Repository navigation
fix(ci): retain reliable audits and owned native fixture evidence - #35
Merged
Merged
Conversation
Retain every production subject and mutation while indexing actual instruction populations within each detector evaluation. Plain database fixture setup owns a physical nonpooled connection instead of repeating Docker and psql startup; real role, rollback and cleanup controls pin the same authority. Record completed local proof without implying hosted fit. ADR: 0003, 0047, 0060
Measure the unchanged proof workload before selecting collector authority or scheduling bounds. Report only finite read-only environment facts and enable the stock console logger alongside final TRX results. Preserve all filters, required names and deadlines; the native preflight still refuses unsupported collectors. Keep the decision index tied to local closeout. ADR: 0060
Keep the repository source census fail-closed while recording the two\nCI-only Python observer files with the existing non-runtime tooling.
Separate the proposed native VM and fixed collector lifecycle from measured CI outcomes, preserve complete required coverage, and record reviewed alternatives without accepting or implementing the decision. ADR: 0060
Keep the complete production and mutation census while avoiding eager identity formatting for unrelated calls and field writes. Preserve independent raw traversal parity and per-evaluation cache lifetimes. ADR: 0047
Keep the same concrete task-owner proof while selecting field writes from the current detector index, so unrelated method identities are not rebuilt on every mutation. Record full and focused qualification without treating local timings as hosted CI success. ADR: 0047
Record the maintainer's approval before dependent CI implementation. Preserve ADR-0060's accepted body through a dated bounded disclosure and keep implementation, enforcement and hosted qualification pending. ADR: 0060, 0062
Accept the hosted runner's documented absent-services representation and parse native ownership with the actual Release build symbols so normal jobs launch and conditional native calls cannot escape their partition. Record both independent review rounds and real native protocol evidence. ADR: 0062
Keep the strict production event parser while preventing a forked test fixture from exposing an empty intermediate file on faster Linux hosts. Record the real hosted failure separately from local repair evidence. ADR: 0062
Keep every crash candidate fatal to qualification while retaining enough finite metadata to distinguish its scan scope and filename category. Never export candidate paths, contents or provider text from the VM. ADR: 0062
Reopen the execution topology after measured hosted budget failures while preserving every case, existing required names and twenty-minute ceilings. Record reviewed finite VM costs and defer dependent code to acceptance. ADR: 0062, 0063
Keep unknown inventory candidates fatal while observing a finite format label through one fixed read-only probe within the existing scan budget. Diagnostic faults never replace the original qualification refusal. ADR: 0062
Keep scan decisions strict while distinguishing fixed storage regions, common file formats and a refused probe without exporting private data. Record actual prelaunch observations separately from qualification. ADR: 0062
Separate retained wall evidence from incomplete duration estimates and make manual tuning, independent layouts, runner authority and aggregate ownership concrete before seeking acceptance. Preserve the outstanding ordinary owner fault and all hosted qualification gates. ADR: 0062, 0063
Keep independent proposal reviews and document checks distinct from maintainer acceptance and final hosted qualification. ADR: 0063
Record maintainer approval before dependent implementation, disclose ADR-0062's bounded replacement and additive authority, and register the general CI obligation without claiming implementation or hosted fit. ADR: 0062, 0063
Keep every fresh discovered test in one deterministic owner and prove both accepted layouts against exact per-project selector discovery. Retain timing provenance without letting estimates define membership. Fix a nonserializable theory and bind TRX Unicode equivalence to the actual discovered assembly and case identity. ADR: 0062, 0063
Reject cross-partition selector groups before assignment so theory and overload rows cannot acquire multiple execution owners despite complete case-ID unions. Cover every partition boundary in both layouts and record independent first-round verification. ADR: 0063
Record both fresh independent Step 1 reviews and the committed cross-partition correction. Keep hosted fit and the remaining execution and aggregate obligations explicit. ADR: 0063
Extend the existing owned process lifecycle with complete selector rediscovery and exact shard result reconciliation. Confine non-Docker jobs to their process subtree, preserve native-only collector setup, and record actual toolchain, phase and resource observations. Handle only verified proc task-exit races narrowly and retain closed stage diagnostics for other membership failures. Keep hosted fit and workflow attestation pending the final implementation step. ADR: 0062, 0063
Record independent approval and exact local control results without claiming Linux containment or final-source hosted qualification. ADR: 0062, 0063
Observe failed units while waiting for readiness instead of spending the full execution allocation. Retain a bounded closed startup cause and a thirty-second handshake cap within the existing job budget. Prove no workload starts and owned cleanup still runs after refusal. ADR: 0062, 0063
Record both independent Step 2 reviews and the verified startup fix before beginning workflow and aggregate enforcement. ADR: 0062, 0063
Record two independent approvals, their actual-shell controls and historical evidence checks without claiming new hosted qualification. ADR: 0056, 0063
Record fresh second-round approvals and independent historical evidence revalidation. Keep complete final-source hosted A/B as a separate gate. ADR: 0056, 0063
The hosted snapshot control fails strict temporary cleanup while its Git object directory changes. Keep maintenance in the foreground only in the synthetic repository so the waited commit also waits its actual work. Prove nested commit-graph completion with a real Git trace under a private configuration that otherwise requests background maintenance. Retain strict cleanup and all OpenAPI comparison and admission rules. The observed mechanism is not a captured trace of the hosted failure. ADR: 0007, 0052
Reject a planted graph write failure even when a prior graph exists. Correct pinned source anchors using physical raw-file lines and record both first-round reviews and their verified fixes. ADR: 0007, 0052
Record two fresh second-round approvals and the independently repeated clean, detached and planted-failure controls with their runtime limits. ADR: 0007, 0052
Both aggregate jobs reject a gate but discard which source-owned producer and step failed validation. Emit finite state words before the unchanged refusal so later API success cannot obscure the original observation. Never export arbitrary provider values or retry inconsistent evidence. Keep the unsuccessful historical attempt separate from new qualification. ADR: 0007, 0063
Retain independent closed-output checks and historical evidence limits. Separate complete public component observations from failed whole-run qualification and final-source A/B still required. ADR: 0007, 0056, 0063
Record fresh differential and mutant controls, independent component archive checks and the unchanged final-source whole-workflow gate. ADR: 0007, 0063
Disable the unowned telemetry exporter in the Outbox host fixture and join actual startup before disposal even when its assertion wait expires. Retain only finite startup facts from the real test adapter output. Report closed producer states before the unchanged aggregate refusal. Keep unknown hosted causes distinct from local counterfactual evidence. ADR: 0007, 0044, 0046, 0063
Record independent code, protocol and retained-evidence validation while preserving unknown hosted causes and complete final-source A/B gates. ADR: 0063
Record the second fresh review pair and narrow container identity prose to the exact retained evidence. Keep full final-source A/B pending. ADR: 0063
Read fresh complete attempt snapshots under one short acquisition budget before applying the unchanged successful-producer witness. Refuse terminal, malformed and identity-invalid evidence immediately, including when an earlier owner is pending. Never combine snapshots. Keep the five-minute aggregate ceiling and upload reserve unchanged. ADR: 0063
Reject malformed or reversed creation timestamps before a pending owner can cause another read. Record independent repros and corrected first-round review validation. ADR: 0063
Record fresh second-round deadline and malformed-evidence controls, with retained failed-attempt and pending hosted qualification limits. ADR: 0063
Phase 02b's phase document reached 18,884 lines, 92% of them dated packet records, and Phase 02d followed the same shape; status was narrated in five places and no check covered link fragments. The maintainer accepts keeping the plan and the record in separate files, status in one place, and two CI guards that hold both, after one review round whose findings this text resolves. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moves every dated packet record out of the two phase documents into sibling append-only delivery logs, grouped by packet in source order, with the superseded Status blocks kept verbatim in each log's archive. Each heading's anchor was recomputed in its new file and checked against its original one, duplicates included, and every original line survives the split; only heading levels and link targets around the text change. 606 inbound links are retargeted with their text unchanged, so the Accepted ADRs touched owe no amendment. Phase 04's one dated plan heading keeps its date in its acceptance line and its six links follow it. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Packet state was narrated in the phase Status block, the packet table, the Completion Criteria preamble, the roadmap index, CLAUDE.md and the repository README, and every step edited all of them. Each now points at the phase document, whose bounded Status block owns packet state; CLAUDE.md drops from 856 to 405 lines. The rule itself lands where readers look for it: Roadmap § Phase Structure and § Decision Timing, Documentation Standards, the glossary, CLAUDE.md and the two skills that write roadmap records. ADR-0069's dated amendment names the README as a sixth carrier and fixes how its budgets are counted. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The link audit strips fragments and reads only changed files, so a moved heading broke links silently, and nothing stopped a phase document from growing records again. The meta job now resolves every fragment link in the tree against GitHub's heading slugs and holds phase documents, delivery logs, the roadmap index, CLAUDE.md and the README to ADR-0069; `make lint` runs both through `lint-docs`. Each guard ships planted-violation controls, the source census classifies the four new tooling files, and the link audit now skips code spans as it already skipped fenced samples. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A delivery log is too large to read whole, so an agent needing one entry has no map of the rest. The amendment opens each log with an index generated from its headings and checked in CI, listing lengths rather than line numbers and no inferred record kinds, and states that the index is navigation, not a record. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Phase 02b log is about 305,000 tokens, so an agent needing one entry had no map of the rest. Each log now opens with an index of its packet sections, entries and dated sub-entries with their lengths, generated by scripts/delivery-log-index.py (`make docs-index`) and refused when stale by the meta job and `make lint-docs`. The fragment audit covers every row's anchor; the logs, roadmap index, Documentation Standards, glossary, CLAUDE.md and the two record-writing skills say to read the index, not the log. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The public demo's five-minute browser step failed four of today's twelve attempts while Playwright's --with-deps installer downloaded fonts from the runner's slow APT mirror; the 15-second acquire timeouts cannot end a slow transfer that is still moving. The hosted image already carries every Chromium library, and no public-demo check depends on system fonts, so the step installs only the pinned Chromium build and drops the temporary APT fragment with it. The workflow test executes the actual step against stubs and fails on any sudo or APT call; against the previous workflow it fails. The delivery log records run 39805658821, the still-unexplained native fixture hang, and the maintainer's single-assignment qualification decision for PR #35. ADR: 0056, 0063 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cemililik
marked this pull request as ready for review
October 23, 2026 14:54
|
Architecture 
Inside the changed components — 1 viewComponent view — Documentation Guards and Audit Tooling Scripts and verification tests that inspect Markdown documents, fragments, and delivery log freshness. 
Data flow 
Tip Run 🪧 More tips
Thanks for using PR Lens! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out on X, Bluesky, Mastodon, Reddit or LinkedIn |
|
Sorry @cemililik, your pull request is larger than the review limit of 150,000 diff characters |
Collaborator
Author
|
@coderabbitai review all |
Contributor
|
Tip For best results, initiate chat on the files or code changes. @cemililik I couldn't produce a complete response to this request. Please try again. 🧠 Learnings used
You are interacting with an AI system. |
cemililik
added a commit
that referenced
this pull request
Oct 24, 2026
* docs(roadmap): close quota correction reviews for qualification Record both fresh quota reviews, current Release and PostgreSQL proofs, and the complete frontend source inventory correction. Freeze the source for renewed exact-head CI; historical results remain source-specific. * docs(roadmap): close merged P02b-4 and name the next packet Record the identical squash-merge tree and complete final-source A/B qualification. Reconcile mutable status carriers while preserving dated delivery receipts and keeping P02b-5 authentication gates open. ADR: 0047, 0063 * docs(decisions): propose the P02b-5 authentication boundary Verify the authentication entry contract before exposing validated claims while authorization remains staged. Record the bounded audit and read-mode instruments, shared ingress costs and five reviewable development steps for maintainer approval before runtime changes. ADR: 0064, 0036, 0040 * docs(roadmap): record P02b-5 decision reviews Keep the reviewed proposal and current entry evidence separate from runtime delivery. Close both independent decision review rounds, reconcile mutable phase pointers and retain the explicit maintainer acceptance boundary. ADR: 0064, 0036, 0040 * docs(decisions): resolve tenant authentication review gaps Make absent-credential masking, host-backed read admission and rejection attribution explicit before activation. Close JOSE and vendor diagnostic boundaries, disclose the full read-mode scope extension and preserve prior review receipts with dated finding dispositions rather than rewriting them. ADR: 0064, 0036, 0040, 0052 * docs(roadmap): record first authentication revision reviews Retain independent review evidence without treating it as acceptance. Make real-identifier checks explicit at the host-backed read boundary so an initialized wrapper cannot be mistaken for a valid tenant identity. ADR: 0064, 0036, 0040, 0052 * docs(roadmap): close authentication proposal revision reviews Record the second independent revision round and final document checks without treating reviewer approval as maintainer acceptance. Keep the original receipts and runtime boundary explicit before renewed approval. ADR: 0064, 0036, 0040, 0052 * docs(decisions): accept the tenant authentication boundary Record explicit maintainer acceptance before dependent runtime work. Disclose the bounded audit and exact read-mode changes in each affected ADR, correct row-10 staging through adjacent errata, and register the five proof obligations without claiming implementation evidence. ADR: 0064, 0036, 0040, 0052 * feat(kernel): add the isolated tenant token foundation Validate signed tenant credentials against the accepted closed profile and bound metadata retrieval before activating the HTTP authentication surface. Keep raw vendor failures out of enabled sinks while preserving closed application outcomes and unrelated diagnostics. ADR: 0064, 0036, 0032 * fix(kernel): keep metadata hosts out of native HTTP metrics Constrain native HTTP and DNS metric dimensions because request-local trace suppression does not prevent destination names reaching OTLP. Preserve duration and status signals, and prove the boundary with real retrieval, an unprojected control and a distinct hostname canary. ADR: 0064, 0032 * docs(roadmap): close both token foundation review rounds Record independent validation of the native metric privacy correction and keep the primary status carriers aligned before starting the real read-only application subject. ADR: 0064 * feat(tenancy): add the host-bounded read-only account query Expose only the caller's validated scope and the existing public site projection through an independently guarded application request. Select its physical read-only mode by one immutable exact-type declaration and share the existing transaction owner across API and Seeder composition. Prove actual app-role isolation, lifecycle visibility, audit Off behavior and SQL/EF write refusal before routing the request over HTTP. ADR: 0064, 0040, 0052, 0036 * docs(tenancy): record account query review and implementation Record both independent Step 2 first-round checks and reconcile the read-only standard with the implemented query before HTTP activation. ADR: 0064, 0040, 0052 * docs(roadmap): close both account query review rounds Record independent transaction, isolation and composition verification before starting attributed reconciliation and subject admission. ADR: 0064 * feat(kernel): attribute tenant refusals and add subject admission Carry validated identity through reconciliation without inventing audit tenants, and bound authenticated rejection work before recording. Preserve anonymous admission and keep production HTTP activation in the next step. ADR: 0064, 0036, 0033, 0044 * docs(roadmap): record the first admission review round Record independent checks of quota lifetime, attributed refusal and actual app-role audit behavior before the second review round. ADR: 0064 * fix(kernel): export actor UUIDs at rejection log boundaries Apply the identifier emission rule to both rejection log paths and pin the actual subject quota window independently. Close both Step 3 reviews with verified corrections and a planted default-window control. ADR: 0064, 0023 * docs(roadmap): wrap the admission closeout pointer Keep the current packet summary within the documentation prose convention. ADR: 0064 * feat(api): activate the closed tenant authentication boundary Bind strict bearer validation, host reconciliation and subject admission to one independently guarded read. Keep anonymous transport credential-free and qualify production routing, durable rejection attribution and generated public/authenticated contracts before widening the HTTP surface. ADR: 0064, 0036, 0040, 0052 Module: Tenancy * fix(api): document the early request body refusal The actual HTTP boundary rejects oversized GET bodies before authentication, but generated clients could not see that response. Require 413 in the served contract and negative controls while preserving the existing runtime outcome. ADR: 0064 * docs(roadmap): close both HTTP activation review rounds Record independent rechecks of the complete active boundary and its corrected contract before progressing to final production enforcement and qualification. ADR: 0064 * test(kernel): enforce closed tenant authentication authority Keep the activated authentication boundary dependent on its typed, validated identity and explicit production consumers. Prove missing, forged and mutable subjects fail the same complete census. Reconcile carrier contracts and catalogue owners without claiming pending CI. Make terminal-plan seed maintenance explicit so bitmap EXPLAIN counts measure live backlog rather than obsolete MVCC index entries. ADR: 0064 * fix(kernel): close alternate authentication authority paths Reject role metadata through its interface and positional identity extraction through generated deconstruction. Compiled negative controls reproduce each review gap before the detector correction. Reconcile the older job manifest's exact controller inventory with the approved AccountSite read and exercise its extra-action refusal. Align catalogue derivations and startup guidance with the active boundary. ADR: 0064 * fix(kernel): close identity exports and inherited role metadata Keep record formatting and alternate token APIs from bypassing the typed identity census. Bound acquisition and forwarding to the actual owners, and resolve authorization metadata through inheritance and interfaces. Compiled negative controls reproduce all three review gaps before the corrections; independent original probes confirm closure. Reconcile the remaining scalar-scope and membership reachability documentation. ADR: 0064 * docs(roadmap): close tenant API implementation and reviews Record all five completed steps, both independent review rounds and verified corrections while separating failed/as-of receipts from final PR-head qualification. Keep realm issuance, browser sessions and phase exit with their first consumers; start no next packet. ADR: 0064 * docs(roadmap): link tenant authentication review handoff Keep the live PR-head CI receipt discoverable from the local delivery record without treating an unmerged implementation as a merged packet. ADR: 0064 * docs(decisions): fix punctuation in ADR index summaries * docs(decisions): accept bounded tenant assertion diagnostics Accept the reviewed target-tenant audit allowance before dependent code. Disclose the loss of durable actor coverage and outbound destination metrics, preserve older decisions, and reconcile the proof owners. ADR: 0036, 0064, 0065 * fix(kernel): close tenant authentication review gaps Bind authentication and host authority to validated inputs, enforce the reviewed audit allowance, and strengthen the production censuses with load-bearing controls. Keep public transport and API configuration confined and reconcile the served OpenAPI and generated SDK contracts. ADR: 0036, 0040, 0052, 0064, 0065 Module: Tenancy, Kernel * docs(roadmap): record authentication review corrections Record verified dispositions, completed local populations and fresh independent reviews. Reconcile the shipped allowance and signal owners without borrowing historical CI receipts for the correction head. ADR: 0064, 0065 * fix(ci): retain closed public demo failure phases Preserve the first browser or worker phase across owned cleanup without exporting provider text. Exercise real worker connection refusal and primary/cleanup failures without changing proof budgets or retries. ADR: 0056, 0064 * fix(ci): recognize signalled browser startup exits Read Node's signal status alongside numeric exit status so a terminated browser is diagnosed without waiting for the startup deadline. Cover live, normal and signal status using actual child processes. ADR: 0056, 0064 * fix(ci): accept native child status in diagnostic types Describe only the process fields read by closed diagnostics. Compile-check real ChildProcess values and the operation callback in existing native child controls, while retaining unknown-field sanitization coverage. ADR: 0056, 0064 * docs(roadmap): record hosted authentication qualification Record complete source-bound backend receipts and the isolated demo refusal, with closed-diagnostic corrections and both fresh review rounds. Keep final-source hosted qualification explicit and mandatory. ADR: 0064, 0065 * docs(standards): Mark ADR-0065 diagnostic controls as implemented * fix(auth): close review privacy and proof gaps Enforce exemplar privacy, exact issuer/JWKS paths and worker process attribution. Strengthen production censuses, real persistence and HTTP controls, and SDK ownership proofs. Reconcile historical evidence and production activation ownership. ADR-0066 remains Proposed; subject-cap policy refinements await explicit approval. ADR: 0064, 0065 * fix(tests): close cross-assembly and middleware proof gaps Scan counter and header literals across all production assemblies. Inspect source-owned middleware and OpenAPI helper leaves before treating framework calls as terminals; plant real-wrapper and alias mutations. Record first-round findings, completed controls and exemplar correlation cost without claiming current-head hosted qualification. ADR: 0064, 0065 * fix(tests): reject hidden fluent middleware registrations Trace builder-valued receivers conservatively before skipping ordinary calls. Actual Program and resolver return mutations must expose chained extra authentication with a specific diagnostic; endpoint naming remains clean. Record round-two findings and the separate schema-proof limit. ADR: 0064 * docs(roadmap): record verified second review corrections Record both independent rounds, verified proof fixes and targeted recheck. Keep hosted qualification source-bound and ADR-0066 approval outstanding. ADR: 0064, 0065 * docs(decisions): clarify subject admission fault ownership Separate sticky cleanup failure from ordinary quota and capacity pressure. Specify one-disposal acquisition ordering, shared retirement ownership and unbounded disposal latency without claiming dependent runtime delivery. Mark mutable cap carriers as current code under a Proposed decision and name exact HTTP, metric, cleanup and concurrency proof obligations. ADR: 0066 * docs(decisions): complete admission retry contract inventory Record the first independent review round and explicitly include capacity retry-hint semantics in the future served and snapshot OpenAPI changes. Keep ADR-0066 Proposed and implementation proofs pending approval. ADR: 