stack/docs/release-integrity/release-evidence.md

RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)

Status: DRAFT — proof complete, awaiting review + merge. All five normative requirements (RI-N1..N5) merged to next behind the live gate. Registry credential fixed 2026-08-18 23:47Z and proven end-to-end: push pipeline 2517 (retry of failed 2512 at the identical commit d4d32a8, only the secret changed between runs) — all steps green including build-gateway. Remaining for closure: this pack PR reviewed (topher), merged to next, its own push pipeline green, #1275 closed. Last updated 2026-08-19 by fargo (day-takeover orchestrator). Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source: docs/PRD.md § Release Integrity Workstream (#1275).

RI-N1 — Canonical terminal verification + exact-commit publish gate

exhibit	evidence	where
Gate live, fail-closed	Push pipeline 2486: verify ran at exact commit, FAILED on a real latent defect (gateway cross-user-isolation cleanup on the no-DB path), and build / publish-npm / build-gateway were all skipped. First push in repo history that did not publish ungated (prior ungated publishes beside failing builds: 2439, 2462, 2482).	Woodpecker repo 47 pipeline 2486
Gate-caught defect fixed	PR #1304 (afterAll honors dbAvailable; both paths verified: dead-port 28 skipped + file passes; live-5433 28 passed). Review 180 (fred).	PR #1304
First gated green npm publish	Push pipeline 2488 (post-#1304): verify GREEN → build GREEN → publish-next-npm GREEN, all publish effects behind the gate.	Woodpecker pipeline 2488
Negative controls	PR #1305: structural DAG tests (S1 missing edge, S2 renamed effect incl. command-based npm/kaniko detection, S3 detach, S4 failure:ignore/success override, S5 when-filter, S6 HEAD-mover between verify and publish with legitimate-recheckout positive control, S7 removal) + subset-stage composition control in verify-release.test.mjs. Mutation-verified by the dispatching seat in both directions (true bypass → S1 assertion fires; non-bypass edit → correctly green). Scripts tests 20/20, CI 2490 green.	PR #1305
✅ Canonical command	scripts/verify-release.mjs (stage table pinned to ci.yml by checked-in test). Merged with #1277; now also invokes the RI-N4 evaluator via its quality-rails stage (#1308).	scripts/verify-release.mjs

RI-N2 — Forge + MACP fail-closed (typed explicit simulation)

• ✅ Forge: PR #1278 merged (head 4917df1f; CI 2477; review 184 fred at pinned head — prior review 172 dismissed by rebase, correctly re-taken).
• ✅ MACP: PR #1293 merged (head 2097379e; CI 2465; review 173).
• ✅ Post-merge behavior docs: PR #1299 merged (head 8a405b14; CI 2497; review 186 fargo at pinned head — legitimate independent seat; merged 2026-08-18 with --expect-head pin, content-verified on next @ ff45f7b).

RI-N3 — PRD authority

• ✅ PR #1294 merged (head 8d258e1d; CI 2466; review 174).

RI-N4 — Quality-rails evaluator

• ✅ Probe inventory: PR #1302 merged (head e06a47fac59; CI 2484; review 187 fargo at pinned head; 54 rows / 21 canonical checks / dispositions 43-2-9-0 row-count-verified; merged 2026-08-18, content-verified on next @ 6435089).
• ✅ TS evaluator absorbs shell probes: PR #1308 merged (head 68279d61; CI 2506; review 188 fred at pinned head — seven targeted mutations, seven detections, incl. the vacuous-pass hole M1 and stage-removal M7). Evaluator: typed fail-closed verdicts, digested versioned definitions, per-subject sets; QC-19 absorbed (verbatim-list parity oracle), QC-20 as thin adapter (verify.sh unmodified); verify-release quality-rails stage wired (RI-N1 consumes the evaluator). Worker-produced, independently verified by the dispatching seat (quality-rails 40/40 incl. sabotage control 6-failed/34-passed restored sha-verified; root build 25/25; typecheck 45/45).

RI-N5 — Consequence-aware stale UI

• ✅ PR #1300 merged (head a337d787; CI 2481; review 179). Web suite 199 → 281 tests (failure matrix + negative controls), independently re-run by the dispatching seat before merge.

Known-open infrastructure item (not a card)

Gateway/ci-base image pushes fail on registry credentials: Woodpecker repo secrets REGISTRY_USERNAME/REGISTRY_PASSWORD are rejected by the Gitea container registry (explicit UNAUTHORIZED at /v2/token; pipeline 2494 after PR #1306 corrected the secret references — previously masked as an ambiguous push-permission error since at least 2439). Requires a package-scoped token (Jason). The npm publish path is green and gated; this item tracks image pushes only and predates the RI-050 floor.

