Advance Phase 8 qualification and fix AWS runtime projection

.dockerignore

@@ -18,6 +18,8 @@
 !examples/**
 !infra/
 !infra/**
+!dist/
+!dist/*.whl
 infra/.DS_Store
 infra/.terraform/
 infra/**/.terraform/

.github/workflows/ci.yml

@@ -17,24 +17,41 @@ jobs:
   python-quality:
     name: Python quality
     runs-on: ubuntu-latest
+    env:
+      DANDER_TEST_POSTGRES_DSN: postgresql://postgres:dander_test@127.0.0.1:5432/dander_test
+    services:
+      postgres:
+        image: postgres:15-alpine@sha256:3d0f7584ed7d04e27fa050d6683a74746608faf21f202be78460d679cc56461f
+        env:
+          POSTGRES_PASSWORD: dander_test
+          POSTGRES_DB: dander_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d dander_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           enable-cache: true
       - name: Install locked environment
-        run: uv sync --frozen --extra dev
+        run: uv sync --frozen --extra dev --extra postgres
       - name: Ruff lint
         run: uv run ruff check .
       - name: Ruff format
         run: uv run ruff format --check .
       - name: Strict typing
         run: uv run mypy src tests
+      - name: Control contract drift
+        run: uv run python scripts/check_control_contracts.py
       - name: Tests
         run: uv run pytest
       - name: Dependency audit
         run: |
-          uv export --frozen --format requirements.txt --no-dev --no-emit-project \
+          uv export --frozen --extra runtime-all --format requirements.txt --no-dev --no-emit-project \
             --output-file /tmp/dander-requirements.txt
           uv run --with pip-audit pip-audit --strict -r /tmp/dander-requirements.txt
 