0066 * docs(roadmap): record subject admission revision reviews Record both fresh independent review rounds, the verified retry-contract inventory fix and current documentation/corpus validation. ADR-0066 stays Proposed and dependent runtime work still requires maintainer approval. ADR: 0066 * docs(decisions): accept bounded subject admission contract Record maintainer approval before dependent runtime changes. Preserve the Accepted ADR-0064/0065 bodies with adjacent attribution errata and their own dated disclosures, and align operational authorities with ADR-0066. Runtime, resource-bound and exported-signal proofs remain pending delivery. ADR: 0064, 0065, 0066 * feat(auth): own bounded subject admission cleanup Keep reclamation and failed resources under one singleton owner before allocation or debit, preserving existing quotas while exposing distinct capacity and cleanup-fault outcomes. Exercise the approved races, DI shutdown and exported signals with matching served and generated contracts. ADR: 0064, 0065, 0066 * fix(auth): preserve no-store on every subject refusal Apply the shared response policy even when a classified API path has no endpoint. Make missing-header assertions fail and bind the retirement timer to its accepted cadence so regression controls cannot pass silently. ADR: 0064, 0065, 0066 * docs(roadmap): close subject admission implementation reviews Record both fresh implementation review rounds and the verified header-proof corrections while keeping complete local and final-source hosted evidence under their own source identities. ADR: 0064, 0065, 0066 * fix(auth): close HTTP boundary proofs and receipt chronology Close composition and cross-root capability gaps in the existing authentication census. Preserve owned cleanup despite diagnostic faults, pin real reader and contract guards, and distinguish delivered status from historical acceptance receipts. ADR: 0036, 0040, 0041, 0052, 0064, 0065, 0066 * test(auth): close provider and anonymous metadata escape paths Extend the bounded filter census to effective provider composition and implemented anonymous contracts. Real DI and compiled metadata controls prevent unchanged filter options from hiding executable policy changes. ADR: 0064 * test(auth): pin effective action filters and authorization metadata Close supported MVC composition channels that can change effective filters or authorization without changing the global inventory or ordinary attributes. Pair exact runtime inventories with compiled dirty and restored controls. ADR: 0064 * docs(roadmap): close backend correction review rounds Record both independent rounds and targeted confirmation of the committed composition-proof fixes before starting the demo and SDK correction step. ADR: 0064, 0065, 0066 * fix(web): bind demo receipts and preserve failure ownership Keep local request refusal distinct from network failure and make demo receipts describe the actual process outcome and observed source. Bind both report files without relaxing browser budgets or cleanup ownership. ADR: 0053, 0054, 0056, 0064 * fix(web): retain the first owned demo failure Publish output refusal before physical shutdown and keep the same first daemon error for every observer. Classify native coordinator cancellation from its owned signal without replacing known faults or cleanup failures. ADR: 0056 * fix(web): observe failing native exits before output closure Keep the first native failure authoritative when paused or inherited output delays close, while successful capture and physical cleanup still retain their existing completion bounds. Real-child controls prove the failure ordering and preserve complete successful output. ADR: 0056, 0064 * fix(web): publish every unexpected daemon exit A daemon's zero exit is still an unexpected failure. Observe it apart from ordinary command success so delayed streams cannot replace the first daemon outcome, while complete command output remains required. ADR: 0056, 0064 * docs(roadmap): close systematic correction review rounds Record verified fixes and independent follow-up closure while keeping current-source hosted qualification separate from historical receipts, local checks, production activation and maintainer merge approval. ADR: 0056, 0064, 0065, 0066 * fix(ci): refresh architecture weights from complete hosted receipts A censored assignment colocated expensive serial controls and exhausted its existing deadline. Refresh only completed hosted selector costs, retain unknown estimates honestly, and require both final-source layouts without changing membership, topology, algorithm or time budgets. ADR: 0063, 0064 * docs(roadmap): close measured timing correction reviews Record both independent provenance and contract review rounds while requiring fresh complete A/B evidence for the revised timing plan. Clarify the existing distinction from ordinary future pushes without changing any execution or qualification policy. ADR: 0063, 0064 * fix(ci): require identified hosted timing sources Require non-null source and run identities for hosted TRX timing records. Keep historical local and console source shapes intact. Plant all three missing-identity combinations against the actual plan validator. ADR: 0063 * docs(roadmap): close provenance guard reviews Record both independent review rounds and keep historical plan qualification separate from the final-source full assignment required after the guard fix. ADR: 0063 * docs(roadmap): propose P02b-6 realm and seed decision package Define bounded development reconciliation and real identity proofs before closing the remaining realm and issuance-lifetime gates. Preserve account and secret ownership, separate provider timestamp semantics from configured lifespan, and retain explicit approval before implementation. ADR: 0004, 0036, 0064 * docs(roadmap): accept P02b-6 realm and seed decisions Record the maintainer's approval before changing identity issuance or existing development accounts. Register real-provider proof obligations and retain the independent session, authorization and production gates. ADR: 0004, 0036, 0064 * feat(identity): declare executable development realm identities Make development issuance satisfy the strict tenant API profile while keeping authentication personas in the typed seed declaration. Qualify the committed import through real confidential code/S256 flow, owned HTTPS and independent scope, lifetime and credential-refusal controls. ADR: 0004, 0036, 0064 * fix(identity): close realm and vocabulary review gaps Keep the existing G20 completeness fence aligned with every declared identity, and reject optional mapper paths that can replace protected claims. Preserve escaped literal keys and qualify implicit writers so export drift cannot hide behind default-only issuance evidence. ADR: 0004, 0036, 0064 * fix(identity): qualify client-role claim interpolation Close the remaining export drift blind spot while retaining the provider's safe built-in role path. Reconcile current guidance and record both completed Step 1 reviews before starting warm-realm implementation. ADR: 0004, 0036, 0064 * docs(roadmap): propose bounded server information read Record the measured stock response that exceeds the accepted universal body budget and propose one authenticated read exception. Keep implementation and complete-core qualification pending maintainer acceptance. ADR: 0004, 0064 * feat(identity): bound development realm transport and ownership Keep setup credentials on the selected local service and retain each request and lock through actual cleanup. These independent primitives retain the accepted 256 KiB bound; planner activation and its version-read proposal remain pending with the rest of Step 2. ADR: 0004, 0064 * docs(roadmap): compare authenticated version probe alternatives Record pinned-source analysis and isolated provider measurements for server information and read-only partial export. Keep the accepted 256 KiB transport cap and the proposed exception pending approval. ADR: 0004, 0064 * docs(roadmap): accept fixed server information response allowance Record maintainer approval after the measured alternative comparison. Keep ordinary responses, outbound bodies and all other ownership bounds unchanged. Dependent implementation and provider qualification follow. ADR: 0004, 0064 * fix(identity): confine server information response allowance Permit 512 KiB only on the fixed authenticated successful bodyless server-information GET. Keep every other response and outbound body at 256 KiB. Exercise exact bounds, closed resources and negative purposes. ADR: 0004, 0064 * feat(identity): reconcile owned development realm state safely Plan all bounded Admin REST changes before writes and independently verify preservation and convergence. Keep existing accounts, secrets, roles and unrelated configuration through warm and partial upgrades. Qualify the actual shared core on PostgreSQL-backed HTTPS Keycloak, including zero-write repeats and conflict refusals. Seed and demo activation remains the next step after both independent review rounds. ADR: 0004, 0036, 0064 * fix(identity): qualify stored identity visibility before reconciliation Admin user projections cannot establish that hidden identity values are absent. Refuse unqualified profiles and projected plan limits before any write, retaining account state and enforcing the same bounded readers on subsequent passes. ADR: 0004, 0036, 0064 * fix(identity): qualify inherited claims and preserve projected users Reject protected group aggregation and inherited identity sources before writes, retain safe group membership, and compare derived profile metadata separately from stored accounts. Real provider controls cover uninterrupted warm upgrades, nested groups, signed claim counterexamples and zero-write reruns. ADR: 0004, 0036, 0064 * docs(roadmap): close realm review and qualify account self-service Record the completed Step 2 correction reviews and the measured account-console capability gap. Keep the bounded role and fixed-account mapper proposal pending maintainer decision while the approved seed/demo lifecycle proceeds. ADR: 0004, 0036, 0064 * feat(identity): share realm convergence across seed and demo Validate private realm configuration before infrastructure work, build and run the argument-free Release Seeder with its own credential, and await one shared reconciler before public demo startup. Keep selected-stack identity and owned cancellation through setup, with credential-free build and renderer processes. ADR: 0004, 0036, 0064 * docs(roadmap): record first seed lifecycle review Keep the Step 3 receipt separate from actual Compose qualification and wrap the verified prose findings without changing its runtime contract. ADR: 0004, 0036, 0064 * fix(identity): confine seed preparation credentials Run selected stack and migration preparation under the seed owner so matching inherited Keycloak credentials never reach EF children. Retain Docker target controls with a fixed prerequisite allowlist and prove the old Makefile dependency path fails the same confinement control. ADR: 0004, 0036, 0064 * fix(identity): keep readiness under one seed owner Own PostgreSQL readiness directly rather than through a nested CLI whose detached Docker cleanup can outlive the preparation group. Prove cancellation and deadlines stop owned work, and that restoring the nested owner fails the same survival predicate. ADR: 0004, 0036, 0064 * test(identity): retain process absence witnesses in seed proofs Keep native process-group retirement evidence through both observation samples so reused IDs cannot be attributed to owned work. Close Step 3 with independent correction reviews and final runtime seed receipts. ADR: 0004, 0036, 0064 * feat(identity): qualify realm self-service and real token admission Keep development account access limited to the approved builtin role and mapper while proving protected identity fields against real Keycloak. Exercise issued credentials through the production API and retain owned provider teardown, physical read-only and complete CI discovery proofs. ADR: 0004, 0036, 0064 * fix(ci): require executed realm cases alongside JUnit reports An empty named Node suite can look like a passing JUnit case. Require actual counters from the same invocation and exercise the real workflow gate against empty-suite counterexamples. Retain measured provider case weights so complete CI assignments use observed advisory costs. ADR: 0004, 0063, 0064 * fix(tests): classify the offline realm gate control source Keep the repository source census closed while declaring the new Python counterexample helper as an exact offline test owner. Require the Node reporter to remain visible to the live runtime census and retain the completed Step 4 independent reviews and actual demo evidence. ADR: 0056, 0064 * docs(roadmap): close P02b-6 implementation and review steps Record actual provider and complete hosted backend evidence alongside the known frontend correction, promote the two delivered behavioural rules, and reconcile current carriers with all four reviewed implementation steps. Keep final PR-head qualification and merge explicitly separate. ADR: 0004, 0036, 0064 * docs(roadmap): identify the live PR qualification owner Keep the completed implementation status distinct from dynamic PR checks so the source-bound record does not imply a merge or stale test result. ADR: 0063, 0064 * fix(identity): preserve setup prerequisites and failure cleanup Retain tooling prerequisites without propagating application secrets, classify aborted transport failures and remove failed lock markers. Align finite seed preparation budgets and identity documentation with current development behavior. ADR: 0004, 0036, 0064 * docs(roadmap): record verified PR identity corrections Record the two independent correction reviews and distinguish current local evidence from the new-head hosted qualification. ADR: 0004, 0036, 0064 * fix(identity): reject false convergence and close proof gaps Refuse ambiguous account creation and incompatible login state before claiming convergence. Preserve credentials without replaying mutations, protect local setup sources, and independently verify provider identity, profile preservation and owned cleanup. Keep CI evidence bound to its actual attempt, distinguish missing receipts, and require the complete reviewed test and fixture populations. Retain failed qualification history instead of promoting partial reruns. ADR: 0003, 0004, 0018, 0063, 0064 * style: align correction whitespace Keep the fixture and dated verification prose within repository formatting conventions without changing executable behavior. ADR: 0004, 0064 * fix(identity): validate first reads and complete fixture census Reject unsafe selected sources before Compose can perform a blocking read. Bind fixture eligibility to actual declarations so qualified collections and other explicit fixtures cannot silently miss the independent-layout witness. Retain exact source-bound review receipts. ADR: 0063, 0064 * fix(identity): bind Docker preflight to the selected environment Inspect the same Docker inputs used by stack commands, including keys removed from inherited configuration. Reject collection-attribute aliases before fixture census filtering so they cannot silently narrow its proof. Retain counterfactual controls and source-bound independent reviews. ADR: 0063, 0064 * docs(roadmap): close independent correction reviews Record both completed review rounds and independent verification of the final alias and Docker-environment corrections. Keep hosted qualification with the frozen source and live PR checks rather than old passing runs. ADR: 0063, 0064 * fix(identity): keep seed authority generic and retain startup faults Bind legacy identities to their complete typed declarations instead of branching on demo usernames. Preserve existing finite provider startup faults in failed measurements without exporting raw error messages or changing execution and cleanup evidence requirements. Record the failed frozen-source run and its diagnostic limits. Keep all fixture, HTTP and whole-job deadlines unchanged. ADR: 0018, 0063, 0064 * docs(roadmap): record startup diagnosis correction reviews Record both independent rounds and exact local checks without promoting them to hosted qualification or inventing a provider startup cause. ADR: 0063 * test(identity): distinguish bounded provider startup failure families The actual hosted fixture reaches the database stage and reports the generic provider fault. Retain finite Docker status, reaper, socket and filesystem classifications without exposing provider messages or bodies. Do not infer a cause from the broader family or change startup budgets. ADR: 0063, 0064 * test(identity): isolate pure startup diagnostics from fixture ownership The source Docker guard correctly treats direct fixture references as provider dependencies. Put pure finite classification in its own type so offline canary controls remain Docker-free without weakening the guard. ADR: 0063, 0064 * docs(roadmap): close provider classification correction reviews Record independent final-source verification of finite failure codes and the fixture-free diagnostic boundary, without claiming a repair. ADR: 0063 * fix(ci): retain closed Docker startup failure families Distinguish PostgreSQL SDK milestones and fixed daemon failure families without exporting provider text or changing startup and cleanup policy. Keep malformed and unknown responses on the existing generic diagnostic. Validate seven offline cases, seven corpus/Docker-sweep cases, all 43 launcher controls and sixty combined shard/aggregate controls. ADR: 0063 * fix(ci): contain malformed diagnostic Unicode Map raw unpaired UTF-16 parser failures to the existing fixed fallback. Four independently reproduced red controls now pass within the seven-case offline suite with warnings as errors. Record first-round review and the successful isolated Linux startup without claiming hosted reproduction. ADR: 0063 * docs(roadmap): record daemon diagnosis correction reviews Record both fresh second-round approvals, independent offline checks and source-bound evidence limits before the next complete hosted A run. ADR: 0063 * fix(testing): align fixture publishers and browser readiness Publish application PostgreSQL on the identity fixtures' loopback address. Share publication checks and require real configured/runtime inspection; retain all database roles and ownership cleanup. Poll only valid empty browser target lists within the original shared five-second discovery budget. Preserve immediate invalid-response refusal, closed diagnostics and owner/liveness checks. Validate nine C# cases, seven corpus/Docker-sweep cases, 1756 guarded frontend cases, 43 launcher controls and sixty shard/aggregate controls. Record actual Linux before-red/after-green publication and role proofs. ADR: 0003, 0063, 0064 * docs(roadmap): record publication correction first reviews Retain both scoped approvals, independently executed controls and the fourth frozen source's verified auxiliary evidence without promoting its failed integration result or claiming an observed daemon version. ADR: 0063 * docs(roadmap): complete publication correction reviews Record both fresh second-round approvals and independent browser, PostgreSQL privilege and cleanup checks before complete final-source A/B qualification. Keep source-bound evidence limits explicit. ADR: 0063 * fix(identity): clarify private setup and realm proof failures Keep unsafe private-file refusals actionable without exposing their contents, and make realm drift controls reject malformed profiles and exercise username uniqueness independently. Extend owned fixture TLS validity without changing trust. Record the existing issuance choice in a Proposed ADR pending separate maintainer approval. ADR: 0004, 0064 * docs(testing): preserve provider-only fixture boundaries Describe the actual dependencies of provider-only and combined API tests without implying every Keycloak proof configures application modules. Record the first independent correction reviews and their verified fix. ADR: 0004, 0064 * docs(roadmap): complete setup correction reviews Record both independent correction reviews and their validation limits, while keeping the dedicated issuance ADR Proposed until explicit approval. ADR: 0004, 0064 * fix(identity): prove coupled development token expiration Clarify the proposed issuance ADR's authority and provider consequences without treating the review as acceptance. Preserve historical package statements through dated adjacent corrections and name the actual reconciliation owners. Validate signed access and ID expiration together, including session clamping, and plant an independent ID-expiration payload defect that passes each fresh-window check. Retain the existing runtime and case population. ADR: 0004, 0064 * docs(roadmap): record first issuance correction review Record independent proof/security and ADR/provenance approval while retaining the second review and explicit ADR acceptance gates. ADR: 0004, 0064 * docs(roadmap): complete issuance correction reviews Record the fresh second-round proof and ADR reviews and their limits. Keep formal ADR acceptance and current-head hosted qualification separate. ADR: 0004, 0064 * docs(identity): accept development issuance decision Record explicit maintainer acceptance of revised ADR-0067 and complete its authority references in Security 11, the catalogue and local guides. Preserve original phase approval and Proposed-state reviews with dated adjacent disclosures. Keep issuance configuration, API acceptance, session ownership and source-bound qualification unchanged. The preceding ordinary CI failure remains separately under investigation. ADR: 0004, 0064, 0067 * docs(roadmap): record first issuance acceptance review Record the independent authority and scope reviews of the approved ADR-0067 carrier changes, with hosted failure investigation retained. ADR: 0067 * docs(roadmap): complete issuance acceptance reviews Record both completed independent carrier reviews and the source-bound CI triage. Preserve the failed lifecycle case without inferring its missing assertion diagnostic or waiving aggregate refusal. ADR: 0067 * fix(ci): retain closed causal restart failure locations Add the one observed lifecycle test source to the finite diagnostic projection while keeping paths, stacks and provider messages private. Plant the missing location in the existing control, observe it fail, then pass all 43 offline launcher controls after adding the mapping. This does not identify or fix the previous runtime assertion failure. Success witnesses, aggregate refusal and execution budgets stay intact. ADR: 0063 * docs(roadmap): record closed diagnostic correction review Record independent privacy and counterexample reviews of the one-source mapping, including all 43 controls and the removed-mapping negative. ADR: 0063 * docs(roadmap): complete closed diagnostic correction reviews Record the fresh second-round privacy and proof checks, including the missing-map negative, all offline controls and byte-preserved execution. Keep the preceding failed lifecycle receipt unwaived. ADR: 0063 * fix(tooling): preserve safe development lifecycle operations Keep teardown usable before realm convergence, retain closed setup diagnostics, and confine private configuration and migration credentials to their owners. Add actual-launcher controls without changing accepted realm capabilities. ADR: 0004, 0053, 0054, 0064, 0067 * test(identity): strengthen convergence and CI gate counterexamples Exercise retained-account and transport boundaries independently, keep the realm gates mandatory, and project only recognized safe failure kinds. Record source-bound checks without treating repeat passes as a root cause. Guard the documented migration build before executing no-build EF. ADR: 0004, 0063, 0064, 0067 * docs(decisions): propose development identity visibility preparation Keep the demonstrated hidden-identity refusal while examining a bounded metadata-first exception. Record the independent historical-bootstrap scope prerequisite explicitly; approval and dependent runtime remain pending. ADR: 0004, 0064, 0067, 0068 * docs(identity): bound historical realm upgrade qualification Separate profile visibility preparation from fully planned detachment of only three qualified stock console edges. Retain compatible scopes, existing grants and explicit approval before dependent runtime. Record actual feasibility, completed correction reviews and the remaining proof boundary honestly. ADR: 0004, 0064, 0067, 0068 * test(tooling): declare isolated child test environments Supply the test mode required by Next's process environment types without inheriting application credentials into child fixtures. Full typecheck, lint and all 197 affected cases pass. Record the proposed warm-realm correction steps and reflow the first document review's long lines. ADR: 0064, 0067 * docs(roadmap): record final correction and proposal reviews Record both fresh review rounds for the isolated fixture typing fix and the final Proposed warm-realm correction. Preserve the approval hold and separate author checks, private feasibility and hosted qualification. ADR: 0064, 0067 * fix(identity): resolve assigned console scopes by bound ID Admin assignment endpoints return only ID and name. Read and bind the complete representation before checking protocol, while preserving all existing compatible allowance and mapper checks. Add independent graph, identity, readback and transport-cap counterexamples; 256 guarded Node cases and six workflow-gate controls pass. ADR: 0004, 0064 * docs(decisions): qualify preparation authority and console evidence Require all identity-independent refusals before preparation, preserve readable prior definitions, and specify preparation diagnostics, write accounting and exact assignment-only DELETE authority. Retain shipped catalogue status with pending extensions. Correct raw provider anchors and distinguish actual console token effects from unproved POST/runtime behavior. Record conditional maintainer acceptance authority and the separate source-bound CI failure without guessing its cause. ADR: 0004, 0064, 0067 * fix(ci): retain closed native settlement failure locations Add the existing settlement test file to the finite diagnostic source projection. Verify exact and near-match handling without exposing raw paths or errors. All 43 offline controls pass. This does not infer the lost CI assertion or alter runtime, deadlines or success witnesses. ADR: 0063 * docs(roadmap): record revised decision inspection and failure limits Record the first