releases

Builds of main, tags and releases, per project. Pando records them; the CI runs the builds (research/plans/releases-2026-10-04).

• Main is built at merge. A Buildkite hook taking merged builds main's new merge commit on main (its status token is for that commit), never the branch head again.
• Not built. The summary reads not_built for a commit nothing reported on and nothing requires, never green. The merge gate keeps reading such a commit as success.
• Tags are recorded by the git door from refs/tags/* as pushes land, an annotated tag peeled to its commit; events tag.created and tag.deleted; the hook event tag.
• A release is a tag on its project's main with a title, notes and files. Anyone who may merge may publish one; the commit's required checks must be green unless forced (the merge rule). A published release's tag can't be moved or deleted with git until the release is deleted; deleting a release keeps its tag.
• Notes can be written from the merges since the last published release: each branch's title, who merged it, the issues it closed. At most 500 merges, then "and N more"; notes at most 100,000 characters.
• Files are kept in R2: at most 100 MB (100,000,000 bytes) each and 20 a release, SHA-256 kept. Downloads are for members unless the project's switch "Anyone can download releases" (releases_public) is on; it opens release files only, never code.