Update 2026-08-18 (fargo): Jason set new secret values ~17:25Z; pipeline 2507 (the #1308 merge push, first after the update, 18:0xZ) still fails build-gateway with the identical UNAUTHORIZED. Read-only isolation (no secrets read, no CI retries): the registry endpoint and auth mechanism are HEALTHY — a valid Gitea token via basic-auth mints a JWT at /v2/token (200), bad credentials 401 cleanly. Therefore the failure is isolated to the secret VALUES, not the endpoint or pipeline. Most likely shape error (labeled guess): the registry authenticates username + API token with package scope, not username + login password; if REGISTRY_PASSWORD holds a login password rather than a minted token value, /v2/token 401s exactly as observed. npm publishes remained green in 2507; every publish step except the image push is gated and green.

Resolution 2026-08-18 23:47Z — FIXED on the Gitea server (jarvis, #1275 comment 23239). Root cause was neither scope nor a missing token: REGISTRY_USERNAME held mosaic, the pre-rename org name. Gitea's rename redirect covers API/web paths but not Basic-auth username lookup, and mosaicstack is an organization, which has no password — the pair could never authenticate. Fix: REGISTRY_USERNAME=woodpecker (the existing service account, Gitea user 41, already in ci-publish) and REGISTRY_PASSWORD= a newly minted write:package-only token (gitea admin user generate-access-token in the Gitea container; minting with a token is forbidden server-side). Events [push, tag] preserved. Verified without a pipeline run: POST /v2/<pkg>/blobs/uploads/ opened then cancelled a session — 202 on all four kaniko destinations (gateway, appservice, web, ci-base), anonymous control 401, wrong-owner control 401. The earlier "Requires a package-scoped token (Jason)" expectation is superseded: the defect was a stale value from the org rename, not a scope grant Jason owed.

Proof 2026-08-19 ~00:2xZ (fargo): pipeline 2517 green at build-gateway. Woodpecker retry of 2512 — identical commit d4d32a8, identical pipeline config, only the server-side secret changed between runs — went green on every step (clone, install, verify, build, publish-next-npm, build-gateway). A/B at the same commit isolates the credential as the variable; the stored value is byte-intact. Retry was serialized (sole run in flight; merge-purpose CI queue guard had blocked on 2512's terminal failure at the next head, which this retry also clears). The item is closed.

Timing caveat (recorded so the pack does not outlive the memory of what the pin was). Every pipeline this pack cites — including headline 2517 — finished by 2026-08-19 00:34Z, which is BEFORE the registry credential pin landed at 2026-08-19 23:42:05Z. The A/B above remains sound regardless: it compares identical commits (d4d32a8) with only the secret differing, so it proves the credential value, not anything about the later pin. No pipeline cited in this pack exercises the post-pin registry state; a green trunk publish after the pin is a separate fact that this pack does not claim.

Process record (audit trail)

• Merges executed under the jarvis principal (topher seat; identity provisioning pending) via the Gitea API replicating pr-merge.sh semantics (head-pin + squash + keep branch): pr-merge.sh hard-codes main-only targets and cannot express this repo's next trunk — wrapper gap captured to OpenBrain (id 9db7a95a) and to the framework queue.
• Reviews tonight: 175/178 (zane's #1298, both heads, by topher); 176/177/179/ 180/181/182 (fred) — cross-review rule (producer ≠ reviewer) held on every merge: producers were pi workers / zane; reviewers were the other seat.
• CI contention note: concurrent PR pipelines on the single CI agent can time out the web SPA suite (measured 2470/2472 vs serialized 2475/2476/2477); serialize retries when the queue is busy.

Process record — 2026-08-18 day takeover (fargo)

• Takeover directive: Jason (via jarvis router + both seats' handoff documents, relayed verbatim over comms). First-move conflict between the two handoffs (zane: doctor PR first; topher: review-queue first) resolved on dependency grounds per jarvis's read — topher's order won; zane's finding-2 doctor PR (upgraded by fred's measurement) remains queued, nothing depends on it.
• Reviews 186 (#1299) + 187 (#1302): fargo, at pinned heads, as the legitimate independent seat (topher dispatched both producers; cross-review rule held). Both merged with --expect-head pinning via the REPO-COPY pr-merge.sh (allows next; the installed copy still lags — zane's route, not the raw-API break-glass), each preceded by ci-queue-wait -B next -R mosaicstack/stack. CI green at both heads (2497, 2484). Merges content-verified on the shipping ref (TASKS anchors at ff45f7b / 6435089).
• RI-3-002: one pi worker (zai/glm-5.3:high), independently verified by the dispatching seat before push; PR #1308 reviewed by fred (188, seven mutations incl. vacuous-pass and stage-removal) and merged head-pinned at 68279d61 → next @ 245e0c4.
• Registry-credential isolation measurement (above) performed read-only; no secret values read, no retry-pushes against CI.
• One reviewer-scope disclosure (fred, review 188): fred's approval explicitly did NOT re-run root build/typecheck/mosaic-vitest — those remain the dispatching seat's numbers. The changed-package suites, verify-release suite, and seven mutations were fred's own.