fresh review of the compatible-read correction and conditional decision revision. Reflow its one minor finding and clarify what the failed launcher envelope can and cannot establish. ADR: 0063, 0064, 0067 * docs(decisions): accept bounded warm-realm qualification Accept ADR-0068 under the maintainer's conditional authority after both fresh revision reviews. Disclose the two bounded phase replacements and historical remedy follow-up; reconcile authority headers, architecture, guidance and index. Preserve shipped catalogue status/counts while the expanded obligations remain explicitly pending. Acceptance authorizes the three-step implementation, without claiming automatic-path proof. ADR: 0004, 0064, 0067, 0068 * feat(identity): qualify stock console assignment normalization Bind complete historical scope, mapper and role representations before removing only three approved account-console assignments. Preserve the compatible path, keep DELETE authority opaque and requalify explicit partial-progress reruns without replay or a durable marker. Commit a credential-redacted historical fixture, fixed canonical baseline and independent real-provider reproduction. The ordinary production path performs sixteen writes, then zero after test-owned metadata setup. Automatic preparation and the remaining token/self-service proofs retain the next steps' gates. ADR: 0004, 0064, 0067, 0068 * test(identity): cover every interrupted console assignment Persist uncertain-response and cancellation controls at all three DELETE positions. Verify the exact durable prefix, no replay, last-edge handoff to compatible preservation and explicit zero-write convergence. Record the first independent Step 1 review and its verified proof gap. Runtime behavior and mutation authority remain unchanged. ADR: 0068 * docs(roadmap): close the first warm-realm correction step Record both fresh review rounds, the persisted interruption correction and its independently verified convergence. Keep preparation, complete automatic-path evidence and final hosted qualification explicitly pending. Clarify that the Node census guards files and counts, not test semantics. ADR: 0068 * feat(identity): prepare warm-realm identities before fresh planning Qualify independent prerequisites before the bounded metadata exception, then discard every provisional projection before admitting ordinary writes. Keep uncertain dispatched progress visible through failures and cleanup. Actual historical provider controls prove convergence and explicit recovery. ADR: 0068 * fix(identity): qualify visible facts before warm-realm preparation Keep already observable identity and profile refusals ahead of metadata preparation. Preserve mapper refusal codes through stock qualification and retain dispatched metadata notices through the seed and demo entry owners. Actual provider regressions and clean counterpart controls bind these fixes. ADR: 0068 * docs(roadmap): record verified warm-preparation corrections Bind the closed first-round findings and caller/mapper regressions to their committed fixes and independent checks without claiming final qualification. ADR: 0068 * docs(roadmap): close reviewed warm-realm preparation step Record both fresh review rounds, verified correction coverage and remaining complete-path qualification without treating partial evidence as release proof. ADR: 0068 * test(identity): prove historical realm credentials and API Qualify the approved warm upgrade with usable MFA, signed application reads and stored account changes. Retain source-bound entry evidence and measured case assignments while keeping incomplete public qualification explicit. ADR: 0004, 0064, 0067, 0068 * docs(roadmap): record warm qualification and Step 3 reviews Retain both historical demo outcomes and their distinct evidence limits, then record the two fresh independent review rounds before final hosted assignment qualification. No earlier failure is relabelled as success. ADR: 0063, 0068 * test(ci): bound ingress lookup and retain settlement facts Remove an unrelated unbounded informational lookup from the native ingress fixture while preserving real request settlement and all security checks. Exercise case-bound diagnostics through the pinned test adapter and retain failed qualification receipts without guessing their missing root cause. ADR: 0047, 0055, 0063, 0068 * docs(roadmap): record first CI correction review Retain independent source and actual adapter checks without treating historical green assignments as a waiver for the failed A3 receipt. ADR: 0063, 0068 * docs(roadmap): close independent CI correction reviews Record the fresh second review and clarify the informational fetch bound without claiming a universal response-body deadline or waiving A3. ADR: 0063, 0068 * test(jobs): attribute settlement loss to its execution Preserve the original held Outcome invariant without assigning later Finalize observations to it. Prove the distinction with a real locked Finalize commit, conservative renewal refusal and actual cleanup, and retain closed identity attribution across all failure boundaries. ADR: 0047, 0059 * test(jobs): join issued settlement flights before cleanup Await actual flights before positive ownership joins so an early assertion cannot retain unfinished work permanently. Preserve the first failure and qualify the cleanup path with a real held-COMMIT negative and bounded, case-bound cleanup observations. ADR: 0047, 0059 * docs(roadmap): close independent attribution reviews Record the verified cleanup correction, both fresh review rounds and the exact whitespace-only source binding. Keep current-head hosted qualification in the PR and preserve every earlier failed receipt. ADR: 0047, 0059, 0068 * test(jobs): preserve recurrence failure and cleanup observations Keep the first actual recurrence test fault through independent cleanup and retain only case-bound finite diagnostics. Real adapter controls preserve the original assertion even when cleanup also fails; production behavior and all existing waits remain unchanged. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): record recurrence diagnostic first reviews Record independent ownership and export checks against actual adapter failure, cleanup, source and archive evidence while preserving the failed hosted run. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): close recurrence diagnostic review rounds Bind both fresh review rounds to actual failure preservation, positive cleanup and complete retained evidence, with hosted qualification and merge separate. ADR: 0047, 0059, 0063, 0068 * test(jobs): isolate settlement proofs from pre-ack renewal races Schedule the real renewal pacing callbacks around Outcome settlement, retain actual timer cleanup, and prove the unrelated Prepare-lock refusal against PostgreSQL. Preserve exact cases, deadlines and production policy. Retain the failed CI and partial-rerun evidence with bounded diagnostics. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record first settlement scheduling reviews ADR: 0047, 0063 * test(jobs): arm settlement deadlines before publication holds Create the actual normal deadline timer before the fixture publication hold. Preserve real durations, callback/factory ownership and exact case identities. Retain fresh clean and exclusion-control evidence, and explicitly refuse the ordering control's unconfirmed internal cleanup witness. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record independent deadline fix verification ADR: 0047, 0063 * fix(ci): audit links against immutable event commits Compare the PR event base snapshot directly with the checked-out tree instead of fetching a later shallow base branch. Exercise the actual workflow owner against real squash graphs, missing bases and broken links. Preserve strict aggregate identity refusal and record the merged implementation accurately. ADR: 0007, 0041, 0063 * docs(roadmap): record link audit correction review Record both independent first-round reviews and the actual workflow and corpus checks. Complete hosted A/B qualification remains pending on an open follow-up PR; closed-PR identity evidence is not waived. ADR: 0007, 0041, 0063 * docs(roadmap): close link audit correction reviews Record the different second review pair and independently reproduced old-owner failures. Keep complete final-source hosted qualification pending on the open follow-up PR. ADR: 0007, 0041, 0063 * fix(ci): classify Markdown audit regression tooling Register the new Python proof script in the explicit non-runtime census. The real frontend guard caught the omission; preserve rejection of unknown sources and runtime exemptions. All 1840 frontend cases pass. ADR: 0018, 0056, 0063 * docs(roadmap): record tooling census correction review Record the first fresh review pair and retained frontend evidence. Complete hosted qualification remains pending on the corrected source. ADR: 0007, 0056, 0063 * docs(roadmap): close tooling census correction reviews Record the different second review pair and retain the failed initial attempt's evidence limits. Fresh same-source A/B qualification follows. ADR: 0007, 0056, 0063 * test(jobs): preserve native wait failure attribution Retain the first body or explicit runtime-join exception instead of masking it in finally. Export only case-bound closed boundary and owner task observations so startup and cleanup cancellations can be separated. Validate clean and three planted fault paths with actual native work, including the old test's masking counterexample. The earlier hosted cancellation remains unexplained; no timeout or runtime policy changes. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): record native wait diagnostic review Preserve original proof receipts and disclose the corrected container count against retained raw cleanup evidence. Record source binding and the first independent review round without asserting a hosted cause. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): close native wait diagnostic reviews Record the second fresh independent pair and exact retained evidence verification. Keep hosted cancellation and helper scheduling causes unproven until source-bound qualification supplies actual evidence. ADR: 0007, 0047, 0060, 0063 * test(jobs): wait for actual cleanup before fixture hints The native execution fixtures may consume their sole extra hint while an earlier empty recovery still owns private cleanup. Wait for actual native work and local identity release before issuing that same hint. Reproduce premature consumption with real SQL/native workers and an owned System timer cleanup barrier. Preserve all existing budgets, production policy and original case identities; add one regression fact. ADR: 0047, 0059, 0060, 0063 * test(jobs): retain cancellation before fixture hint emission Restore the original final cancellation check after readiness waits. Record the first independent review round and fresh exact-source clean and planted-failure evidence without claiming atomic cancellation or a cause for the earlier hosted failure. ADR: 0007, 0047, 0059, 0060, 0063 * docs(roadmap): close fixture handoff correction reviews Record the second fresh pair and exact proof/source verification. Preserve the unknown hosted cause and require complete final-source A/B qualification before the follow-up draft is ready for review. ADR: 0007, 0047, 0059, 0060, 0063 * fix(ci): bound browser dependency mirror waits Let the hosted browser installer leave stalled APT mirrors while retaining its complete dependency set, verification and existing time budgets. Read back effective root settings and remove only the exclusive fragment. Exercise the actual workflow shell across success and failure paths, and retain the failed prior attempts as unqualified observations. ADR: 0007, 0056, 0063 * test(ci): exercise partial browser setup writes Make the write-failure control leave a genuinely incomplete fragment before refusing, then verify that the actual workflow shell removes it. Record the first independent review pair and the failed A receipt. ADR: 0007, 0056, 0063 * docs(ci): record browser acquisition review closeout Record the second fresh independent review pair and its extracted-shell checks. Keep the prior failed attempts separate from the complete hosted A/B qualification still required on the resulting source. ADR: 0007, 0056, 0063 * fix(ci): reserve bounded public demo completion time The complete B assignment reaches the last public audit before its sixteen-minute outer allowance cancels it. Allocate seventeen minutes inside the same twenty-minute job, twelve-minute proof and thirty-second native cleanup limits. Bound the remaining cleanup/receipt steps and restore NuGet without a save post-hook to retain a three-minute tail. Exercise actual deadline and tail shells, preserving forced failures. Keep failed partial evidence distinct from complete qualification. ADR: 0007, 0056, 0063 * docs(roadmap): record first outer-budget correction reviews Record two independent approvals, their actual-shell controls and historical evidence checks without claiming new hosted qualification. ADR: 0056, 0063 * docs(roadmap): close outer-budget correction reviews Record fresh second-round approvals and independent historical evidence revalidation. Keep complete final-source hosted A/B as a separate gate. ADR: 0056, 0063 * fix(ci): join maintenance in OpenAPI control repositories The hosted snapshot control fails strict temporary cleanup while its Git object directory changes. Keep maintenance in the foreground only in the synthetic repository so the waited commit also waits its actual work. Prove nested commit-graph completion with a real Git trace under a private configuration that otherwise requests background maintenance. Retain strict cleanup and all OpenAPI comparison and admission rules. The observed mechanism is not a captured trace of the hosted failure. ADR: 0007, 0052 * test(ci): require successful owned Git maintenance proof Reject a planted graph write failure even when a prior graph exists. Correct pinned source anchors using physical raw-file lines and record both first-round reviews and their verified fixes. ADR: 0007, 0052 * docs(roadmap): close Git maintenance fixture reviews Record two fresh second-round approvals and the independently repeated clean, detached and planted-failure controls with their runtime limits. ADR: 0007, 0052 * fix(ci): retain closed producer gate refusal diagnostics Both aggregate jobs reject a gate but discard which source-owned producer and step failed validation. Emit finite state words before the unchanged refusal so later API success cannot obscure the original observation. Never export arbitrary provider values or retry inconsistent evidence. Keep the unsuccessful historical attempt separate from new qualification. ADR: 0007, 0063 * docs(roadmap): record gate diagnostic review evidence Retain independent closed-output checks and historical evidence limits. Separate complete public component observations from failed whole-run qualification and final-source A/B still required. ADR: 0007, 0056, 0063 * docs(roadmap): close producer gate diagnostic reviews Record fresh differential and mutant controls, independent component archive checks and the unchanged final-source whole-workflow gate. ADR: 0007, 0063 * fix(ci): own Outbox startup and attribute producer refusal Disable the unowned telemetry exporter in the Outbox host fixture and join actual startup before disposal even when its assertion wait expires. Retain only finite startup facts from the real test adapter output. Report closed producer states before the unchanged aggregate refusal. Keep unknown hosted causes distinct from local counterfactual evidence. ADR: 0007, 0044, 0046, 0063 * docs(roadmap): record Outbox correction first review Record independent code, protocol and retained-evidence validation while preserving unknown hosted causes and complete final-source A/B gates. ADR: 0063 * docs(roadmap): record independent Outbox correction approval Record the second fresh review pair and narrow container identity prose to the exact retained evidence. Keep full final-source A/B pending. ADR: 0063 * fix(ci): bound pending producer metadata acquisition Read fresh complete attempt snapshots under one short acquisition budget before applying the unchanged successful-producer witness. Refuse terminal, malformed and identity-invalid evidence immediately, including when an earlier owner is pending. Never combine snapshots. Keep the five-minute aggregate ceiling and upload reserve unchanged. ADR: 0063 * fix(ci): validate creation times before metadata settlement Reject malformed or reversed creation timestamps before a pending owner can cause another read. Record independent repros and corrected first-round review validation. ADR: 0063 * docs(roadmap): record independent metadata acquisition reviews Record fresh second-round deadline and malformed-evidence controls, with retained failed-attempt and pending hosted qualification limits. ADR: 0063 * docs(decisions): accept ADR-0069 phase documents and delivery logs Phase 02b's phase document reached 18,884 lines, 92% of them dated packet records, and Phase 02d followed the same shape; status was narrated in five places and no check covered link fragments. The maintainer accepts keeping the plan and the record in separate files, status in one place, and two CI guards that hold both, after one review round whose findings this text resolves. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): split Phase 02b and 02d records into delivery logs Moves every dated packet record out of the two phase documents into sibling append-only delivery logs, grouped by packet in source order, with the superseded Status blocks kept verbatim in each log's archive. Each heading's anchor was recomputed in its new file and checked against its original one, duplicates included, and every original line survives the split; only heading levels and link targets around the text change. 606 inbound links are retargeted with their text unchanged, so the Accepted ADRs touched owe no amendment. Phase 04's one dated plan heading keeps its date in its acceptance line and its six links follow it. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: hold packet status once and record the delivery log rule Packet state was narrated in the phase Status block, the packet table, the Completion Criteria preamble, the roadmap index, CLAUDE.md and the repository README, and every step edited all of them. Each now points at the phase document, whose bounded Status block owns packet state; CLAUDE.md drops from 856 to 405 lines. The rule itself lands where readers look for it: Roadmap § Phase Structure and § Decision Timing, Documentation Standards, the glossary, CLAUDE.md and the two skills that write roadmap records. ADR-0069's dated amendment names the README as a sixth carrier and fixes how its budgets are counted. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(meta): guard link fragments and roadmap structure The link audit strips fragments and reads only changed files, so a moved heading broke links silently, and nothing stopped a phase document from growing records again. The meta job now resolves every fragment link in the tree against GitHub's heading slugs and holds phase documents, delivery logs, the roadmap index, CLAUDE.md and the README to ADR-0069; `make lint` runs both through `lint-docs`. Each guard ships planted-violation controls, the source census classifies the four new tooling files, and the link audit now skips code spans as it already skipped fenced samples. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): amend ADR-0069 with generated delivery log indexes A delivery log is too large to read whole, so an agent needing one entry has no map of the rest. The amendment opens each log with an index generated from its headings and checked in CI, listing lengths rather than line numbers and no inferred record kinds, and states that the index is navigation, not a record. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): open each delivery log with a generated index The Phase 02b log is about 305,000 tokens, so an agent needing one entry had no map of the rest. Each log now opens with an index of its packet sections, entries and dated sub-entries with their lengths, generated by scripts/delivery-log-index.py (`make docs-index`) and refused when stale by the meta job and `make lint-docs`. The fragment audit covers every row's anchor; the logs, roadmap index, Documentation Standards, glossary, CLAUDE.md and the two record-writing skills say to read the index, not the log. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): install Chromium without the APT mirror The public demo's five-minute browser step failed four of today's twelve attempts while Playwright's --with-deps installer downloaded fonts from the runner's slow APT mirror; the 15-second acquire timeouts cannot end a slow transfer that is still moving. The hosted image already carries every Chromium library, and no public-demo check depends on system fonts, so the step installs only the pinned Chromium build and drops the temporary APT fragment with it. The workflow test executes the actual step against stubs and fails on any sudo or APT call; against the previous workflow it fails. The delivery log records run 39805658821, the still-unexplained native fixture hang, and the maintainer's single-assignment qualification decision for PR #35. ADR: 0056, 0063 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): propose owned tenant BFF sessions Define session custody, lifecycle, admission and evidence before the first BFF credential owner is implemented. Keep G13 open until the maintainer accepts the proposal and five-step delivery package. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): resolve BFF session proposal review findings Separate local logout guarantees from provider navigation, preserve logout at full sign-in capacity and require the actual warm-realm BFF chain. Record the first independent proposal review and its verified corrections. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): finish the BFF decision pass and prior closeout Record the second independent proposal review, make optional BFF activation explicit and distinguish public requests from OIDC transactions. Verify PR 35's merged source and successful CI without inferring historical causes. Keep the new session ADR Proposed until maintainer approval. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): revise BFF ownership after maintainer review Compare maintained RP alternatives and select openid-client without a credential-bearing cookie or competing session framework. Define provider event persistence, source and subject admission, effective expiry and browser transaction fencing before requesting renewed approval. ADR: 0004, 0035, 0036, 0053, 0054, 0064, 0067, 0069 * docs(decisions): retain logout owners in subject admission Keep logout-return entries in the subject budget until return expiry or consumption and actual work settlement. Distinguish AccountSite actor and scope evidence from independently validated OIDC subject continuity. Record the first revised proposal review and its verified corrections. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): complete revised BFF proposal review Record the second fresh independent review pair and final source clarifications. Preserve API-owned resolved organization scope separately from optional protected claims and retain approval-pending status. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(decisions): accept native tenant BFF session ownership Record maintainer approval of ADR-0070 and its five-step delivery plan before dependent implementation. Reconcile custody, CSRF, event evidence and deployment rules, append bounded prior-decision disclosures, and register the four proof obligations without claiming runtime delivery. ADR: 0035, 0053, 0054, 0064, 0067, 0069, 0070 * feat(identity): add inactive BFF RP and provider event policy Keep credentials behind a server-only pinned RP with fixed-purpose bounded transport and signature-enabled grants. Qualify development event storage before metadata preparation, preserve existing event policy and verify actual fresh/warm persistence without activating browser sign-in. Targeted checks pass; the delivery record explicitly tracks the remaining historical count reruns and added real-body cancellation proof before Step 1 closure. Production route and configuration admission stay closed. ADR: 0004, 0035, 0053, 0054, 0064, 0067, 0068, 0070 * fix(identity): qualify logout and event response boundaries Keep the supported loopback logout path inside the closed provider boundary and refuse known event-expanded realm overflows before any preparation write. ADR: 0068, 0070 * fix(identity): preserve provider defaults and closed network reasons Retain every pinned default-saved event and distinguish library-wrapped network uncertainty from malformed responses. Close both Step 1 review rounds with independent omission controls and real provider evidence. ADR: 0068, 0070 * feat(identity): own bounded native BFF…
cemililik
added a commit
that referenced
this pull request
Oct 25, 2026