@@ -48,7 +65,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
       - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform_version: 1.9.8
+          terraform_version: 1.15.8
       - name: Format
         run: terraform fmt -check -recursive
       - name: Initialize without a backend
@@ -59,6 +76,64 @@ jobs:
         run: |
           terraform -chdir=bootstrap-admin init -backend=false -input=false
           terraform -chdir=bootstrap-admin validate
+      - name: Validate AWS Terraform stacks
+        run: |
+          terraform -chdir=aws/bootstrap-admin init -backend=false -input=false
+          terraform -chdir=aws/bootstrap-admin validate
+          terraform -chdir=aws/bootstrap-admin test
+          terraform -chdir=aws init -backend=false -input=false
+          terraform -chdir=aws validate
+          terraform -chdir=aws/modules/fargate init -backend=false -input=false
+          terraform -chdir=aws/modules/fargate test
+          terraform -chdir=aws-control init -backend=false -input=false
+          terraform -chdir=aws-control validate
+          terraform -chdir=aws-control test
+      - name: Validate Azure Terraform stacks
+        run: |
+          terraform -chdir=azure/bootstrap-admin init -backend=false -input=false
+          terraform -chdir=azure/bootstrap-admin validate
+          terraform -chdir=azure/bootstrap-admin test
+          terraform -chdir=azure init -backend=false -input=false
+          terraform -chdir=azure validate
+          terraform -chdir=azure test
+          terraform -chdir=azure/modules/container-apps-jobs init -backend=false -input=false
+          terraform -chdir=azure/modules/container-apps-jobs test
+      - name: Validate OCI Terraform stacks
+        run: |
+          terraform -chdir=oci/bootstrap-admin init -backend=false -input=false
+          terraform -chdir=oci/bootstrap-admin validate
+          terraform -chdir=oci/bootstrap-admin test
+          terraform -chdir=oci init -backend=false -input=false
+          terraform -chdir=oci validate
+          terraform -chdir=oci test
+      - name: Validate GCP Control Terraform stack
+        run: |
+          terraform -chdir=gcp-control init -backend=false -input=false
+          terraform -chdir=gcp-control validate
+          terraform -chdir=gcp-control test
+      - name: Validate Kubernetes Helm chart
+        run: |
+          helm lint kubernetes/chart/dander --values ../tests/fixtures/kubernetes-values.yaml
+          helm template dander kubernetes/chart/dander \
+            --namespace dander-test \
+            --values ../tests/fixtures/kubernetes-values.yaml >/tmp/dander-kubernetes.yaml
+          helm lint kubernetes/chart/dander-control \
+            --values ../tests/fixtures/kubernetes-control-values.yaml
+          helm template dander-control kubernetes/chart/dander-control \
+            --namespace dander-control \
+            --values ../tests/fixtures/kubernetes-control-values.yaml \
+            >/tmp/dander-control-kubernetes.yaml
+      - name: Validate cross-cloud feasibility roots
+        run: |
+          terraform fmt -check -recursive ../acceptance/cloud-portability/phase1b
+          terraform -chdir=../acceptance/cloud-portability/phase1b/ecr init -backend=false -input=false
+          terraform -chdir=../acceptance/cloud-portability/phase1b/ecr validate
+          terraform -chdir=../acceptance/cloud-portability/phase1b/smoke init -backend=false -input=false
+          terraform -chdir=../acceptance/cloud-portability/phase1b/smoke validate
+          terraform fmt -check -recursive ../acceptance/cloud-portability/phase6/azure-google-federation
+          terraform -chdir=../acceptance/cloud-portability/phase6/azure-google-federation init -backend=false -input=false
+          terraform -chdir=../acceptance/cloud-portability/phase6/azure-google-federation validate
+          terraform -chdir=../acceptance/cloud-portability/phase6/azure-google-federation test
       - name: Static security analysis
         uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
         with:
@@ -77,14 +152,16 @@ jobs:
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform_version: 1.9.8
+          terraform_version: 1.15.8
       - name: Build and inspect artifacts
         run: |
+          python3 scripts/check_release_metadata.py
           uv build
           python scripts/check_distribution.py dist/*.whl dist/*.tar.gz
       - name: Install and run outside the checkout
         run: |
           TEMP_DIR="$(mktemp -d)"
+          VERSION="$(uv version --short)"
           INDEX=0
           for ARTIFACT in dist/*.whl dist/*.tar.gz; do
             ENV_DIR="$TEMP_DIR/venv-$INDEX"
@@ -93,15 +170,20 @@ jobs:
             uv pip install --python "$ENV_DIR/bin/python" "$ARTIFACT"
             (
               cd "$TEMP_DIR"
-              "$ENV_DIR/bin/dander" --version | grep -F "dander 0.5.1"
+              "$ENV_DIR/bin/dander" --version | grep -F "dander $VERSION"
               "$ENV_DIR/bin/dander" new "$PROJECT_DIR"
               cd "$PROJECT_DIR"
               "$ENV_DIR/bin/dander" validate
-              grep -F "ARG DANDER_VERSION=0.5.1" Dockerfile
+              grep -F "ARG DANDER_VERSION=$VERSION" Dockerfile
               "$ENV_DIR/bin/python" -c 'import dander; assert "site-packages" in dander.__file__'
             )
             INDEX=$((INDEX + 1))
           done
+          FULL_ENV="$TEMP_DIR/venv-runtime-all"
+          uv venv "$FULL_ENV"
+          uv pip install --python "$FULL_ENV/bin/python" "dist/dander_platform-${VERSION}-py3-none-any.whl[runtime-all]"
+          "$FULL_ENV/bin/python" -c \
+            'from dander.providers.dependencies import require_full_runtime; require_full_runtime()'
           terraform -chdir="$TEMP_DIR/project-0/infra" init -backend=false -input=false
           terraform -chdir="$TEMP_DIR/project-0/infra" validate
 
