sub(/^v/, "", right)
+        split(left, left_parts, /[^0-9]+/)
+        split(right, right_parts, /[^0-9]+/)
+        for (i = 1; i <= 3; i++) {
+            if (left_parts[i] !~ /^[0-9]+$/ || right_parts[i] !~ /^[0-9]+$/) {
+                return "invalid"
+            }
+            if ((left_parts[i] + 0) < (right_parts[i] + 0)) {
+                return -1
+            }
+            if ((left_parts[i] + 0) > (right_parts[i] + 0)) {
+                return 1
+            }
+        }
+        return 0
+    }
+    BEGIN {
+        while ((getline key < current_keys) > 0) {
+            current[key] = 1
+        }
+        close(current_keys)
+        if (compare_version(current_version, "0.0.0") == "invalid") {
+            print "pingora dependency policy: invalid current version " current_version > "/dev/stderr"
+            exit 2
+        }
+    }
+    /^[[:space:]]*#/ { next }
+    NF == 0 { next }
+    $1 == "profile" { next }
+    NF < 4 { next }
+    {
+        key = $1 "\t" $2
+        if (key in current) {
+            comparison = compare_version(current_version, $3)
+            if (comparison == "invalid") {
+                print "pingora dependency policy: invalid removal_target " $3 " for " key > "/dev/stderr"
+                exit 2
+            }
+            if (comparison >= 0) {
+                print $1 "\t" $2 "\t" $3
+            }
+        }
+    }
+' "$exceptions" | sort -u >"$expired"
+
 if [ -s "$unexpected" ]; then
     echo "pingora dependency policy: unexpected Pingora crates:" >&2
     cat "$unexpected" >&2
@@ -103,7 +168,12 @@ if [ -s "$stale" ]; then
     cat "$stale" >&2
 fi
 
-if [ "$mode" = "check" ] && { [ -s "$unexpected" ] || [ -s "$stale" ]; }; then
+if [ -s "$expired" ]; then
+    echo "pingora dependency policy: expired Pingora exceptions still present for Fluxheim $current_version:" >&2
+    cat "$expired" >&2
+fi
+
+if [ "$mode" = "check" ] && { [ -s "$unexpected" ] || [ -s "$stale" ] || [ -s "$expired" ]; }; then
     exit 1
 fi