* fix(ci): accept native child status in diagnostic types Describe only the process fields read by closed diagnostics. Compile-check real ChildProcess values and the operation callback in existing native child controls, while retaining unknown-field sanitization coverage. ADR: 0056, 0064 * docs(roadmap): record hosted authentication qualification Record complete source-bound backend receipts and the isolated demo refusal, with closed-diagnostic corrections and both fresh review rounds. Keep final-source hosted qualification explicit and mandatory. ADR: 0064, 0065 * docs(standards): Mark ADR-0065 diagnostic controls as implemented * fix(auth): close review privacy and proof gaps Enforce exemplar privacy, exact issuer/JWKS paths and worker process attribution. Strengthen production censuses, real persistence and HTTP controls, and SDK ownership proofs. Reconcile historical evidence and production activation ownership. ADR-0066 remains Proposed; subject-cap policy refinements await explicit approval. ADR: 0064, 0065 * fix(tests): close cross-assembly and middleware proof gaps Scan counter and header literals across all production assemblies. Inspect source-owned middleware and OpenAPI helper leaves before treating framework calls as terminals; plant real-wrapper and alias mutations. Record first-round findings, completed controls and exemplar correlation cost without claiming current-head hosted qualification. ADR: 0064, 0065 * fix(tests): reject hidden fluent middleware registrations Trace builder-valued receivers conservatively before skipping ordinary calls. Actual Program and resolver return mutations must expose chained extra authentication with a specific diagnostic; endpoint naming remains clean. Record round-two findings and the separate schema-proof limit. ADR: 0064 * docs(roadmap): record verified second review corrections Record both independent rounds, verified proof fixes and targeted recheck. Keep hosted qualification source-bound and ADR-0066 approval outstanding. ADR: 0064, 0065 * docs(decisions): clarify subject admission fault ownership Separate sticky cleanup failure from ordinary quota and capacity pressure. Specify one-disposal acquisition ordering, shared retirement ownership and unbounded disposal latency without claiming dependent runtime delivery. Mark mutable cap carriers as current code under a Proposed decision and name exact HTTP, metric, cleanup and concurrency proof obligations. ADR: 0066 * docs(decisions): complete admission retry contract inventory Record the first independent review round and explicitly include capacity retry-hint semantics in the future served and snapshot OpenAPI changes. Keep ADR-0066 Proposed and implementation proofs pending approval. ADR: 0066 * docs(roadmap): record subject admission revision reviews Record both fresh independent review rounds, the verified retry-contract inventory fix and current documentation/corpus validation. ADR-0066 stays Proposed and dependent runtime work still requires maintainer approval. ADR: 0066 * docs(decisions): accept bounded subject admission contract Record maintainer approval before dependent runtime changes. Preserve the Accepted ADR-0064/0065 bodies with adjacent attribution errata and their own dated disclosures, and align operational authorities with ADR-0066. Runtime, resource-bound and exported-signal proofs remain pending delivery. ADR: 0064, 0065, 0066 * feat(auth): own bounded subject admission cleanup Keep reclamation and failed resources under one singleton owner before allocation or debit, preserving existing quotas while exposing distinct capacity and cleanup-fault outcomes. Exercise the approved races, DI shutdown and exported signals with matching served and generated contracts. ADR: 0064, 0065, 0066 * fix(auth): preserve no-store on every subject refusal Apply the shared response policy even when a classified API path has no endpoint. Make missing-header assertions fail and bind the retirement timer to its accepted cadence so regression controls cannot pass silently. ADR: 0064, 0065, 0066 * docs(roadmap): close subject admission implementation reviews Record both fresh implementation review rounds and the verified header-proof corrections while keeping complete local and final-source hosted evidence under their own source identities. ADR: 0064, 0065, 0066 * fix(auth): close HTTP boundary proofs and receipt chronology Close composition and cross-root capability gaps in the existing authentication census. Preserve owned cleanup despite diagnostic faults, pin real reader and contract guards, and distinguish delivered status from historical acceptance receipts. ADR: 0036, 0040, 0041, 0052, 0064, 0065, 0066 * test(auth): close provider and anonymous metadata escape paths Extend the bounded filter census to effective provider composition and implemented anonymous contracts. Real DI and compiled metadata controls prevent unchanged filter options from hiding executable policy changes. ADR: 0064 * test(auth): pin effective action filters and authorization metadata Close supported MVC composition channels that can change effective filters or authorization without changing the global inventory or ordinary attributes. Pair exact runtime inventories with compiled dirty and restored controls. ADR: 0064 * docs(roadmap): close backend correction review rounds Record both independent rounds and targeted confirmation of the committed composition-proof fixes before starting the demo and SDK correction step. ADR: 0064, 0065, 0066 * fix(web): bind demo receipts and preserve failure ownership Keep local request refusal distinct from network failure and make demo receipts describe the actual process outcome and observed source. Bind both report files without relaxing browser budgets or cleanup ownership. ADR: 0053, 0054, 0056, 0064 * fix(web): retain the first owned demo failure Publish output refusal before physical shutdown and keep the same first daemon error for every observer. Classify native coordinator cancellation from its owned signal without replacing known faults or cleanup failures. ADR: 0056 * fix(web): observe failing native exits before output closure Keep the first native failure authoritative when paused or inherited output delays close, while successful capture and physical cleanup still retain their existing completion bounds. Real-child controls prove the failure ordering and preserve complete successful output. ADR: 0056, 0064 * fix(web): publish every unexpected daemon exit A daemon's zero exit is still an unexpected failure. Observe it apart from ordinary command success so delayed streams cannot replace the first daemon outcome, while complete command output remains required. ADR: 0056, 0064 * docs(roadmap): close systematic correction review rounds Record verified fixes and independent follow-up closure while keeping current-source hosted qualification separate from historical receipts, local checks, production activation and maintainer merge approval. ADR: 0056, 0064, 0065, 0066 * fix(ci): refresh architecture weights from complete hosted receipts A censored assignment colocated expensive serial controls and exhausted its existing deadline. Refresh only completed hosted selector costs, retain unknown estimates honestly, and require both final-source layouts without changing membership, topology, algorithm or time budgets. ADR: 0063, 0064 * docs(roadmap): close measured timing correction reviews Record both independent provenance and contract review rounds while requiring fresh complete A/B evidence for the revised timing plan. Clarify the existing distinction from ordinary future pushes without changing any execution or qualification policy. ADR: 0063, 0064 * fix(ci): require identified hosted timing sources Require non-null source and run identities for hosted TRX timing records. Keep historical local and console source shapes intact. Plant all three missing-identity combinations against the actual plan validator. ADR: 0063 * docs(roadmap): close provenance guard reviews Record both independent review rounds and keep historical plan qualification separate from the final-source full assignment required after the guard fix. ADR: 0063 * docs(roadmap): propose P02b-6 realm and seed decision package Define bounded development reconciliation and real identity proofs before closing the remaining realm and issuance-lifetime gates. Preserve account and secret ownership, separate provider timestamp semantics from configured lifespan, and retain explicit approval before implementation. ADR: 0004, 0036, 0064 * docs(roadmap): accept P02b-6 realm and seed decisions Record the maintainer's approval before changing identity issuance or existing development accounts. Register real-provider proof obligations and retain the independent session, authorization and production gates. ADR: 0004, 0036, 0064 * feat(identity): declare executable development realm identities Make development issuance satisfy the strict tenant API profile while keeping authentication personas in the typed seed declaration. Qualify the committed import through real confidential code/S256 flow, owned HTTPS and independent scope, lifetime and credential-refusal controls. ADR: 0004, 0036, 0064 * fix(identity): close realm and vocabulary review gaps Keep the existing G20 completeness fence aligned with every declared identity, and reject optional mapper paths that can replace protected claims. Preserve escaped literal keys and qualify implicit writers so export drift cannot hide behind default-only issuance evidence. ADR: 0004, 0036, 0064 * fix(identity): qualify client-role claim interpolation Close the remaining export drift blind spot while retaining the provider's safe built-in role path. Reconcile current guidance and record both completed Step 1 reviews before starting warm-realm implementation. ADR: 0004, 0036, 0064 * docs(roadmap): propose bounded server information read Record the measured stock response that exceeds the accepted universal body budget and propose one authenticated read exception. Keep implementation and complete-core qualification pending maintainer acceptance. ADR: 0004, 0064 * feat(identity): bound development realm transport and ownership Keep setup credentials on the selected local service and retain each request and lock through actual cleanup. These independent primitives retain the accepted 256 KiB bound; planner activation and its version-read proposal remain pending with the rest of Step 2. ADR: 0004, 0064 * docs(roadmap): compare authenticated version probe alternatives Record pinned-source analysis and isolated provider measurements for server information and read-only partial export. Keep the accepted 256 KiB transport cap and the proposed exception pending approval. ADR: 0004, 0064 * docs(roadmap): accept fixed server information response allowance Record maintainer approval after the measured alternative comparison. Keep ordinary responses, outbound bodies and all other ownership bounds unchanged. Dependent implementation and provider qualification follow. ADR: 0004, 0064 * fix(identity): confine server information response allowance Permit 512 KiB only on the fixed authenticated successful bodyless server-information GET. Keep every other response and outbound body at 256 KiB. Exercise exact bounds, closed resources and negative purposes. ADR: 0004, 0064 * feat(identity): reconcile owned development realm state safely Plan all bounded Admin REST changes before writes and independently verify preservation and convergence. Keep existing accounts, secrets, roles and unrelated configuration through warm and partial upgrades. Qualify the actual shared core on PostgreSQL-backed HTTPS Keycloak, including zero-write repeats and conflict refusals. Seed and demo activation remains the next step after both independent review rounds. ADR: 0004, 0036, 0064 * fix(identity): qualify stored identity visibility before reconciliation Admin user projections cannot establish that hidden identity values are absent. Refuse unqualified profiles and projected plan limits before any write, retaining account state and enforcing the same bounded readers on subsequent passes. ADR: 0004, 0036, 0064 * fix(identity): qualify inherited claims and preserve projected users Reject protected group aggregation and inherited identity sources before writes, retain safe group membership, and compare derived profile metadata separately from stored accounts. Real provider controls cover uninterrupted warm upgrades, nested groups, signed claim counterexamples and zero-write reruns. ADR: 0004, 0036, 0064 * docs(roadmap): close realm review and qualify account self-service Record the completed Step 2 correction reviews and the measured account-console capability gap. Keep the bounded role and fixed-account mapper proposal pending maintainer decision while the approved seed/demo lifecycle proceeds. ADR: 0004, 0036, 0064 * feat(identity): share realm convergence across seed and demo Validate private realm configuration before infrastructure work, build and run the argument-free Release Seeder with its own credential, and await one shared reconciler before public demo startup. Keep selected-stack identity and owned cancellation through setup, with credential-free build and renderer processes. ADR: 0004, 0036, 0064 * docs(roadmap): record first seed lifecycle review Keep the Step 3 receipt separate from actual Compose qualification and wrap the verified prose findings without changing its runtime contract. ADR: 0004, 0036, 0064 * fix(identity): confine seed preparation credentials Run selected stack and migration preparation under the seed owner so matching inherited Keycloak credentials never reach EF children. Retain Docker target controls with a fixed prerequisite allowlist and prove the old Makefile dependency path fails the same confinement control. ADR: 0004, 0036, 0064 * fix(identity): keep readiness under one seed owner Own PostgreSQL readiness directly rather than through a nested CLI whose detached Docker cleanup can outlive the preparation group. Prove cancellation and deadlines stop owned work, and that restoring the nested owner fails the same survival predicate. ADR: 0004, 0036, 0064 * test(identity): retain process absence witnesses in seed proofs Keep native process-group retirement evidence through both observation samples so reused IDs cannot be attributed to owned work. Close Step 3 with independent correction reviews and final runtime seed receipts. ADR: 0004, 0036, 0064 * feat(identity): qualify realm self-service and real token admission Keep development account access limited to the approved builtin role and mapper while proving protected identity fields against real Keycloak. Exercise issued credentials through the production API and retain owned provider teardown, physical read-only and complete CI discovery proofs. ADR: 0004, 0036, 0064 * fix(ci): require executed realm cases alongside JUnit reports An empty named Node suite can look like a passing JUnit case. Require actual counters from the same invocation and exercise the real workflow gate against empty-suite counterexamples. Retain measured provider case weights so complete CI assignments use observed advisory costs. ADR: 0004, 0063, 0064 * fix(tests): classify the offline realm gate control source Keep the repository source census closed while declaring the new Python counterexample helper as an exact offline test owner. Require the Node reporter to remain visible to the live runtime census and retain the completed Step 4 independent reviews and actual demo evidence. ADR: 0056, 0064 * docs(roadmap): close P02b-6 implementation and review steps Record actual provider and complete hosted backend evidence alongside the known frontend correction, promote the two delivered behavioural rules, and reconcile current carriers with all four reviewed implementation steps. Keep final PR-head qualification and merge explicitly separate. ADR: 0004, 0036, 0064 * docs(roadmap): identify the live PR qualification owner Keep the completed implementation status distinct from dynamic PR checks so the source-bound record does not imply a merge or stale test result. ADR: 0063, 0064 * fix(identity): preserve setup prerequisites and failure cleanup Retain tooling prerequisites without propagating application secrets, classify aborted transport failures and remove failed lock markers. Align finite seed preparation budgets and identity documentation with current development behavior. ADR: 0004, 0036, 0064 * docs(roadmap): record verified PR identity corrections Record the two independent correction reviews and distinguish current local evidence from the new-head hosted qualification. ADR: 0004, 0036, 0064 * fix(identity): reject false convergence and close proof gaps Refuse ambiguous account creation and incompatible login state before claiming convergence. Preserve credentials without replaying mutations, protect local setup sources, and independently verify provider identity, profile preservation and owned cleanup. Keep CI evidence bound to its actual attempt, distinguish missing receipts, and require the complete reviewed test and fixture populations. Retain failed qualification history instead of promoting partial reruns. ADR: 0003, 0004, 0018, 0063, 0064 * style: align correction whitespace Keep the fixture and dated verification prose within repository formatting conventions without changing executable behavior. ADR: 0004, 0064 * fix(identity): validate first reads and complete fixture census Reject unsafe selected sources before Compose can perform a blocking read. Bind fixture eligibility to actual declarations so qualified collections and other explicit fixtures cannot silently miss the independent-layout witness. Retain exact source-bound review receipts. ADR: 0063, 0064 * fix(identity): bind Docker preflight to the selected environment Inspect the same Docker inputs used by stack commands, including keys removed from inherited configuration. Reject collection-attribute aliases before fixture census filtering so they cannot silently narrow its proof. Retain counterfactual controls and source-bound independent reviews. ADR: 0063, 0064 * docs(roadmap): close independent correction reviews Record both completed review rounds and independent verification of the final alias and Docker-environment corrections. Keep hosted qualification with the frozen source and live PR checks rather than old passing runs. ADR: 0063, 0064 * fix(identity): keep seed authority generic and retain startup faults Bind legacy identities to their complete typed declarations instead of branching on demo usernames. Preserve existing finite provider startup faults in failed measurements without exporting raw error messages or changing execution and cleanup evidence requirements. Record the failed frozen-source run and its diagnostic limits. Keep all fixture, HTTP and whole-job deadlines unchanged. ADR: 0018, 0063, 0064 * docs(roadmap): record startup diagnosis correction reviews Record both independent rounds and exact local checks without promoting them to hosted qualification or inventing a provider startup cause. ADR: 0063 * test(identity): distinguish bounded provider startup failure families The actual hosted fixture reaches the database stage and reports the generic provider fault. Retain finite Docker status, reaper, socket and filesystem classifications without exposing provider messages or bodies. Do not infer a cause from the broader family or change startup budgets. ADR: 0063, 0064 * test(identity): isolate pure startup diagnostics from fixture ownership The source Docker guard correctly treats direct fixture references as provider dependencies. Put pure finite classification in its own type so offline canary controls remain Docker-free without weakening the guard. ADR: 0063, 0064 * docs(roadmap): close provider classification correction reviews Record independent final-source verification of finite failure codes and the fixture-free diagnostic boundary, without claiming a repair. ADR: 0063 * fix(ci): retain closed Docker startup failure families Distinguish PostgreSQL SDK milestones and fixed daemon failure families without exporting provider text or changing startup and cleanup policy. Keep malformed and unknown responses on the existing generic diagnostic. Validate seven offline cases, seven corpus/Docker-sweep cases, all 43 launcher controls and sixty combined shard/aggregate controls. ADR: 0063 * fix(ci): contain malformed diagnostic Unicode Map raw unpaired UTF-16 parser failures to the existing fixed fallback. Four independently reproduced red controls now pass within the seven-case offline suite with warnings as errors. Record first-round review and the successful isolated Linux startup without claiming hosted reproduction. ADR: 0063 * docs(roadmap): record daemon diagnosis correction reviews Record both fresh second-round approvals, independent offline checks and source-bound evidence limits before the next complete hosted A run. ADR: 0063 * fix(testing): align fixture publishers and browser readiness Publish application PostgreSQL on the identity fixtures' loopback address. Share publication checks and require real configured/runtime inspection; retain all database roles and ownership cleanup. Poll only valid empty browser target lists within the original shared five-second discovery budget. Preserve immediate invalid-response refusal, closed diagnostics and owner/liveness checks. Validate nine C# cases, seven corpus/Docker-sweep cases, 1756 guarded frontend cases, 43 launcher controls and sixty shard/aggregate controls. Record actual Linux before-red/after-green publication and role proofs. ADR: 0003, 0063, 0064 * docs(roadmap): record publication correction first reviews Retain both scoped approvals, independently executed controls and the fourth frozen source's verified auxiliary evidence without promoting its failed integration result or claiming an observed daemon version. ADR: 0063 * docs(roadmap): complete publication correction reviews Record both fresh second-round approvals and independent browser, PostgreSQL privilege and cleanup checks before complete final-source A/B qualification. Keep source-bound evidence limits explicit. ADR: 0063 * fix(identity): clarify private setup and realm proof failures Keep unsafe private-file refusals actionable without exposing their contents, and make realm drift controls reject malformed profiles and exercise username uniqueness independently. Extend owned fixture TLS validity without changing trust. Record the existing issuance choice in a Proposed ADR pending separate maintainer approval. ADR: 0004, 0064 * docs(testing): preserve provider-only fixture boundaries Describe the actual dependencies of provider-only and combined API tests without implying every Keycloak proof configures application modules. Record the first independent correction reviews and their verified fix. ADR: 0004, 0064 * docs(roadmap): complete setup correction reviews Record both independent correction reviews and their validation limits, while keeping the dedicated issuance ADR Proposed until explicit approval. ADR: 0004, 0064 * fix(identity): prove coupled development token expiration Clarify the proposed issuance ADR's authority and provider consequences without treating the review as acceptance. Preserve historical package statements through dated adjacent corrections and name the actual reconciliation owners. Validate signed access and ID expiration together, including session clamping, and plant an independent ID-expiration payload defect that passes each fresh-window check. Retain the existing runtime and case population. ADR: 0004, 0064 * docs(roadmap): record first issuance correction review Record independent proof/security and ADR/provenance approval while retaining the second review and explicit ADR acceptance gates. ADR: 0004, 0064 * docs(roadmap): complete issuance correction reviews Record the fresh second-round proof and ADR reviews and their limits. Keep formal ADR acceptance and current-head hosted qualification separate. ADR: 0004, 0064 * docs(identity): accept development issuance decision Record explicit maintainer acceptance of revised ADR-0067 and complete its authority references in Security 11, the catalogue and local guides. Preserve original phase approval and Proposed-state reviews with dated adjacent disclosures. Keep issuance configuration, API acceptance, session ownership and source-bound qualification unchanged. The preceding ordinary CI failure remains separately under investigation. ADR: 0004, 0064, 0067 * docs(roadmap): record first issuance acceptance review Record the independent authority and scope reviews of the approved ADR-0067 carrier changes, with hosted failure investigation retained. ADR: 0067 * docs(roadmap): complete issuance acceptance reviews Record both completed independent carrier reviews and the source-bound CI triage. Preserve the failed lifecycle case without inferring its missing assertion diagnostic or waiving aggregate refusal. ADR: 0067 * fix(ci): retain closed causal restart failure locations Add the one observed lifecycle test source to the finite diagnostic projection while keeping paths, stacks and provider messages private. Plant the missing location in the existing control, observe it fail, then pass all 43 offline launcher controls after adding the mapping. This does not identify or fix the previous runtime assertion failure. Success witnesses, aggregate refusal and execution budgets stay intact. ADR: 0063 * docs(roadmap): record closed diagnostic correction review Record independent privacy and counterexample reviews of the one-source mapping, including all 43 controls and the removed-mapping negative. ADR: 0063 * docs(roadmap): complete closed diagnostic correction reviews Record the fresh second-round privacy and proof checks, including the missing-map negative, all offline controls and byte-preserved execution. Keep the preceding failed lifecycle receipt unwaived. ADR: 0063 * fix(tooling): preserve safe development lifecycle operations Keep teardown usable before realm convergence, retain closed setup diagnostics, and confine private configuration and migration credentials to their owners. Add actual-launcher controls without changing accepted realm capabilities. ADR: 0004, 0053, 0054, 0064, 0067 * test(identity): strengthen convergence and CI gate counterexamples Exercise retained-account and transport boundaries independently, keep the realm gates mandatory, and project only recognized safe failure kinds. Record source-bound checks without treating repeat passes as a root cause. Guard the documented migration build before executing no-build EF. ADR: 0004, 0063, 0064, 0067 * docs(decisions): propose development identity visibility preparation Keep the demonstrated hidden-identity refusal while examining a bounded metadata-first exception. Record the independent historical-bootstrap scope prerequisite explicitly; approval and dependent runtime remain pending. ADR: 0004, 0064, 0067, 0068 * docs(identity): bound historical realm upgrade qualification Separate profile visibility preparation from fully planned detachment of only three qualified stock console edges. Retain compatible scopes, existing grants and explicit approval before dependent runtime. Record actual feasibility, completed correction reviews and the remaining proof boundary honestly. ADR: 0004, 0064, 0067, 0068 * test(tooling): declare isolated child test environments Supply the test mode required by Next's process environment types without inheriting application credentials into child fixtures. Full typecheck, lint and all 197 affected cases pass. Record the proposed warm-realm correction steps and reflow the first document review's long lines. ADR: 0064, 0067 * docs(roadmap): record final correction and proposal reviews Record both fresh review rounds for the isolated fixture typing fix and the final Proposed warm-realm correction. Preserve the approval hold and separate author checks, private feasibility and hosted qualification. ADR: 0064, 0067 * fix(identity): resolve assigned console scopes by bound ID Admin assignment endpoints return only ID and name. Read and bind the complete representation