@@ -111,13 +193,16 @@ jobs:
     needs: [python-quality, terraform-quality]
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - name: Build immutable-check image
         run: docker build --tag dander-ci:${{ github.sha }} .
       - name: Verify CLI starts
         run: docker run --rm dander-ci:${{ github.sha }} --help
       - name: Verify runtime contract and bundled proof assets
         run: |
           test "$(docker run --rm --entrypoint /usr/bin/id dander-ci:${{ github.sha }} -u)" = "65532"
+          docker run --rm --read-only --tmpfs /tmp dander-ci:${{ github.sha }} runtime conformance \
+            | grep -F '"status":"succeeded"'
           docker run --rm --entrypoint /usr/bin/test dander-ci:${{ github.sha }} -f /app/connectors/hubspot_test.yaml
           docker run --rm --entrypoint /usr/bin/test dander-ci:${{ github.sha }} -f /app/models/staging/stg_hubspot__companies.yml
       - name: Scan image
@@ -128,6 +213,29 @@ jobs:
           exit-code: 1
           ignore-unfixed: true
           severity: CRITICAL,HIGH
+      - name: Build OCI lifecycle controller
+        run: |
+          uv build --wheel
+          VERSION="$(uv version --short)"
+          docker build --platform linux/amd64 \
+            --file infra/oci/controller/Dockerfile \
+            --build-arg DANDER_WHEEL="dist/dander_platform-${VERSION}-py3-none-any.whl" \
+            --tag dander-oci-controller:${{ github.sha }} .
+      - name: Verify OCI lifecycle controller contract
+        run: |
+          test "$(docker image inspect dander-oci-controller:${{ github.sha }} --format '{{.Architecture}}')" = "amd64"
+          test "$(docker run --rm --platform linux/amd64 --entrypoint /usr/bin/id dander-oci-controller:${{ github.sha }} -u)" = "1000"
+          docker run --rm --platform linux/amd64 --read-only --tmpfs /tmp \
+            --entrypoint /usr/bin/python3.12 dander-oci-controller:${{ github.sha }} \
+            -c 'import dander, func, oci; assert callable(func.handler)'
+      - name: Scan OCI lifecycle controller
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: dander-oci-controller:${{ github.sha }}
+          format: table
+          exit-code: 1
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
 
   secrets:
     name: Secret scan

.github/workflows/live-proof.yml

@@ -57,7 +57,7 @@ jobs:
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform_version: 1.9.8
+          terraform_version: 1.15.8
       - name: Locked Python checks
         run: |
           uv sync --frozen --extra dev
@@ -90,7 +90,7 @@ jobs:
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
       - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform_version: 1.9.8
+          terraform_version: 1.15.8
       - name: Install locked runtime
         run: uv sync --frozen --extra dev
       - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2

.github/workflows/publish.yml

@@ -17,6 +17,8 @@ jobs:
         run: |
           VERSION="$(uv version --short)"
           test "$GITHUB_REF" = "refs/tags/v$VERSION"
+      - name: Reject stale public release metadata
+        run: python3 scripts/check_release_metadata.py --publication
       - name: Build wheel and source distribution
         run: uv build
       - name: Validate distribution contents

.gitleaksignore

@@ -13,3 +13,8 @@ b5ea9389a35354a3da154238abba2446f42069cf:tests/security/test_enterprise_auth.py:
 # rk_live_ prefixes gitleaks's stripe-access-token rule matches on, but the historical commit still
 # contains the original wording and can't be edited after the fact without rewriting pushed history.
 60dc73b90458055b5d8a9d7c7d3e830d283199be:tickets/DANDER-72-row-level-operations.md:stripe-access-token:345
+
+# tests/providers/test_oci_vault_runtime.py — a synthetic OCI Vault resource OCID assembled
+# from a fixed prefix plus repeated test characters. The scanner matched the original constant
+# name, not credential material; the current tree uses a neutral fixture name as well.
+75eb05281ec614fce4a596fcfd0ff452d9e8a1bc:tests/providers/test_oci_vault_runtime.py:generic-api-key:16

AGENTS.md

@@ -0,0 +1,12 @@
+# Dander Engineering Guide
+
+- Use Python 3.12+ through `uv`; keep `uv.lock` synchronized with `pyproject.toml`.
+- Run Ruff lint/format, strict mypy, focused pytest, and proportionate full checks before merge.
+- Regenerate Control contracts with `scripts/generate_control_contracts.py` and verify drift with
+  `scripts/check_control_contracts.py`; never hand-edit generated schemas or fixtures.
+- Keep provider SDK imports lazy and inside the selected provider boundary. Public Control models
+  and GraphStore semantics must remain provider-neutral and fail closed.
+- Preserve existing CLI, runtime, and cloud-provider behavior unless the ticket explicitly changes
+  it. Use focused protected PRs and verify exact-main CI after merge.
+- Never commit credentials, secret values, business rows, Terraform state/plan files, caches, or
+  unreviewed live-provider evidence.