before checking protocol, while preserving all existing compatible allowance and mapper checks. Add independent graph, identity, readback and transport-cap counterexamples; 256 guarded Node cases and six workflow-gate controls pass. ADR: 0004, 0064 * docs(decisions): qualify preparation authority and console evidence Require all identity-independent refusals before preparation, preserve readable prior definitions, and specify preparation diagnostics, write accounting and exact assignment-only DELETE authority. Retain shipped catalogue status with pending extensions. Correct raw provider anchors and distinguish actual console token effects from unproved POST/runtime behavior. Record conditional maintainer acceptance authority and the separate source-bound CI failure without guessing its cause. ADR: 0004, 0064, 0067 * fix(ci): retain closed native settlement failure locations Add the existing settlement test file to the finite diagnostic source projection. Verify exact and near-match handling without exposing raw paths or errors. All 43 offline controls pass. This does not infer the lost CI assertion or alter runtime, deadlines or success witnesses. ADR: 0063 * docs(roadmap): record revised decision inspection and failure limits Record the first fresh review of the compatible-read correction and conditional decision revision. Reflow its one minor finding and clarify what the failed launcher envelope can and cannot establish. ADR: 0063, 0064, 0067 * docs(decisions): accept bounded warm-realm qualification Accept ADR-0068 under the maintainer's conditional authority after both fresh revision reviews. Disclose the two bounded phase replacements and historical remedy follow-up; reconcile authority headers, architecture, guidance and index. Preserve shipped catalogue status/counts while the expanded obligations remain explicitly pending. Acceptance authorizes the three-step implementation, without claiming automatic-path proof. ADR: 0004, 0064, 0067, 0068 * feat(identity): qualify stock console assignment normalization Bind complete historical scope, mapper and role representations before removing only three approved account-console assignments. Preserve the compatible path, keep DELETE authority opaque and requalify explicit partial-progress reruns without replay or a durable marker. Commit a credential-redacted historical fixture, fixed canonical baseline and independent real-provider reproduction. The ordinary production path performs sixteen writes, then zero after test-owned metadata setup. Automatic preparation and the remaining token/self-service proofs retain the next steps' gates. ADR: 0004, 0064, 0067, 0068 * test(identity): cover every interrupted console assignment Persist uncertain-response and cancellation controls at all three DELETE positions. Verify the exact durable prefix, no replay, last-edge handoff to compatible preservation and explicit zero-write convergence. Record the first independent Step 1 review and its verified proof gap. Runtime behavior and mutation authority remain unchanged. ADR: 0068 * docs(roadmap): close the first warm-realm correction step Record both fresh review rounds, the persisted interruption correction and its independently verified convergence. Keep preparation, complete automatic-path evidence and final hosted qualification explicitly pending. Clarify that the Node census guards files and counts, not test semantics. ADR: 0068 * feat(identity): prepare warm-realm identities before fresh planning Qualify independent prerequisites before the bounded metadata exception, then discard every provisional projection before admitting ordinary writes. Keep uncertain dispatched progress visible through failures and cleanup. Actual historical provider controls prove convergence and explicit recovery. ADR: 0068 * fix(identity): qualify visible facts before warm-realm preparation Keep already observable identity and profile refusals ahead of metadata preparation. Preserve mapper refusal codes through stock qualification and retain dispatched metadata notices through the seed and demo entry owners. Actual provider regressions and clean counterpart controls bind these fixes. ADR: 0068 * docs(roadmap): record verified warm-preparation corrections Bind the closed first-round findings and caller/mapper regressions to their committed fixes and independent checks without claiming final qualification. ADR: 0068 * docs(roadmap): close reviewed warm-realm preparation step Record both fresh review rounds, verified correction coverage and remaining complete-path qualification without treating partial evidence as release proof. ADR: 0068 * test(identity): prove historical realm credentials and API Qualify the approved warm upgrade with usable MFA, signed application reads and stored account changes. Retain source-bound entry evidence and measured case assignments while keeping incomplete public qualification explicit. ADR: 0004, 0064, 0067, 0068 * docs(roadmap): record warm qualification and Step 3 reviews Retain both historical demo outcomes and their distinct evidence limits, then record the two fresh independent review rounds before final hosted assignment qualification. No earlier failure is relabelled as success. ADR: 0063, 0068 * test(ci): bound ingress lookup and retain settlement facts Remove an unrelated unbounded informational lookup from the native ingress fixture while preserving real request settlement and all security checks. Exercise case-bound diagnostics through the pinned test adapter and retain failed qualification receipts without guessing their missing root cause. ADR: 0047, 0055, 0063, 0068 * docs(roadmap): record first CI correction review Retain independent source and actual adapter checks without treating historical green assignments as a waiver for the failed A3 receipt. ADR: 0063, 0068 * docs(roadmap): close independent CI correction reviews Record the fresh second review and clarify the informational fetch bound without claiming a universal response-body deadline or waiving A3. ADR: 0063, 0068 * test(jobs): attribute settlement loss to its execution Preserve the original held Outcome invariant without assigning later Finalize observations to it. Prove the distinction with a real locked Finalize commit, conservative renewal refusal and actual cleanup, and retain closed identity attribution across all failure boundaries. ADR: 0047, 0059 * test(jobs): join issued settlement flights before cleanup Await actual flights before positive ownership joins so an early assertion cannot retain unfinished work permanently. Preserve the first failure and qualify the cleanup path with a real held-COMMIT negative and bounded, case-bound cleanup observations. ADR: 0047, 0059 * docs(roadmap): close independent attribution reviews Record the verified cleanup correction, both fresh review rounds and the exact whitespace-only source binding. Keep current-head hosted qualification in the PR and preserve every earlier failed receipt. ADR: 0047, 0059, 0068 * test(jobs): preserve recurrence failure and cleanup observations Keep the first actual recurrence test fault through independent cleanup and retain only case-bound finite diagnostics. Real adapter controls preserve the original assertion even when cleanup also fails; production behavior and all existing waits remain unchanged. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): record recurrence diagnostic first reviews Record independent ownership and export checks against actual adapter failure, cleanup, source and archive evidence while preserving the failed hosted run. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): close recurrence diagnostic review rounds Bind both fresh review rounds to actual failure preservation, positive cleanup and complete retained evidence, with hosted qualification and merge separate. ADR: 0047, 0059, 0063, 0068 * test(jobs): isolate settlement proofs from pre-ack renewal races Schedule the real renewal pacing callbacks around Outcome settlement, retain actual timer cleanup, and prove the unrelated Prepare-lock refusal against PostgreSQL. Preserve exact cases, deadlines and production policy. Retain the failed CI and partial-rerun evidence with bounded diagnostics. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record first settlement scheduling reviews ADR: 0047, 0063 * test(jobs): arm settlement deadlines before publication holds Create the actual normal deadline timer before the fixture publication hold. Preserve real durations, callback/factory ownership and exact case identities. Retain fresh clean and exclusion-control evidence, and explicitly refuse the ordering control's unconfirmed internal cleanup witness. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record independent deadline fix verification ADR: 0047, 0063 * fix(ci): audit links against immutable event commits Compare the PR event base snapshot directly with the checked-out tree instead of fetching a later shallow base branch. Exercise the actual workflow owner against real squash graphs, missing bases and broken links. Preserve strict aggregate identity refusal and record the merged implementation accurately. ADR: 0007, 0041, 0063 * docs(roadmap): record link audit correction review Record both independent first-round reviews and the actual workflow and corpus checks. Complete hosted A/B qualification remains pending on an open follow-up PR; closed-PR identity evidence is not waived. ADR: 0007, 0041, 0063 * docs(roadmap): close link audit correction reviews Record the different second review pair and independently reproduced old-owner failures. Keep complete final-source hosted qualification pending on the open follow-up PR. ADR: 0007, 0041, 0063 * fix(ci): classify Markdown audit regression tooling Register the new Python proof script in the explicit non-runtime census. The real frontend guard caught the omission; preserve rejection of unknown sources and runtime exemptions. All 1840 frontend cases pass. ADR: 0018, 0056, 0063 * docs(roadmap): record tooling census correction review Record the first fresh review pair and retained frontend evidence. Complete hosted qualification remains pending on the corrected source. ADR: 0007, 0056, 0063 * docs(roadmap): close tooling census correction reviews Record the different second review pair and retain the failed initial attempt's evidence limits. Fresh same-source A/B qualification follows. ADR: 0007, 0056, 0063 * test(jobs): preserve native wait failure attribution Retain the first body or explicit runtime-join exception instead of masking it in finally. Export only case-bound closed boundary and owner task observations so startup and cleanup cancellations can be separated. Validate clean and three planted fault paths with actual native work, including the old test's masking counterexample. The earlier hosted cancellation remains unexplained; no timeout or runtime policy changes. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): record native wait diagnostic review Preserve original proof receipts and disclose the corrected container count against retained raw cleanup evidence. Record source binding and the first independent review round without asserting a hosted cause. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): close native wait diagnostic reviews Record the second fresh independent pair and exact retained evidence verification. Keep hosted cancellation and helper scheduling causes unproven until source-bound qualification supplies actual evidence. ADR: 0007, 0047, 0060, 0063 * test(jobs): wait for actual cleanup before fixture hints The native execution fixtures may consume their sole extra hint while an earlier empty recovery still owns private cleanup. Wait for actual native work and local identity release before issuing that same hint. Reproduce premature consumption with real SQL/native workers and an owned System timer cleanup barrier. Preserve all existing budgets, production policy and original case identities; add one regression fact. ADR: 0047, 0059, 0060, 0063 * test(jobs): retain cancellation before fixture hint emission Restore the original final cancellation check after readiness waits. Record the first independent review round and fresh exact-source clean and planted-failure evidence without claiming atomic cancellation or a cause for the earlier hosted failure. ADR: 0007, 0047, 0059, 0060, 0063 * docs(roadmap): close fixture handoff correction reviews Record the second fresh pair and exact proof/source verification. Preserve the unknown hosted cause and require complete final-source A/B qualification before the follow-up draft is ready for review. ADR: 0007, 0047, 0059, 0060, 0063 * fix(ci): bound browser dependency mirror waits Let the hosted browser installer leave stalled APT mirrors while retaining its complete dependency set, verification and existing time budgets. Read back effective root settings and remove only the exclusive fragment. Exercise the actual workflow shell across success and failure paths, and retain the failed prior attempts as unqualified observations. ADR: 0007, 0056, 0063 * test(ci): exercise partial browser setup writes Make the write-failure control leave a genuinely incomplete fragment before refusing, then verify that the actual workflow shell removes it. Record the first independent review pair and the failed A receipt. ADR: 0007, 0056, 0063 * docs(ci): record browser acquisition review closeout Record the second fresh independent review pair and its extracted-shell checks. Keep the prior failed attempts separate from the complete hosted A/B qualification still required on the resulting source. ADR: 0007, 0056, 0063 * fix(ci): reserve bounded public demo completion time The complete B assignment reaches the last public audit before its sixteen-minute outer allowance cancels it. Allocate seventeen minutes inside the same twenty-minute job, twelve-minute proof and thirty-second native cleanup limits. Bound the remaining cleanup/receipt steps and restore NuGet without a save post-hook to retain a three-minute tail. Exercise actual deadline and tail shells, preserving forced failures. Keep failed partial evidence distinct from complete qualification. ADR: 0007, 0056, 0063 * docs(roadmap): record first outer-budget correction reviews Record two independent approvals, their actual-shell controls and historical evidence checks without claiming new hosted qualification. ADR: 0056, 0063 * docs(roadmap): close outer-budget correction reviews Record fresh second-round approvals and independent historical evidence revalidation. Keep complete final-source hosted A/B as a separate gate. ADR: 0056, 0063 * fix(ci): join maintenance in OpenAPI control repositories The hosted snapshot control fails strict temporary cleanup while its Git object directory changes. Keep maintenance in the foreground only in the synthetic repository so the waited commit also waits its actual work. Prove nested commit-graph completion with a real Git trace under a private configuration that otherwise requests background maintenance. Retain strict cleanup and all OpenAPI comparison and admission rules. The observed mechanism is not a captured trace of the hosted failure. ADR: 0007, 0052 * test(ci): require successful owned Git maintenance proof Reject a planted graph write failure even when a prior graph exists. Correct pinned source anchors using physical raw-file lines and record both first-round reviews and their verified fixes. ADR: 0007, 0052 * docs(roadmap): close Git maintenance fixture reviews Record two fresh second-round approvals and the independently repeated clean, detached and planted-failure controls with their runtime limits. ADR: 0007, 0052 * fix(ci): retain closed producer gate refusal diagnostics Both aggregate jobs reject a gate but discard which source-owned producer and step failed validation. Emit finite state words before the unchanged refusal so later API success cannot obscure the original observation. Never export arbitrary provider values or retry inconsistent evidence. Keep the unsuccessful historical attempt separate from new qualification. ADR: 0007, 0063 * docs(roadmap): record gate diagnostic review evidence Retain independent closed-output checks and historical evidence limits. Separate complete public component observations from failed whole-run qualification and final-source A/B still required. ADR: 0007, 0056, 0063 * docs(roadmap): close producer gate diagnostic reviews Record fresh differential and mutant controls, independent component archive checks and the unchanged final-source whole-workflow gate. ADR: 0007, 0063 * fix(ci): own Outbox startup and attribute producer refusal Disable the unowned telemetry exporter in the Outbox host fixture and join actual startup before disposal even when its assertion wait expires. Retain only finite startup facts from the real test adapter output. Report closed producer states before the unchanged aggregate refusal. Keep unknown hosted causes distinct from local counterfactual evidence. ADR: 0007, 0044, 0046, 0063 * docs(roadmap): record Outbox correction first review Record independent code, protocol and retained-evidence validation while preserving unknown hosted causes and complete final-source A/B gates. ADR: 0063 * docs(roadmap): record independent Outbox correction approval Record the second fresh review pair and narrow container identity prose to the exact retained evidence. Keep full final-source A/B pending. ADR: 0063 * fix(ci): bound pending producer metadata acquisition Read fresh complete attempt snapshots under one short acquisition budget before applying the unchanged successful-producer witness. Refuse terminal, malformed and identity-invalid evidence immediately, including when an earlier owner is pending. Never combine snapshots. Keep the five-minute aggregate ceiling and upload reserve unchanged. ADR: 0063 * fix(ci): validate creation times before metadata settlement Reject malformed or reversed creation timestamps before a pending owner can cause another read. Record independent repros and corrected first-round review validation. ADR: 0063 * docs(roadmap): record independent metadata acquisition reviews Record fresh second-round deadline and malformed-evidence controls, with retained failed-attempt and pending hosted qualification limits. ADR: 0063 * docs(decisions): accept ADR-0069 phase documents and delivery logs Phase 02b's phase document reached 18,884 lines, 92% of them dated packet records, and Phase 02d followed the same shape; status was narrated in five places and no check covered link fragments. The maintainer accepts keeping the plan and the record in separate files, status in one place, and two CI guards that hold both, after one review round whose findings this text resolves. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): split Phase 02b and 02d records into delivery logs Moves every dated packet record out of the two phase documents into sibling append-only delivery logs, grouped by packet in source order, with the superseded Status blocks kept verbatim in each log's archive. Each heading's anchor was recomputed in its new file and checked against its original one, duplicates included, and every original line survives the split; only heading levels and link targets around the text change. 606 inbound links are retargeted with their text unchanged, so the Accepted ADRs touched owe no amendment. Phase 04's one dated plan heading keeps its date in its acceptance line and its six links follow it. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: hold packet status once and record the delivery log rule Packet state was narrated in the phase Status block, the packet table, the Completion Criteria preamble, the roadmap index, CLAUDE.md and the repository README, and every step edited all of them. Each now points at the phase document, whose bounded Status block owns packet state; CLAUDE.md drops from 856 to 405 lines. The rule itself lands where readers look for it: Roadmap § Phase Structure and § Decision Timing, Documentation Standards, the glossary, CLAUDE.md and the two skills that write roadmap records. ADR-0069's dated amendment names the README as a sixth carrier and fixes how its budgets are counted. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(meta): guard link fragments and roadmap structure The link audit strips fragments and reads only changed files, so a moved heading broke links silently, and nothing stopped a phase document from growing records again. The meta job now resolves every fragment link in the tree against GitHub's heading slugs and holds phase documents, delivery logs, the roadmap index, CLAUDE.md and the README to ADR-0069; `make lint` runs both through `lint-docs`. Each guard ships planted-violation controls, the source census classifies the four new tooling files, and the link audit now skips code spans as it already skipped fenced samples. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): amend ADR-0069 with generated delivery log indexes A delivery log is too large to read whole, so an agent needing one entry has no map of the rest. The amendment opens each log with an index generated from its headings and checked in CI, listing lengths rather than line numbers and no inferred record kinds, and states that the index is navigation, not a record. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): open each delivery log with a generated index The Phase 02b log is about 305,000 tokens, so an agent needing one entry had no map of the rest. Each log now opens with an index of its packet sections, entries and dated sub-entries with their lengths, generated by scripts/delivery-log-index.py (`make docs-index`) and refused when stale by the meta job and `make lint-docs`. The fragment audit covers every row's anchor; the logs, roadmap index, Documentation Standards, glossary, CLAUDE.md and the two record-writing skills say to read the index, not the log. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): install Chromium without the APT mirror The public demo's five-minute browser step failed four of today's twelve attempts while Playwright's --with-deps installer downloaded fonts from the runner's slow APT mirror; the 15-second acquire timeouts cannot end a slow transfer that is still moving. The hosted image already carries every Chromium library, and no public-demo check depends on system fonts, so the step installs only the pinned Chromium build and drops the temporary APT fragment with it. The workflow test executes the actual step against stubs and fails on any sudo or APT call; against the previous workflow it fails. The delivery log records run 39805658821, the still-unexplained native fixture hang, and the maintainer's single-assignment qualification decision for PR #35. ADR: 0056, 0063 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): propose owned tenant BFF sessions Define session custody, lifecycle, admission and evidence before the first BFF credential owner is implemented. Keep G13 open until the maintainer accepts the proposal and five-step delivery package. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): resolve BFF session proposal review findings Separate local logout guarantees from provider navigation, preserve logout at full sign-in capacity and require the actual warm-realm BFF chain. Record the first independent proposal review and its verified corrections. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): finish the BFF decision pass and prior closeout Record the second independent proposal review, make optional BFF activation explicit and distinguish public requests from OIDC transactions. Verify PR 35's merged source and successful CI without inferring historical causes. Keep the new session ADR Proposed until maintainer approval. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): revise BFF ownership after maintainer review Compare maintained RP alternatives and select openid-client without a credential-bearing cookie or competing session framework. Define provider event persistence, source and subject admission, effective expiry and browser transaction fencing before requesting renewed approval. ADR: 0004, 0035, 0036, 0053, 0054, 0064, 0067, 0069 * docs(decisions): retain logout owners in subject admission Keep logout-return entries in the subject budget until return expiry or consumption and actual work settlement. Distinguish AccountSite actor and scope evidence from independently validated OIDC subject continuity. Record the first revised proposal review and its verified corrections. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): complete revised BFF proposal review Record the second fresh independent review pair and final source clarifications. Preserve API-owned resolved organization scope separately from optional protected claims and retain approval-pending status. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(decisions): accept native tenant BFF session ownership Record maintainer approval of ADR-0070 and its five-step delivery plan before dependent implementation. Reconcile custody, CSRF, event evidence and deployment rules, append bounded prior-decision disclosures, and register the four proof obligations without claiming runtime delivery. ADR: 0035, 0053, 0054, 0064, 0067, 0069, 0070 * feat(identity): add inactive BFF RP and provider event policy Keep credentials behind a server-only pinned RP with fixed-purpose bounded transport and signature-enabled grants. Qualify development event storage before metadata preparation, preserve existing event policy and verify actual fresh/warm persistence without activating browser sign-in. Targeted checks pass; the delivery record explicitly tracks the remaining historical count reruns and added real-body cancellation proof before Step 1 closure. Production route and configuration admission stay closed. ADR: 0004, 0035, 0053, 0054, 0064, 0067, 0068, 0070 * fix(identity): qualify logout and event response boundaries Keep the supported loopback logout path inside the closed provider boundary and refuse known event-expanded realm overflows before any preparation write. ADR: 0068, 0070 * fix(identity): preserve provider defaults and closed network reasons Retain every pinned default-saved event and distinguish library-wrapped network uncertainty from malformed responses. Close both Step 1 review rounds with independent omission controls and real provider evidence. ADR: 0068, 0070 * feat(identity): own bounded native BFF session lifecycles Keep credentials and actual operation ownership in one native process across browser transactions, refresh, replacement and logout. Exercise capacity and revocation races before wiring any production route or activation. ADR: 0035, 0053, 0054, 0070 * fix(identity): preserve current callback visitor attribution Use the callback's verified visitor for AccountSite without moving the original pending-source credit or consuming state on a malformed source. ADR: 0064, 0070 * docs(roadmap): close native BFF ownership reviews Record both fresh review approvals and the tested source before starting the closed HTTP and SDK slice; retain later activation and runtime proof owners. ADR: 0069, 0070 * feat(web): implement closed BFF HTTP and request projections Keep production activation closed while adding native response-owned auth protocol, bounded input, host cookies, CSRF and safe read-only RSC sessions. Use the exact authenticated SDK for the native AccountSite witness. Qualify the inactive path through actual native HTTPS and production Next middleware/RSC bundles. Real provider/API and browser proof remains Step 5. ADR: 0053, 0054, 0070 * fix(web): retain native RSC activity through Next middleware Capture only the closed activity scalar before Next strips Flight headers. Keep response-owned refresh and idle mutation separate from RSC reads. Exercise actual production Next with expired access and passive controls; a copied dropped-handoff mutant must fail the same RSC assertions. ADR: 0053, 0054, 0070 * docs(roadmap): close P02b-7 HTTP protocol review rounds Record both fresh second-round approvals and retain the distinction between native Next proof and the remaining provider/browser gates. ADR: 0069, 0070 * feat(web): activate optional tenant BFF and localized session UI Activate native session and request owners atomically after private configuration agreement. Resolve live host/locale admission before session actions, and guard the read-only Studio/Portal shells. Add complete sign-in/recovery copy, effective-expiry warning, real extension and local-first logout UI. Keep browser transport closed to one same-origin action and veil protected history before restoration. Preserve actual public admission, browser fallback and HMR evidence without bypassing the new shell guard. Validate 2,081 guarded frontend cases, production Next builds, the PostgreSQL admission lifecycle and five corpus controls. Real provider, browser history and final-source hosted proof remain Step 5. ADR: 0053, 0054, 0069, 0070 I18n: auth * fix(web): close development auth traces and add skip links Suppress Next request URL tracing before the native process imports Next; retain an actual development canary and a guard-removal counter-control. Add localized keyboard skip links to auth documents and protected shells. Bound frontend file concurrency while retaining complete guarded discovery. ADR: 0053, 0054, 0069, 0070 * fix(web): preserve focus through session recovery transitions Announce unchanged or maximum extension and recover focus after focused controls expire, while preserving external focus and passive warnings. Record both independent Step 4 review rounds and begin lifecycle proof. ADR: 0069, 0070 * test(identity): prove native BFF lifecycle and browser isolation Exercise the reconciled warm provider through the native BFF and real application-role API, with separate actual HTTPS cookie/history proof and an enabled no-network startup control. Keep private IPC and joined fixture cleanup outside retained artifacts. Correct the sign-in document's referrer policy so browser form Origin survives exact CSRF admission. Require fresh native/SDK fixture builds and retain complete local discovery and advisory timing evidence. Hosted qualification, demo and both review rounds remain open. ADR: 0070, 0064, 0063, 0053, 0054 * fix(identity): join BFF proof owners before reporting success Close the private lifetime pipe before joining fixture processes and independently require empty owned temporary roots. Reject nonzero native shutdown and forced process-group cleanup instead of publishing success. Own the browser synchronously before CDP connection to fence late launch. Prove early parent disposal and the exact shutdown counter alongside the real warm-provider/API chain and separate HTTPS browser history control. Record stopped-provider public-demo evidence and complete local controls. ADR: 0056, 0063, 0070 * fix(identity): observe parent EOF throughout BFF acquisition Keep bounded private input flowing while native compilation and build are awaited, so an early parent close reaches the fixture owner before readiness. Prove the held-build abort joins and removes its private tree. Require zero native exit and unforced settlement in every protocol and UI proof. Add the exact shutdown counter and retain the real six-case BFF and 2090-case frontend results with both review confirmations. ADR: 0056, 0063, 0069, 0070 * test(web): expect closed shells when tenant sign-in is disabled The standalone ingress proof still expected pre-BFF placeholders after the accepted activation changed disabled protected shells to 503. Require that unavailable response without cookies, forms or protected content while preserving exact bootstrap, method and TLS controls. Record the hosted failure honestly and retain the fresh production proof, 19 cleanup controls and both focused source confirmations. ADR: 0053, 0056, 0070 * test(ci): isolate held-constructor cancellation and copied ingress Copy the new pure ingress dependency into the existing local launcher fixture. Establish real constructor entry before the held-constructor test requests stop or expires its SQL lease, while retaining real timers and shared cleanup bounds. Keep failure-only closed handoff observations for future source diagnosis. Record the complete failed first A attempt, focused independent reviews and local worker/parser/aggregate evidence without claiming its cause reproduced. Refresh overview pointers for optional native tenant sign-in. ADR: 0047, 0059, 0063, 0070 * test(jobs): preserve the handoff control before constructor entry Compose the existing real renewal pacing and held-disposal observers so safe preconstructor renewal refusal cannot replace the one-hint cleanup subject. Keep actual clocks, original assertions and the shared cleanup budget. Record both completed failed A runs and six focused real-worker passes. Regenerate the delivery index after the final receipt edit. ADR: 0047, 0059, 0063, 0069, 0070 * test(web): distinguish closed browser readiness failures Read the owned debugging-port file once and retain only branded finite readiness observations. Preserve the existing deadline and polling, and keep observed child death separate without exporting private errors. Cover actual files, incomplete publication, private exceptions, deadline boundaries and forged diagnostics. Record the failed hosted attempt and successful real-browser/frontend/parser evidence without inferring its cause. ADR: 0032, 0063, 0069, 0070 * test(jobs): retain the first source-contention failure Preserve the first body or explicit cleanup exception while attempting all owned cleanup. Retain only exact-case, closed memory observations and source locations, with malformed/private diagnostic controls. Keep every runtime policy, operation budget and successful assertion unchanged. Record the complete A and failed B separately; local passes do not establish the historical cancellation cause or complete same-source qualification. ADR: 0047, 0059, 0060, 0063, 0069, 0070 * test(jobs): accept lawful finalizer retries in causal restart Reproduce the exact-one assertion overconstraint with a genuine-handler post-write conflict and fresh actual admission. Keep one logical provider effect, immutable outcome, ledger accountability and atomic business/audit proofs while permitting the runtime's existing bounded finalizer retries and repeat recovery reads. Retain only closed failure facts and preserve the first explicit failure. Record actual counter/local receipts and update the advisory selector cost; complete source-bound hosted A/B qualification remains pending. ADR: 0047, 0061, 0063, 0069, 0070 * test(web): retain closed browser failure and cleanup evidence Preserve the first browser fixture failure across actual cleanup and retain finite case-bound journey, stage and source observations in CI. The failed hosted interleaving remains unproven; no success assertion, operation budget, retry policy or execution topology changes. Record both original hosted attempts and require original evidence retention before a complete rerun replaces Actions artifacts. ADR: 0063, 0069, 0070 * docs(roadmap): close P02b-7 implementation qualification Record two complete source-matched hosted layouts with exact case, artifact, ownership and cleanup evidence. Mark the five-step packet complete while retaining maintainer review and P02b-8 exit work. Preserve the historical browser failure's evidence limits and the separate scope of real-provider and actual-browser proofs. ADR: 0063, 0069, 0070 * fix(web): preserve anonymous reads and BFF failure ownership Keep public rendering available on malformed browser state and preserve live sessions across plain API outages without relaxing refresh fences. Confine logout hints to Location, prove cookie and first-error cleanup boundaries, and reconcile test assertions and delivery claims with the actual source and evidence. ADR: 0053, 0054, 0063, 0064, 0069, 0070 I18n: auth.session.expired * docs(roadmap): record the reviewed BFF correction handoff Keep implementation state separate from live source-bound check results so recording CI evidence in the PR does not invalidate its source again. The correction source and local review receipts remain explicit. ADR: 0063, 0069, 0070 * test(web):…
cemililik
added a commit
that referenced
this pull request
Oct 27, 2026
* test(identity): isolate pure startup diagnostics from fixture ownership The source Docker guard correctly treats direct fixture references as provider dependencies. Put pure finite classification in its own type so offline canary controls remain Docker-free without weakening the guard. ADR: 0063, 0064 * docs(roadmap): close provider classification correction reviews Record independent final-source verification of finite failure codes and the fixture-free diagnostic boundary, without claiming a repair. ADR: 0063 * fix(ci): retain closed Docker startup failure families Distinguish PostgreSQL SDK milestones and fixed daemon failure families without exporting provider text or changing startup and cleanup policy. Keep malformed and unknown responses on the existing generic diagnostic. Validate seven offline cases, seven corpus/Docker-sweep cases, all 43 launcher controls and sixty combined shard/aggregate controls. ADR: 0063 * fix(ci): contain malformed diagnostic Unicode Map raw unpaired UTF-16 parser failures to the existing fixed fallback. Four independently reproduced red controls now pass within the seven-case offline suite with warnings as errors. Record first-round review and the successful isolated Linux startup without claiming hosted reproduction. ADR: 0063 * docs(roadmap): record daemon diagnosis correction reviews Record both fresh second-round approvals, independent offline checks and source-bound evidence limits before the next complete hosted A run. ADR: 0063 * fix(testing): align fixture publishers and browser readiness Publish application PostgreSQL on the identity fixtures' loopback address. Share publication checks and require real configured/runtime inspection; retain all database roles and ownership cleanup. Poll only valid empty browser target lists within the original shared five-second discovery budget. Preserve immediate invalid-response refusal, closed diagnostics and owner/liveness checks. Validate nine C# cases, seven corpus/Docker-sweep cases, 1756 guarded frontend cases, 43 launcher controls and sixty shard/aggregate controls. Record actual Linux before-red/after-green publication and role proofs. ADR: 0003, 0063, 0064 * docs(roadmap): record publication correction first reviews Retain both scoped approvals, independently executed controls and the fourth frozen source's verified auxiliary evidence without promoting its failed integration result or claiming an observed daemon version. ADR: 0063 * docs(roadmap): complete publication correction reviews Record both fresh second-round approvals and independent browser, PostgreSQL privilege and cleanup checks before complete final-source A/B qualification. Keep source-bound evidence limits explicit. ADR: 0063 * fix(identity): clarify private setup and realm proof failures Keep unsafe private-file refusals actionable without exposing their contents, and make realm drift controls reject malformed profiles and exercise username uniqueness independently. Extend owned fixture TLS validity without changing trust. Record the existing issuance choice in a Proposed ADR pending separate maintainer approval. ADR: 0004, 0064 * docs(testing): preserve provider-only fixture boundaries Describe the actual dependencies of provider-only and combined API tests without implying every Keycloak proof configures application modules. Record the first independent correction reviews and their verified fix. ADR: 0004, 0064 * docs(roadmap): complete setup correction reviews Record both independent correction reviews and their validation limits, while keeping the dedicated issuance ADR Proposed until explicit approval. ADR: 0004, 0064 * fix(identity): prove coupled development token expiration Clarify the proposed issuance ADR's authority and provider consequences without treating the review as acceptance. Preserve historical package statements through dated adjacent corrections and name the actual reconciliation owners. Validate signed access and ID expiration together, including session clamping, and plant an independent ID-expiration payload defect that passes each fresh-window check. Retain the existing runtime and case population. ADR: 0004, 0064 * docs(roadmap): record first issuance correction review Record independent proof/security and ADR/provenance approval while retaining the second review and explicit ADR acceptance gates. ADR: 0004, 0064 * docs(roadmap): complete issuance correction reviews Record the fresh second-round proof and ADR reviews and their limits. Keep formal ADR acceptance and current-head hosted qualification separate. ADR: 0004, 0064 * docs(identity): accept development issuance decision Record explicit maintainer acceptance of revised ADR-0067 and complete its authority references in Security 11, the catalogue and local guides. Preserve original phase approval and Proposed-state reviews with dated adjacent disclosures. Keep issuance configuration, API acceptance, session ownership and source-bound qualification unchanged. The preceding ordinary CI failure remains separately under investigation. ADR: 0004, 0064, 0067 * docs(roadmap): record first issuance acceptance review Record the independent authority and scope reviews of the approved ADR-0067 carrier changes, with hosted failure investigation retained. ADR: 0067 * docs(roadmap): complete issuance acceptance reviews Record both completed independent carrier reviews and the source-bound CI triage. Preserve the failed lifecycle case without inferring its missing assertion diagnostic or waiving aggregate refusal. ADR: 0067 * fix(ci): retain closed causal restart failure locations Add the one observed lifecycle test source to the finite diagnostic projection while keeping paths, stacks and provider messages private. Plant the missing location in the existing control, observe it fail, then pass all 43 offline launcher controls after adding the mapping. This does not identify or fix the previous runtime assertion failure. Success witnesses, aggregate refusal and execution budgets stay intact. ADR: 0063 * docs(roadmap): record closed diagnostic correction review Record independent privacy and counterexample reviews of the one-source mapping, including all 43 controls and the removed-mapping negative. ADR: 0063 * docs(roadmap): complete closed diagnostic correction reviews Record the fresh second-round privacy and proof checks, including the missing-map negative, all offline controls and byte-preserved execution. Keep the preceding failed lifecycle receipt unwaived. ADR: 0063 * fix(tooling): preserve safe development lifecycle operations Keep teardown usable before realm convergence, retain closed setup diagnostics, and confine private configuration and migration credentials to their owners. Add actual-launcher controls without changing accepted realm capabilities. ADR: 0004, 0053, 0054, 0064, 0067 * test(identity): strengthen convergence and CI gate counterexamples Exercise retained-account and transport boundaries independently, keep the realm gates mandatory, and project only recognized safe failure kinds. Record source-bound checks without treating repeat passes as a root cause. Guard the documented migration build before executing no-build EF. ADR: 0004, 0063, 0064, 0067 * docs(decisions): propose development identity visibility preparation Keep the demonstrated hidden-identity refusal while examining a bounded metadata-first exception. Record the independent historical-bootstrap scope prerequisite explicitly; approval and dependent runtime remain pending. ADR: 0004, 0064, 0067, 0068 * docs(identity): bound historical realm upgrade qualification Separate profile visibility preparation from fully planned detachment of only three qualified stock console edges. Retain compatible scopes, existing grants and explicit approval before dependent runtime. Record actual feasibility, completed correction reviews and the remaining proof boundary honestly. ADR: 0004, 0064, 0067, 0068 * test(tooling): declare isolated child test environments Supply the test mode required by Next's process environment types without inheriting application credentials into child fixtures. Full typecheck, lint and all 197 affected cases pass. Record the proposed warm-realm correction steps and reflow the first document review's long lines. ADR: 0064, 0067 * docs(roadmap): record final correction and proposal reviews Record both fresh review rounds for the isolated fixture typing fix and the final Proposed warm-realm correction. Preserve the approval hold and separate author checks, private feasibility and hosted qualification. ADR: 0064, 0067 * fix(identity): resolve assigned console scopes by bound ID Admin assignment endpoints return only ID and name. Read and bind the complete representation before checking protocol, while preserving all existing compatible allowance and mapper checks. Add independent graph, identity, readback and transport-cap counterexamples; 256 guarded Node cases and six workflow-gate controls pass. ADR: 0004, 0064 * docs(decisions): qualify preparation authority and console evidence Require all identity-independent refusals before preparation, preserve readable prior definitions, and specify preparation diagnostics, write accounting and exact assignment-only DELETE authority. Retain shipped catalogue status with pending extensions. Correct raw provider anchors and distinguish actual console token effects from unproved POST/runtime behavior. Record conditional maintainer acceptance authority and the separate source-bound CI failure without guessing its cause. ADR: 0004, 0064, 0067 * fix(ci): retain closed native settlement failure locations Add the existing settlement test file to the finite diagnostic source projection. Verify exact and near-match handling without exposing raw paths or errors. All 43 offline controls pass. This does not infer the lost CI assertion or alter runtime, deadlines or success witnesses. ADR: 0063 * docs(roadmap): record revised decision inspection and failure limits Record the first fresh review of the compatible-read correction and conditional decision revision. Reflow its one minor finding and clarify what the failed launcher envelope can and cannot establish. ADR: 0063, 0064, 0067 * docs(decisions): accept bounded warm-realm qualification Accept ADR-0068 under the maintainer's conditional authority after both fresh revision reviews. Disclose the two bounded phase replacements and historical remedy follow-up; reconcile authority headers, architecture, guidance and index. Preserve shipped catalogue status/counts while the expanded obligations remain explicitly pending. Acceptance authorizes the three-step implementation, without claiming automatic-path proof. ADR: 0004, 0064, 0067, 0068 * feat(identity): qualify stock console assignment normalization Bind complete historical scope, mapper and role representations before removing only three approved account-console assignments. Preserve the compatible path, keep DELETE authority opaque and requalify explicit partial-progress reruns without replay or a durable marker. Commit a credential-redacted historical fixture, fixed canonical baseline and independent real-provider reproduction. The ordinary production path performs sixteen writes, then zero after test-owned metadata setup. Automatic preparation and the remaining token/self-service proofs retain the next steps' gates. ADR: 0004, 0064, 0067, 0068 * test(identity): cover every interrupted console assignment Persist uncertain-response and cancellation controls at all three DELETE positions. Verify the exact durable prefix, no replay, last-edge handoff to compatible preservation and explicit zero-write convergence. Record the first independent Step 1 review and its verified proof gap. Runtime behavior and mutation authority remain unchanged. ADR: 0068 * docs(roadmap): close the first warm-realm correction step Record both fresh review rounds, the persisted interruption correction and its independently verified convergence. Keep preparation, complete automatic-path evidence and final hosted qualification explicitly pending. Clarify that the Node census guards files and counts, not test semantics. ADR: 0068 * feat(identity): prepare warm-realm identities before fresh planning Qualify independent prerequisites before the bounded metadata exception, then discard every provisional projection before admitting ordinary writes. Keep uncertain dispatched progress visible through failures and cleanup. Actual historical provider controls prove convergence and explicit recovery. ADR: 0068 * fix(identity): qualify visible facts before warm-realm preparation Keep already observable identity and profile refusals ahead of metadata preparation. Preserve mapper refusal codes through stock qualification and retain dispatched metadata notices through the seed and demo entry owners. Actual provider regressions and clean counterpart controls bind these fixes. ADR: 0068 * docs(roadmap): record verified warm-preparation corrections Bind the closed first-round findings and caller/mapper regressions to their committed fixes and independent checks without claiming final qualification. ADR: 0068 * docs(roadmap): close reviewed warm-realm preparation step Record both fresh review rounds, verified correction coverage and remaining complete-path qualification without treating partial evidence as release proof. ADR: 0068 * test(identity): prove historical realm credentials and API Qualify the approved warm upgrade with usable MFA, signed application reads and stored account changes. Retain source-bound entry evidence and measured case assignments while keeping incomplete public qualification explicit. ADR: 0004, 0064, 0067, 0068 * docs(roadmap): record warm qualification and Step 3 reviews Retain both historical demo outcomes and their distinct evidence limits, then record the two fresh independent review rounds before final hosted assignment qualification. No earlier failure is relabelled as success. ADR: 0063, 0068 * test(ci): bound ingress lookup and retain settlement facts Remove an unrelated unbounded informational lookup from the native ingress fixture while preserving real request settlement and all security checks. Exercise case-bound diagnostics through the pinned test adapter and retain failed qualification receipts without guessing their missing root cause. ADR: 0047, 0055, 0063, 0068 * docs(roadmap): record first CI correction review Retain independent source and actual adapter checks without treating historical green assignments as a waiver for the failed A3 receipt. ADR: 0063, 0068 * docs(roadmap): close independent CI correction reviews Record the fresh second review and clarify the informational fetch bound without claiming a universal response-body deadline or waiving A3. ADR: 0063, 0068 * test(jobs): attribute settlement loss to its execution Preserve the original held Outcome invariant without assigning later Finalize observations to it. Prove the distinction with a real locked Finalize commit, conservative renewal refusal and actual cleanup, and retain closed identity attribution across all failure boundaries. ADR: 0047, 0059 * test(jobs): join issued settlement flights before cleanup Await actual flights before positive ownership joins so an early assertion cannot retain unfinished work permanently. Preserve the first failure and qualify the cleanup path with a real held-COMMIT negative and bounded, case-bound cleanup observations. ADR: 0047, 0059 * docs(roadmap): close independent attribution reviews Record the verified cleanup correction, both fresh review rounds and the exact whitespace-only source binding. Keep current-head hosted qualification in the PR and preserve every earlier failed receipt. ADR: 0047, 0059, 0068 * test(jobs): preserve recurrence failure and cleanup observations Keep the first actual recurrence test fault through independent cleanup and retain only case-bound finite diagnostics. Real adapter controls preserve the original assertion even when cleanup also fails; production behavior and all existing waits remain unchanged. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): record recurrence diagnostic first reviews Record independent ownership and export checks against actual adapter failure, cleanup, source and archive evidence while preserving the failed hosted run. ADR: 0047, 0059, 0063, 0068 * docs(roadmap): close recurrence diagnostic review rounds Bind both fresh review rounds to actual failure preservation, positive cleanup and complete retained evidence, with hosted qualification and merge separate. ADR: 0047, 0059, 0063, 0068 * test(jobs): isolate settlement proofs from pre-ack renewal races Schedule the real renewal pacing callbacks around Outcome settlement, retain actual timer cleanup, and prove the unrelated Prepare-lock refusal against PostgreSQL. Preserve exact cases, deadlines and production policy. Retain the failed CI and partial-rerun evidence with bounded diagnostics. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record first settlement scheduling reviews ADR: 0047, 0063 * test(jobs): arm settlement deadlines before publication holds Create the actual normal deadline timer before the fixture publication hold. Preserve real durations, callback/factory ownership and exact case identities. Retain fresh clean and exclusion-control evidence, and explicitly refuse the ordering control's unconfirmed internal cleanup witness. ADR: 0047, 0059, 0060, 0063 * docs(roadmap): record independent deadline fix verification ADR: 0047, 0063 * fix(ci): audit links against immutable event commits Compare the PR event base snapshot directly with the checked-out tree instead of fetching a later shallow base branch. Exercise the actual workflow owner against real squash graphs, missing bases and broken links. Preserve strict aggregate identity refusal and record the merged implementation accurately. ADR: 0007, 0041, 0063 * docs(roadmap): record link audit correction review Record both independent first-round reviews and the actual workflow and corpus checks. Complete hosted A/B qualification remains pending on an open follow-up PR; closed-PR identity evidence is not waived. ADR: 0007, 0041, 0063 * docs(roadmap): close link audit correction reviews Record the different second review pair and independently reproduced old-owner failures. Keep complete final-source hosted qualification pending on the open follow-up PR. ADR: 0007, 0041, 0063 * fix(ci): classify Markdown audit regression tooling Register the new Python proof script in the explicit non-runtime census. The real frontend guard caught the omission; preserve rejection of unknown sources and runtime exemptions. All 1840 frontend cases pass. ADR: 0018, 0056, 0063 * docs(roadmap): record tooling census correction review Record the first fresh review pair and retained frontend evidence. Complete hosted qualification remains pending on the corrected source. ADR: 0007, 0056, 0063 * docs(roadmap): close tooling census correction reviews Record the different second review pair and retain the failed initial attempt's evidence limits. Fresh same-source A/B qualification follows. ADR: 0007, 0056, 0063 * test(jobs): preserve native wait failure attribution Retain the first body or explicit runtime-join exception instead of masking it in finally. Export only case-bound closed boundary and owner task observations so startup and cleanup cancellations can be separated. Validate clean and three planted fault paths with actual native work, including the old test's masking counterexample. The earlier hosted cancellation remains unexplained; no timeout or runtime policy changes. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): record native wait diagnostic review Preserve original proof receipts and disclose the corrected container count against retained raw cleanup evidence. Record source binding and the first independent review round without asserting a hosted cause. ADR: 0007, 0047, 0060, 0063 * docs(roadmap): close native wait diagnostic reviews Record the second fresh independent pair and exact retained evidence verification. Keep hosted cancellation and helper scheduling causes unproven until source-bound qualification supplies actual evidence. ADR: 0007, 0047, 0060, 0063 * test(jobs): wait for actual cleanup before fixture hints The native execution fixtures may consume their sole extra hint while an earlier empty recovery still owns private cleanup. Wait for actual native work and local identity release before issuing that same hint. Reproduce premature consumption with real SQL/native workers and an owned System timer cleanup barrier. Preserve all existing budgets, production policy and original case identities; add one regression fact. ADR: 0047, 0059, 0060, 0063 * test(jobs): retain cancellation before fixture hint emission Restore the original final cancellation check after readiness waits. Record the first independent review round and fresh exact-source clean and planted-failure evidence without claiming atomic cancellation or a cause for the earlier hosted failure. ADR: 0007, 0047, 0059, 0060, 0063 * docs(roadmap): close fixture handoff correction reviews Record the second fresh pair and exact proof/source verification. Preserve the unknown hosted cause and require complete final-source A/B qualification before the follow-up draft is ready for review. ADR: 0007, 0047, 0059, 0060, 0063 * fix(ci): bound browser dependency mirror waits Let the hosted browser installer leave stalled APT mirrors while retaining its complete dependency set, verification and existing time budgets. Read back effective root settings and remove only the exclusive fragment. Exercise the actual workflow shell across success and failure paths, and retain the failed prior attempts as unqualified observations. ADR: 0007, 0056, 0063 * test(ci): exercise partial browser setup writes Make the write-failure control leave a genuinely incomplete fragment before refusing, then verify that the actual workflow shell removes it. Record the first independent review pair and the failed A receipt. ADR: 0007, 0056, 0063 * docs(ci): record browser acquisition review closeout Record the second fresh independent review pair and its extracted-shell checks. Keep the prior failed attempts separate from the complete hosted A/B qualification still required on the resulting source. ADR: 0007, 0056, 0063 * fix(ci): reserve bounded public demo completion time The complete B assignment reaches the last public audit before its sixteen-minute outer allowance cancels it. Allocate seventeen minutes inside the same twenty-minute job, twelve-minute proof and thirty-second native cleanup limits. Bound the remaining cleanup/receipt steps and restore NuGet without a save post-hook to retain a three-minute tail. Exercise actual deadline and tail shells, preserving forced failures. Keep failed partial evidence distinct from complete qualification. ADR: 0007, 0056, 0063 * docs(roadmap): record first outer-budget correction reviews Record two independent approvals, their actual-shell controls and historical evidence checks without claiming new hosted qualification. ADR: 0056, 0063 * docs(roadmap): close outer-budget correction reviews Record fresh second-round approvals and independent historical evidence revalidation. Keep complete final-source hosted A/B as a separate gate. ADR: 0056, 0063 * fix(ci): join maintenance in OpenAPI control repositories The hosted snapshot control fails strict temporary cleanup while its Git object directory changes. Keep maintenance in the foreground only in the synthetic repository so the waited commit also waits its actual work. Prove nested commit-graph completion with a real Git trace under a private configuration that otherwise requests background maintenance. Retain strict cleanup and all OpenAPI comparison and admission rules. The observed mechanism is not a captured trace of the hosted failure. ADR: 0007, 0052 * test(ci): require successful owned Git maintenance proof Reject a planted graph write failure even when a prior graph exists. Correct pinned source anchors using physical raw-file lines and record both first-round reviews and their verified fixes. ADR: 0007, 0052 * docs(roadmap): close Git maintenance fixture reviews Record two fresh second-round approvals and the independently repeated clean, detached and planted-failure controls with their runtime limits. ADR: 0007, 0052 * fix(ci): retain closed producer gate refusal diagnostics Both aggregate jobs reject a gate but discard which source-owned producer and step failed validation. Emit finite state words before the unchanged refusal so later API success cannot obscure the original observation. Never export arbitrary provider values or retry inconsistent evidence. Keep the unsuccessful historical attempt separate from new qualification. ADR: 0007, 0063 * docs(roadmap): record gate diagnostic review evidence Retain independent closed-output checks and historical evidence limits. Separate complete public component observations from failed whole-run qualification and final-source A/B still required. ADR: 0007, 0056, 0063 * docs(roadmap): close producer gate diagnostic reviews Record fresh differential and mutant controls, independent component archive checks and the unchanged final-source whole-workflow gate. ADR: 0007, 0063 * fix(ci): own Outbox startup and attribute producer refusal Disable the unowned telemetry exporter in the Outbox host fixture and join actual startup before disposal even when its assertion wait expires. Retain only finite startup facts from the real test adapter output. Report closed producer states before the unchanged aggregate refusal. Keep unknown hosted causes distinct from local counterfactual evidence. ADR: 0007, 0044, 0046, 0063 * docs(roadmap): record Outbox correction first review Record independent code, protocol and retained-evidence validation while preserving unknown hosted causes and complete final-source A/B gates. ADR: 0063 * docs(roadmap): record independent Outbox correction approval Record the second fresh review pair and narrow container identity prose to the exact retained evidence. Keep full final-source A/B pending. ADR: 0063 * fix(ci): bound pending producer metadata acquisition Read fresh complete attempt snapshots under one short acquisition budget before applying the unchanged successful-producer witness. Refuse terminal, malformed and identity-invalid evidence immediately, including when an earlier owner is pending. Never combine snapshots. Keep the five-minute aggregate ceiling and upload reserve unchanged. ADR: 0063 * fix(ci): validate creation times before metadata settlement Reject malformed or reversed creation timestamps before a pending owner can cause another read. Record independent repros and corrected first-round review validation. ADR: 0063 * docs(roadmap): record independent metadata acquisition reviews Record fresh second-round deadline and malformed-evidence controls, with retained failed-attempt and pending hosted qualification limits. ADR: 0063 * docs(decisions): accept ADR-0069 phase documents and delivery logs Phase 02b's phase document reached 18,884 lines, 92% of them dated packet records, and Phase 02d followed the same shape; status was narrated in five places and no check covered link fragments. The maintainer accepts keeping the plan and the record in separate files, status in one place, and two CI guards that hold both, after one review round whose findings this text resolves. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): split Phase 02b and 02d records into delivery logs Moves every dated packet record out of the two phase documents into sibling append-only delivery logs, grouped by packet in source order, with the superseded Status blocks kept verbatim in each log's archive. Each heading's anchor was recomputed in its new file and checked against its original one, duplicates included, and every original line survives the split; only heading levels and link targets around the text change. 606 inbound links are retargeted with their text unchanged, so the Accepted ADRs touched owe no amendment. Phase 04's one dated plan heading keeps its date in its acceptance line and its six links follow it. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: hold packet status once and record the delivery log rule Packet state was narrated in the phase Status block, the packet table, the Completion Criteria preamble, the roadmap index, CLAUDE.md and the repository README, and every step edited all of them. Each now points at the phase document, whose bounded Status block owns packet state; CLAUDE.md drops from 856 to 405 lines. The rule itself lands where readers look for it: Roadmap § Phase Structure and § Decision Timing, Documentation Standards, the glossary, CLAUDE.md and the two skills that write roadmap records. ADR-0069's dated amendment names the README as a sixth carrier and fixes how its budgets are counted. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * ci(meta): guard link fragments and roadmap structure The link audit strips fragments and reads only changed files, so a moved heading broke links silently, and nothing stopped a phase document from growing records again. The meta job now resolves every fragment link in the tree against GitHub's heading slugs and holds phase documents, delivery logs, the roadmap index, CLAUDE.md and the README to ADR-0069; `make lint` runs both through `lint-docs`. Each guard ships planted-violation controls, the source census classifies the four new tooling files, and the link audit now skips code spans as it already skipped fenced samples. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): amend ADR-0069 with generated delivery log indexes A delivery log is too large to read whole, so an agent needing one entry has no map of the rest. The amendment opens each log with an index generated from its headings and checked in CI, listing lengths rather than line numbers and no inferred record kinds, and states that the index is navigation, not a record. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(roadmap): open each delivery log with a generated index The Phase 02b log is about 305,000 tokens, so an agent needing one entry had no map of the rest. Each log now opens with an index of its packet sections, entries and dated sub-entries with their lengths, generated by scripts/delivery-log-index.py (`make docs-index`) and refused when stale by the meta job and `make lint-docs`. The fragment audit covers every row's anchor; the logs, roadmap index, Documentation Standards, glossary, CLAUDE.md and the two record-writing skills say to read the index, not the log. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): install Chromium without the APT mirror The public demo's five-minute browser step failed four of today's twelve attempts while Playwright's --with-deps installer downloaded fonts from the runner's slow APT mirror; the 15-second acquire timeouts cannot end a slow transfer that is still moving. The hosted image already carries every Chromium library, and no public-demo check depends on system fonts, so the step installs only the pinned Chromium build and drops the temporary APT fragment with it. The workflow test executes the actual step against stubs and fails on any sudo or APT call; against the previous workflow it fails. The delivery log records run 39805658821, the still-unexplained native fixture hang, and the maintainer's single-assignment qualification decision for PR #35. ADR: 0056, 0063 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(decisions): propose owned tenant BFF sessions Define session custody, lifecycle, admission and evidence before the first BFF credential owner is implemented. Keep G13 open until the maintainer accepts the proposal and five-step delivery package. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): resolve BFF session proposal review findings Separate local logout guarantees from provider navigation, preserve logout at full sign-in capacity and require the actual warm-realm BFF chain. Record the first independent proposal review and its verified corrections. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): finish the BFF decision pass and prior closeout Record the second independent proposal review, make optional BFF activation explicit and distinguish public requests from OIDC transactions. Verify PR 35's merged source and successful CI without inferring historical causes. Keep the new session ADR Proposed until maintainer approval. ADR: 0004, 0053, 0054, 0064, 0067, 0069 * docs(decisions): revise BFF ownership after maintainer review Compare maintained RP alternatives and select openid-client without a credential-bearing cookie or competing session framework. Define provider event persistence, source and subject admission, effective expiry and browser transaction fencing before requesting renewed approval. ADR: 0004, 0035, 0036, 0053, 0054, 0064, 0067, 0069 * docs(decisions): retain logout owners in subject admission Keep logout-return entries in the subject budget until return expiry or consumption and actual work settlement. Distinguish AccountSite actor and scope evidence from independently validated OIDC subject continuity. Record the first revised proposal review and its verified corrections. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(roadmap): complete revised BFF proposal review Record the second fresh independent review pair and final source clarifications. Preserve API-owned resolved organization scope separately from optional protected claims and retain approval-pending status. ADR: 0035, 0053, 0054, 0064, 0067, 0069 * docs(decisions): accept native tenant BFF session ownership Record maintainer approval of ADR-0070 and its five-step delivery plan before dependent implementation. Reconcile custody, CSRF, event evidence and deployment rules, append bounded prior-decision disclosures, and register the four proof obligations without claiming runtime delivery. ADR: 0035, 0053, 0054, 0064, 0067, 0069, 0070 * feat(identity): add inactive BFF RP and provider event policy Keep credentials behind a server-only pinned RP with fixed-purpose bounded transport and signature-enabled grants. Qualify development event storage before metadata preparation, preserve existing event policy and verify actual fresh/warm persistence without activating browser sign-in. Targeted checks pass; the delivery record explicitly tracks the remaining historical count reruns and added real-body cancellation proof before Step 1 closure. Production route and configuration admission stay closed. ADR: 0004, 0035, 0053, 0054, 0064, 0067, 0068, 0070 * fix(identity): qualify logout and event response boundaries Keep the supported loopback logout path inside the closed provider boundary and refuse known event-expanded realm overflows before any preparation write. ADR: 0068, 0070 * fix(identity): preserve provider defaults and closed network reasons Retain every pinned default-saved event and distinguish library-wrapped network uncertainty from malformed responses. Close both Step 1 review rounds with independent omission controls and real provider evidence. ADR: 0068, 0070 * feat(identity): own bounded native BFF session lifecycles Keep credentials and actual operation ownership in one native process across browser transactions, refresh, replacement and logout. Exercise capacity and revocation races before wiring any production route or activation. ADR: 0035, 0053, 0054, 0070 * fix(identity): preserve current callback visitor attribution Use the callback's verified visitor for AccountSite without moving the original pending-source credit or consuming state on a malformed source. ADR: 0064, 0070 * docs(roadmap): close native BFF ownership reviews Record both fresh review approvals and the tested source before starting the closed HTTP and SDK slice; retain later activation and runtime proof owners. ADR: 0069, 0070 * feat(web): implement closed BFF HTTP and request projections Keep production activation closed while adding native response-owned auth protocol, bounded input, host cookies, CSRF and safe read-only RSC sessions. Use the exact authenticated SDK for the native AccountSite witness. Qualify the inactive path through actual native HTTPS and production Next middleware/RSC bundles. Real provider/API and browser proof remains Step 5. ADR: 0053, 0054, 0070 * fix(web): retain native RSC activity through Next middleware Capture only the closed activity scalar before Next strips Flight headers. Keep response-owned refresh and idle mutation separate from RSC reads. Exercise actual production Next with expired access and passive controls; a copied dropped-handoff mutant must fail the same RSC assertions. ADR: 0053, 0054, 0070 * docs(roadmap): close P02b-7 HTTP protocol review rounds Record both fresh second-round approvals and retain the distinction between native Next proof and the remaining provider/browser gates. ADR: 0069, 0070 * feat(web): activate optional tenant BFF and localized session UI Activate native session and request owners atomically after private configuration agreement. Resolve live host/locale admission before session actions, and guard the read-only Studio/Portal shells. Add complete sign-in/recovery copy, effective-expiry warning, real extension and local-first logout UI. Keep browser transport closed to one same-origin action and veil protected history before restoration. Preserve actual public admission, browser fallback and HMR evidence without bypassing the new shell guard. Validate 2,081 guarded frontend cases, production Next builds, the PostgreSQL admission lifecycle and five corpus controls. Real provider, browser history and final-source hosted proof remain Step 5. ADR: 0053, 0054, 0069, 0070 I18n: auth * fix(web): close development auth traces and add skip links Suppress Next request URL tracing before the native process imports Next; retain an actual development canary and a guard-removal counter-control. Add localized keyboard skip links to auth documents and protected shells. Bound frontend file concurrency while retaining complete guarded discovery. ADR: 0053, 0054, 0069, 0070 * fix(web): preserve focus through session recovery transitions Announce unchanged or maximum extension and recover focus after focused controls expire, while preserving external focus and passive warnings. Record both independent Step 4 review rounds and begin lifecycle proof. ADR: 0069, 0070 * test(identity): prove native BFF lifecycle and browser isolation Exercise the reconciled warm provider through the native BFF and real application-role API, with separate actual HTTPS cookie/history proof and an enabled no-network startup control. Keep private IPC and joined fixture cleanup outside retained artifacts. Correct the sign-in document's referrer policy so browser form Origin survives exact CSRF admission. Require fresh native/SDK fixture builds and retain complete local discovery and advisory timing evidence. Hosted qualification, demo and both review rounds remain open. ADR: 0070, 0064, 0063, 0053, 0054 * fix(identity): join BFF proof owners before reporting success Close the private lifetime pipe before joining fixture processes and independently require empty owned temporary roots. Reject nonzero native shutdown and forced process-group cleanup instead of publishing success. Own the browser synchronously before CDP connection to fence late launch. Prove early parent disposal and the exact shutdown counter alongside the real warm-provider/API chain and separate HTTPS browser history control. Record stopped-provider public-demo evidence and complete local controls. ADR: 0056, 0063, 0070 * fix(identity): observe parent EOF throughout BFF acquisition Keep bounded private input flowing while native compilation and build are awaited, so an early parent close reaches the fixture owner before readiness. Prove the held-build abort joins and removes its private tree. Require zero native exit and unforced settlement in every protocol and UI proof. Add the exact shutdown counter and retain the real six-case BFF and 2090-case frontend results with both review confirmations. ADR: 0056, 0063, 0069, 0070 * test(web): expect closed shells when tenant sign-in is disabled The standalone ingress proof still expected pre-BFF placeholders after the accepted activation changed disabled protected shells to 503. Require that unavailable response without cookies, forms or protected content while preserving exact bootstrap, method and TLS controls. Record the hosted failure honestly and retain the fresh production proof, 19 cleanup controls and both focused source confirmations. ADR: 0053, 0056, 0070 * test(ci): isolate held-constructor cancellation and copied ingress Copy the new pure ingress dependency into the existing local launcher fixture. Establish real constructor entry before the held-constructor test requests stop or expires its SQL lease, while retaining real timers and shared cleanup bounds. Keep failure-only closed handoff observations for future source diagnosis. Record the complete failed first A attempt, focused independent reviews and local worker/parser/aggregate evidence without claiming its cause reproduced. Refresh overview pointers for optional native tenant sign-in. ADR: 0047, 0059, 0063, 0070 * test(jobs): preserve the handoff control before constructor entry Compose the existing real renewal pacing and held-disposal observers so safe preconstructor renewal refusal cannot replace the one-hint cleanup subject. Keep actual clocks, original assertions and the shared cleanup budget. Record both completed failed A runs and six focused real-worker passes. Regenerate the delivery index after the final receipt edit. ADR: 0047, 0059, 0063, 0069, 0070 * test(web): distinguish closed browser readiness failures Read the owned debugging-port file once and retain only branded finite readiness observations. Preserve the existing deadline and polling, and keep observed child death separate without exporting private errors. Cover actual files, incomplete publication, private exceptions, deadline boundaries and forged diagnostics. Record the failed hosted attempt and successful real-browser/frontend/parser evidence without inferring its cause. ADR: 0032, 0063, 0069, 0070 * test(jobs): retain the first source-contention failure Preserve the first body or explicit cleanup exception while attempting all owned cleanup. Retain only exact-case, closed memory observations and source locations, with malformed/private diagnostic controls. Keep every runtime policy, operation budget and successful assertion unchanged. Record the complete A and failed B separately; local passes do not establish the historical cancellation cause or complete same-source qualification. ADR: 0047, 0059, 0060, 0063, 0069, 0070 * test(jobs): accept lawful finalizer retries in causal restart Reproduce the exact-one assertion overconstraint with a genuine-handler post-write conflict and fresh actual admission. Keep one logical provider effect, immutable outcome, ledger accountability and atomic business/audit proofs while permitting the runtime's existing bounded finalizer retries and repeat recovery reads. Retain only closed failure facts and preserve the first explicit failure. Record actual counter/local receipts and update the advisory selector cost; complete source-bound hosted A/B qualification remains pending. ADR: 0047, 0061, 0063, 0069, 0070 * test(web): retain closed browser failure and cleanup evidence Preserve the first browser fixture failure across actual cleanup and retain finite case-bound journey, stage and source observations in CI. The failed hosted interleaving remains unproven; no success assertion, operation budget, retry policy or execution topology changes. Record both original hosted attempts and require original evidence retention before a complete rerun replaces Actions artifacts. ADR: 0063, 0069, 0070 * docs(roadmap): close P02b-7 implementation qualification Record two complete source-matched hosted layouts with exact case, artifact, ownership and cleanup evidence. Mark the five-step packet complete while retaining maintainer review and P02b-8 exit work. Preserve the historical browser failure's evidence limits and the separate scope of real-provider and actual-browser proofs. ADR: 0063, 0069, 0070 * fix(web): preserve anonymous reads and BFF failure ownership Keep public rendering available on malformed browser state and preserve live sessions across plain API outages without relaxing refresh fences. Confine logout hints to Location, prove cookie and first-error cleanup boundaries, and reconcile test assertions and delivery claims with the actual source and evidence. ADR: 0053, 0054, 0063, 0064, 0069, 0070 I18n: auth.session.expired * docs(roadmap): record the reviewed BFF correction handoff Keep implementation state separate from live source-bound check results so recording CI evidence in the PR does not invalidate its source again. The correction source and local review receipts remain explicit. ADR: 0063, 0069, 0070 * test(web): retain startup evidence until child absence Do not remove either counter tree when actual child absence cannot be confirmed. Keep failure evidence and the original startup error intact. The focused independent confirmation and actual child controls pass. ADR: 0063, 0069, 0070 * test(jobs): distinguish recovery renewal from initial timer setup Preserve the first failed recovery proof across actual cleanup and retain closed failure stages without exporting private diagnostic content. The hosted failure remains unexplained; keep every runtime bound and exact outcome assertion while requiring a real later timer rearm. ADR: 0047, 0063, 0069, 0070 * docs(roadmap): refresh the recovery follow-up index Regenerate the delivery index after the final focused verification receipt. ADR: 0069 * fix(ci): classify private fixture image preparation failures Retain only finite component and failure observations for repeated opaque pre-test image-pull refusals. Keep the command's default behavior and all budgets while preserving first-error ownership through private capture cleanup. No retry or registry policy changes are introduced. ADR: 0062, 0063, 0069 * docs(auth): propose uncertain AccountSite refusal policy Separate API authentication uncertainty from proven identity refusal before changing live session custody. Preserve the qualified correction source in a durable receipt and record the remaining correction and approval gates. ADR: 0064, 0069, 0070 * docs(auth): accept explicit AccountSite refusal decision Record the maintainer-authorized decision after verified review corrections. Preserve accepted history and separate local session custody from checked API authority, including callback statuses and conservative masked refusals. ADR: 0064, 0070, 0071 * fix(auth): bind closed BFF boundaries and lifecycle proofs Close independent HTTP and custody regression gaps without expanding the approved surface. Stabilize projected expiry and apply compatible security patches while preserving native ownership and actual-settlement evidence. ADR: 0053, 0054, 0070 I18n: unchanged * test(auth): close configuration and scoped dependency escapes Bind configuration references to the checked export and test quoted package keys so independently planted bypasses cannot evade the new source guards. ADR: 0070 * fix(auth): retain ordinary sessions on uncertain API refusal An API 401 cannot distinguish invalid from undecidable credentials. Preserve ordinary-read ownership without idle touch while withholding checked content; keep callback and refreshed revision publication fail closed. ADR: 0064, 0070, 0071 * test(auth): pin the checked configuration plugin binding Keep the fixed configuration export from delegating to an uninspected local wrapper while preserving the clean pinned Next integration. ADR: 0070 * fix(auth): preserve accessible recovery and proof observations Keep safe recovery available while withholding unverified content. Exercise actual child-output and cookie-header observations, and retain current localized fixture views without claiming a full provider browser journey. ADR: 0027, 0070 I18n: en/tr auth catalogues updated * test(auth): bind provider and CI proof failure boundaries Make original cookie revocation, opposite-tenant refusal and closed successful causal observations visible through their actual owners. Plant isolated CI violations while preserving existing budgets and production job semantics. ADR: 0047, 0063, 0070, 0071 * fix(auth): reconcile current session proof carriers Keep current architecture, standards and future acceptance owners aligned with the delivered native boundary. Carry the closed privacy stage through both proof readers without changing authority, cleanup or deployment support. ADR: 0069, 0070, 0071 * docs(auth): distinguish verified callback authority Preserve the native host rule while excluding unverified browser selectors, and record the first correction review and source-bound qualification gates. ADR: 0063, 0070, 0071 * test(auth): observe provider time and actual HTML refusal Use fresh fixture-owned issuance time instead of assuming an optional response header. Keep the real browser negative aligned with HTML while independently preserving publication, audit and reader-isolation checks. ADR: 0070, 0071 * test(auth): bind authenticated SDK result boundaries Replace a vacuous ownership comparison and isolate cancellation, body failure and Problem Details mapping in the authenticated wrapper without duplicating the shared public response policy or changing runtime behavior. ADR: 0064, 0070, 0071 * docs(auth): record SDK counterfactual review evidence Separate the verified wrapper coverage gap from an unreproduced signal claim, and retain the complete current frontend census without overstating scope. ADR: 0064, 0069, 0070, 0071 * docs(auth): hand off the reviewed correction source Close the completed local review gates while keeping exact-source hosted qualification, durable receipt and maintainer merge as explicit remaining work. ADR: 0063, 0069, 0070, 0071 * test(jobs): retain closed recurrence wait observations Keep the original timeout and ownership failure visible while retaining bounded pre-stop progress facts for the unexplained hosted failure. ADR: 0047, 0063, 0069 * test(ci): bind both recurrence observation cases independently Prevent the finite diagnostic control from shrinking with its production allowlist and preserve the failed qualification's exact evidence scope. ADR: 0063, 0069 * test(auth): preserve closed browser launch observations Distinguish launch phases and retain branded readiness failures without changing browser execution, deadlines or actual cleanup requirements. ADR: 0063, 0069, 0070 * test(auth): report browser liveness without inferring exit Keep the readiness diagnostic faithful for failed spawns as well as observed exits and preserve the completed first-round review evidence. ADR: 0063, 0069, 0070 * test(jobs): isolate causal stop after actual provider acceptance Use the qualified real-timer pacing owner to exclude an unrelated legal pre-ACK refusal while retaining original deadlines, runtime policy and all causal provider, cleanup and durable-state assertions. ADR: 0047, 0063, 0069 * docs(roadmap): record final BFF correction qualification Bind the completed reviews and independently verified A/B evidence to its exact implementation source while keeping the closeout documentation-only. ADR: 0063, 0069, 0070, 0071 * fix(auth): close review proof and recovery gaps Isolate security controls from unrelated refusals and keep recovery usable without granting failed checks authority. Bind native credential flows to the fixed port, bound diagnostic child output and preserve source-bound qualification and explicit maintainer acceptance evidence. ADR: 0009, 0047, 0063, 0069, 0070, 0071 I18n: auth.session.unavailable_title, auth.session.unavailable * docs(roadmap): retain first correction review receipts Bind the independent source-review conclusions and their executed checks to the committed correction without presenting local results as hosted qualification. ADR: 0069, 0070, 0071 * docs(roadmap): record independent correction recheck Preserve the second fresh review scope and independently executed checks, then freeze the corrected source for complete hosted qualification. ADR: 0063, 0069, 0070, 0071 * test(auth): delimit opaque observer child arguments A valid opaque cookie can begin with a dash. Keep it positional after the Node option terminator and force that boundary in both output observers so the controls reach the intended late-cookie assertion. ADR: 0063, 0069, 0070 * docs(roadmap): record observer argument review evidence Keep the exact narrow review and independent argv/scanner checks distinct from the failed hosted assignment and pending final qualification. ADR: 0063, 0069, 0070 * docs(roadmap): freeze reviewed observer correction Record the second independent observer review and preserve failed-source limits before beginning complete qualification of the corrected source. ADR: 0063, 0069, 0070 * docs(roadmap): record reviewed BFF correction qualification Bind complete same-source A/B and retained independent evidence to the reviewed implementation while keeping this closeout documentation-only. ADR: 0063, 0069, 0070, 0071 * docs(roadmap): close merged tenant BFF delivery Record PR #36's verified merge and identical tested source tree. Close P02b-7 while keeping P02b-8's decisions, erasure inventory and phase exit enforcement explicitly pending. ADR: 0069, 0070, 0071 * docs(roadmap): propose phase exit enforcement decisions Ground G16 and G18 in the delivered analyzer, storage and CI boundaries before implementation. Record the additive ADR-0032 proposal, complete erasure-inventory scope and four reviewed implementation steps without changing runtime or accepting either gate. ADR: 0032, 0046, 0047, 0057, 0069, 0070 * docs(roadmap): refine phase exit proposal after review Preserve Phase 03's existing erasure deliverables and make the proposed exception and constant-name boundaries unambiguous before acceptance. Record both independent first-round reviews and the baseline checks. ADR: 0032, 0046, 0047, 0069 * docs(roadmap): require canonical inventory before gate acceptance Install the G18 carrier and its existing authority handoffs before marking either gate accepted or starting analyzer work. Keep Step 2 focused on independent storage verification and drift controls. ADR: 0032, 0046, 0047, 0069 * docs(roadmap): record phase exit proposal review verification Retain both independent correction rechecks and the pending maintainer decision without implying analyzer delivery or phase-exit qualification. ADR: 0032, 0046, 0047, 0069 * docs(decisions): accept phase exit enforcement package Record the approved G16 diagnostic and G18 canonical inventory before implementation. Preserve current erasure authorities and Phase 03/11 ownership while registering the pending proof obligations. ADR: 0032, 0046, 0047, 0057, 0069, 0070 * feat(kernel): guard sensitive exception messages at compile time Check bounded sensitive-name expressions across production C# projects using the shared runtime matcher, while preserving LS0001 scope and the approved Warning posture. Exercise actual compiler imports and isolated CI builds alongside source propagation and clean-sample controls. ADR: 0032, 0069 Module: Tenancy, Identity, Customization, Audit, Education, Content, Media * fix(kernel): analyze dynamically bound exception constructors Keep known string arguments under the approved guard when another constructor argument is dynamic. Retain evaluated wiring controls and remove the superseded XML parser that tested only itself. ADR: 0032, 0069 * docs(roadmap): close first phase exit implementation step Retain both fresh independent second-round reviews and their execution limits before beginning inventory drift enforcement. ADR: 0032, 0069 * test(kernel): verify durable asynchronous inventory coverage Bind the canonical inventory to actual compiled migration operations so new storage and missing classifications cannot silently escape the erasure review. Keep structural coverage separate from deletion authority and live-schema proof. ADR: 0046, 0047, 0057, 0069 * fix(kernel): refuse unsupported inventory table creation Keep new durable copies from silently bypassing the migration census through SELECT INTO or fragmented dynamic SQL while preserving the pinned installer. ADR: 0046, 0047, 0057, 0069 * fix(kernel): close inventory schema resolution bypasses Refuse unsupported schema resolution and dynamic commands so conditional names and qualified renames cannot masquerade as inventoried public tables. ADR: 0046, 0047, 0057, 0069 * docs(roadmap): close asynchronous inventory verification Record both independent review rounds and their verified corrections before continuing phase-exit carrier reconciliation. ADR: 0069 * fix(kernel): reconcile delivered phase contract carriers Keep the plan, standards, workflow examples and source explanations aligned with delivered authentication and asynchronous ownership without granting new authority or disguising future permission and erasure prerequisites. ADR: 0032, 0033, 0044, 0046, 0047, 0064, 0065, 0069, 0070, 0071 * docs(roadmap): record carrier reconciliation review Keep independent source and corpus verification distinct from final-source runtime qualification before opening the second review round. ADR: 0069 * docs(roadmap): close phase carrier reconciliation Record both fresh approvals and keep final-source runtime qualification as an explicit remaining exit obligation. ADR: 0069 * test(kernel): bind phase exit criteria to actual proof owners Make delivery reconciliation counts explicit and map every exit obligation to its real owner before complete source-bound qualification. Preserve existing audit composition and future tenant-status decision authority. ADR: 0033, 0044, 0046, 0047, 0057, 0069 * docs(roadmap): record exit source review boundary Keep independent source approval separate from still-pending complete hosted qualification at the frozen code and test source. ADR: 0069 * docs(roadmap): record the second exit source review Keep source approval and the retained A evidence separate from the pending B and current-head qualification so no partial proof implies phase exit. ADR: 0032, 0063, 0069 * docs(roadmap): close source-bound Phase 02b exit qualification Preserve exact-source A and B evidence and the completed review trail while keeping final PR-head checks and maintainer merge as separate gates. Record the live protection and each future phase's actual owner. ADR: 0032, 0063, 0069 * fix(kernel): close exit guard and evidence review gaps Ensure the approved exit guards cannot silently miss build suppression or unclassified storage, and bind audit cleanup proof to the production capture. Reconcile the surrounding ownership and privacy claims with current authority. ADR: 0032, 0044, 0046, 0047, 0057, 0069 Module: Audit, Customization, Education, Tenancy * test(kernel): reject opaque SQL routine storage creation Refuse quoted routine bodies that can hide dynamic storage DDL from the bounded inventory reader, and prove their actual effect on owned PostgreSQL. Align the remaining realm-activation and job-qualification carrier comments. ADR: 0046, 0047, 0057, 0069 * test(kernel): validate complete SQL routine declaration boundaries Keep default dollar strings and post-body options from hiding an opaque body or unresolved search path, while preserving the pinned migration headers. ADR: 0046, 0047, 0057 * docs(roadmap): record verified exit correction review boundaries Keep source review, local execution and pending hosted qualification distinct, including the accepted scope limits and independently verified dispositions. ADR: 0032, 0046, 0047, 0057, 0069 * test(ci): include the new PostgreSQL fixture in the plan witness Reconcile the declared fixture population with the actual new test class so complete-plan validation remains strict before hosted qualification. ADR: 0063, 0069 * test(kernel): bind retry fairness and SQL literal proof to durable facts Distinguish body entry from committed job effects through a controlled rollback, and keep escaped SQL literals from hiding durable storage declarations. ADR: 0046, 0047, 0057, 0063, 0069 * docs(roadmap): record the reviewed CI correction source Bind both fresh second-round reviews and the independently rebuilt census to an exact source while leaving complete hosted qualification pending. ADR: 0047, 0063, 0069 * test(kernel): qualify completion after acknowledged skipped wakeups Separate native completion proof from accepted bridge repair timing while retaining the real ACK, due, generation and cleanup fences. Prove a locked retry generation with durable business and audit outcomes and a wrong- generation counterfactual, without changing production behavior or deadlines. ADR: 0047, 0059, 0063, 0069 * docs(roadmap): freeze the reviewed native completion correction Bind both fresh second-round reviews and post-hook execution to the exact committed test correction before complete hosted qualification. ADR: 0047, 0063, 0069 * test(frontend): own Playwright artifacts through fixture cleanup Keep CDP artifacts beneath the existing private fixture root so SDK cleanup failures cannot leave an unowned sibling behind a successful close. Preserve joined shutdown and the parent empty-root guard; validate with the real browser journey and an isolated SDK refusal counterexample. ADR: 0063, 0069, 0070 * docs(roadmap): freeze reviewed fixture ownership and carrier fixes Record both fresh source reviews and restore accurate module terminology and ADR navigation before qualifying the final correction source. ADR: 0032, 0047, 0063, 0069, 0070 * docs(roadmap): close qualified PR corrections and exit evidence Bind the complete corrected-source A/B proof and independent audits to exact source, cases, artifacts and cleanup. Keep current documentation-head checks, maintainer review and merge as separate gates. ADR: 0032, 0063, 0069 * docs(roadmap): close merged phase 02b and point to phase 03 Record the actual PR merge and its equality to the qualified source so phase completion follows verified delivery. Preserve dated evidence and point the entry documents to the next phase without starting its work. ADR: 0063, 0069 * docs: prepare phase 03 identity implementation plan Make identity delivery start from explicit first-writer gates and complete proof ownership, preserving the accepted auth, isolation and audit boundaries. Reconcile scope and dependency examples so preparation cannot be mistaken for runtime authorization. ADR: 0017, 0036, 0044, 0064, 0069, 0070 Module: Identity, Tenancy, Customization, Audit * docs(decisions): propose identity and membership foundation Break the first-login actor cycle through an explicit application identity contract, and settle shared membership and privacy invariants before their first writers. Keep both decisions Proposed and all runtime gates closed pending maintainer approval; separate later packet responsibilities. ADR: 0017, 0036, 0044, 0064, 0069, 0070 Module: Identity, Tenancy, Audit * docs(decisions): close first identity proposal review findings Make tenantless pre-session bootstrap and organization learner grants explicit before approval. Separate insertion-time audit proof from retained references and choose a closure guard compatible with the read policy. Record the independent review scope and pending implementation boundary. ADR: 0064, 0069, 0070 Module: Identity, Audit * docs(decisions): define global audit outcomes and fresh lock reads Preserve MUST reconciliation for failed or uncertain identity creation and make its subject attribution and cleanup explicit. Require a fresh read committed snapshot after admission locks so the promised database guards cannot accept stale closure or administrator state. ADR: 0033, 0040, 0044, 0069 Module: Identity, Audit * docs(decisions): preserve canonical audit timestamp reconciliation Keep the existing fresh-timestamp indeterminate evidence for the new global class rather than introducing a separate key policy. Distinguish durable failure evidence from proof of a committed identity creation. ADR: 0033, 0044, 0069 Module: Identity, Audit * docs(roadmap): record reviewed identity proposal readiness Keep approval and runtime boundaries visible after both independent review roun…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--with-depsonly added fonts through a slow APT mirror that repeatedly exhausted the five-minute step. Allocate 17 minutes to outer setup/proof and reserve three minutes for bounded tail steps; retain the 20-minute job, 12-minute proof and 30-second native cleanup ceilings.Tests
sudo/APT call fails the browser step, and the previous workflow fails them. Full frontend validation passes 1,852 cases in two packages with zero skips/todos; typecheck, lint and scoped formatting pass.395d078ccompletes two fresh independent review rounds; the maintainer approved the browser-installer change without them. Offline shell checks establish command arguments and failure propagation, not hosted signal timing or fit.Head:
395d078cd07af6619ed3b8237a368e0589c10dfc; tree:f145dd050a3b18d952f1627b988a893c54c52c5f.Run 39964808314 attempt 1 (assignment A) passes all 27 jobs; the browser step takes 14 seconds. On 2026-10-23 the maintainer decided that one complete green assignment qualifies this PR: ADR-0063 requires both variants only for plan, algorithm or fixture-lifetime changes. The PR is ready for review.
Earlier observations remain distinct: source
9eecf967passes complete B but its A attempts fail browser APT setup. Sourcee2954be9passes complete A (27 jobs, 5,921 backend cases); B passes all backend cases and both aggregates but outer-deadline cancellation leaves 26/27 public audit report pairs. Successful natural cleanup does not qualify those failed whole attempts.At source
58d9ecdf, all 20 producers and public demo pass, but whole A is 24/27: a synthetic Git-cleanup failure blocks OpenAPI and both aggregates refuse a producer gate. The fixture now waits actual maintenance; closed diagnostics preserve the original gate observation. The first aggregate API response remains unavailable, so projection lag is unproven. That diagnostic correction adds no polling or acceptance relaxation.At source
95edb219, whole A is again 24/27: two Outbox startup cases fail in ordinary-10 and both aggregates refuse producer state. The baseline fixture independently reproduces those two failures against an owned held collector; this verifies a mechanism, not that hosted exception. Closed producer-state diagnostics now identify the refused owner/state before the unchanged failure. The original hosted exception and backend API response remain unavailable.At source
ed223aca, all twenty producers (5,921 cases) and the other five checks pass, but both aggregates observe a required producer stillin_progressand refuse: whole A is 25/27. Metadata acquisition now permits at most 30 seconds, sixteen complete reads and two-second pacing for explicit present-null pending states. Every snapshot is independently validated; terminal/malformed/identity-invalid evidence refuses immediately, and snapshots never combine. A single complete successful snapshot remains mandatory before unchanged artifact checks. New source full A/B is pending.Previous frozen source
dada277b, run39805658821attempt 1: both aggregates and all twenty producers pass. Independent archive/result recomputation confirms 3,350 non-Docker + 2,571 Docker cases and both aggregate receipts. Whole A remains unqualified, 26/27: Ubuntu package downloads reach the unchanged five-minute browser-installer limit before any public proof. Full B attempt 2 now passes all 27 jobs and independent verification: 5,921 backend cases, 1,857 frontend cases, 27 public JSON/HTML report pairs, 9 screenshots, 134 API completions and natural confirmed cleanup. Its backend summary SHA-256 is6dec960a69056da115ec6691a3cedee8e50670da505d1ea7e43c2e07a866e79d; public receipt SHA-256 isced9f6afa005f33f164071b9d1f4022dacf16bf298c2a17677c70fd3dcefc845. Full A attempt 3 uses the same frozen source but failsbackend ordinary-8(job119943000095): 243 assigned cases finish, with one failure inNative_fixture_start_waits_for_previous_actual_cleanup_before_one_same_generation_hint. Its retained result records cancellation at the provider-construction wait, 31.379 seconds, after the preceding cleanup and hint helper have returned. The same case passed in A1 and B2 in 3.472 and 2.682 seconds. Two independent source/evidence inspections confirm the boundary; the artifacts do not establish the post-hint cause. This failed whole attempt cannot qualify A or be combined with successful subsets. No behavior or deadline change has been made for this failure; its cause remains unknown.PR #34 is merged and P02b-6's four implementation steps are complete. This PR is the separate CI closeout; P02b-7 and P02b-8 remain pending.
Risk
The metadata allocation consumes time inside the same five-minute aggregate; its sixty-second upload reserve remains fixed. Thirty seconds is not a guaranteed API propagation bound.
Application, realm and credential policies, shard plan, case identities, required contexts, aggregate API identity checks and permissions remain intact. The outer allocation changes from 16/4 to 17/3 within the existing ceilings. Sandbox cleanup and receipt generation use 15+5-second timeout wrappers; NuGet uses restore-only caching at the same pinned revision. Tail allocations are nominal scheduling allowances, not a worst-case OS guarantee. Chromium installation no longer touches APT and relies on the hosted image's libraries; an image that drops one fails the browser step visibly rather than silently.
The earlier 32-second native cancellation and the
dada277bA3 handoff cancellation remain causally unexplained; neither is reproduced in about 150 local repetitions. The controlled fixture weakness is reproduced and corrected independently. Native success, elapsed timeout and forced cleanup never substitute for actual private cleanup. Partial/failed-job reruns never qualify a run.Related
Prepared with Codex.
Summary by Sourcery
Harden CI evidence and fixture ownership so audits remain reliable across reruns while native and hosted failures retain their original causes.
New Features:
Bug Fixes:
Enhancements:
CI:
Documentation:
Tests: