[bokelley]

Current RC5-train status (2026-09-23)

Ready for review at exact head 642a2edbc2948ce3a7dfefe6efdefecf66a7aa87, merged with main at 0f451209315986084385ee48932ab441853bba43. Squash auto-merge is armed but remains gated by exact-head CI and non-author human maintainer approval. Local release validation passed 149/149 publication/fence tests, 9/9 compliance-version tests, promotion/immutability, and the broader suite passed 666 files / 11,018 tests with 31 skips. All review threads are resolved/outdated. This paragraph supersedes older Draft/readiness/authorization status below; historical incident evidence remains for audit context.

Routine Deploy exposed committed rc.3 artifacts before their tag/GitHub Release, and stale Changesets runs force-updated the release branch. This change restricts routine uploads to mutable latest, binds immutable publication to current maintainer approval and exact commit provenance, and contains stale generated-branch updates using verified Draft/HOLD state and exact leases.

Draft only; auto-merge off. Human maintainer approval remains required. #7510 is the hard predecessor of #7507 and #7509. Neither may land first: legacy bulk deployment would publish their historical artifacts without separate authority. After this fence lands, successors must rebase onto the actual landed fence and repeat exact CI, independent audit and human review. #7507 additionally requires confirmed deployment of human-reviewed/landed #7506. Synthetic composition does not release these holds.

#7502, the separate immutability-guard workstream, was last recorded as quarantined Draft/auto-off at 97057931798034e9ed57a6f4160b7d01f635a5ac on recorded base 36a. Its exact Secretariat bot approval is not human authority. Do not assume its guard is landed or authorized: current-main refresh, exact CI/audit, native human gate and human review remain required. #7503 owns its release-content/documentation corrections; neither workstream's production changes are absorbed here.

Behavior:

• Deploy preflight rejects any pending current-version schema, compliance or protocol surface before Fly. Routine publication accepts only latest; unscoped live bulk publication fails. Regression fixtures include historical rc.0–rc.3 JSONL and 3.1.22/3.1.23 artifacts and prove routine Deploy cannot backfill them.
• Approval requires exactly one associated merged PR and the latest exact-head APPROVED review by a non-author human with current write/maintain/admin authority. Permission/role metadata and reviewer identity are validated. Bots, outsiders, authors, stale/dismissed reviews, demoted users, ambiguous PRs/identities and lookup errors fail closed. Generated-head parent and merged-tree provenance are independently checked.
• Before Changesets, capture the exact release ref and zero/one PR; verify an existing PR is Draft with a durable HOLD. Intercept only the pinned action's expected push and substitute an exact old-ref lease. Drift or uncertain outcomes trigger a lease-bound restore, or deletion only of a newly created owned ref. Preserve competing refs and verify Draft containment. Fresh tokens, bounded processes, durable evidence and conservative replay cover expiry, outages, timeouts and lost acknowledgements. Successful generated PRs remain Draft. An outage preventing containment is reported as unresolved reconciliation, never successful quarantine.
• New GitHub Releases stage exactly four unchanged signed assets in Draft before publication. Existing published releases take a strictly read-only validation path: tag target, metadata, exact four-asset inventory and all bytes must match; no uploads or PATCH on reuse. Only then may explicit version-scoped R2 publication conditionally create missing objects. Existing bytes must match. No signing or artifact regeneration is added.
• Fresh tested-SHA/current-main checks guard external publication and repeat after slow work. Release concurrency uses queue: max with cancellation disabled; obsolete runs and stranded committed releases stop explicitly with an eligible recovery route. GitHub's queue is bounded, not guaranteed delivery.

R2 publication is progressive and atomic per object only. A request already in flight can finish after main advances; subsequent writes stop. There is no whole-bundle transaction across main, GitHub and R2. Partial attempts require inventory and separately authorized recovery.

Exact candidate (pure rebase onto #7533):

• Base: cdcc8f996e8acd2417d5f7a547711cd21929289b
• Head: 22047cc647fdcb23aebb6582476af8f1fe341e54
• Tree: 2d4e6213ac3bbe8decebe4f1062b84cb4144c0af
• Original head/base: f7890344fd472dbadc12f8dc43f5f571b0d35774 / 2da35544ffb7257861324786a33cae9db0457bac.
• All nine range-diff entries are equal; every changed file blob/mode and the complete branch patch are unchanged. Main advances only three CSRF/MCP paths, with zero overlap. Old-to-new head differs by exactly those same three path/blob changes.
• Canonical git diff --binary --full-index BASE...HEAD: 153,720 bytes, SHA-256 8dbd5f38d01cedb350fafa2f17756557d1dc5ec22e2f4455c107726e0c98e4ad. Ordinary diff with core.abbrev=10: 152,820 bytes, SHA-256 80044fabc06b08c7da1986223746f477c437ecba04424d30d03ba9c2f191d4fa.
• Scope remains 15 files +3,238/-122. Entire dist tree 16839080cf3ce1c9f1e140080e14988f56eacddf is unchanged: all 94,064 blobs, including all 2,097 original rc.3 path/mode/blob records. No dist or .context paths in the diff. No dependency, lock, version, release-content or protocol-surface changes; package.json only registers the release tests. No changeset is required for this operational scope.

Local validation on this exact head used Docker node:24-bookworm-slim, Node 24.21.0, and dependency content matching the lockfile (SDK 14.0.0-rc.35):

• bash scripts/with-timeout.sh 900 npm run test:release-workflow: 149/149 ordering/fence tests, 9/9 published-compliance tests, promotion and release/forward-merge immutability passed (98.898s).
• Explicit server Vitest selection: csrf-middleware.test.ts, mcp-route-authorization.test.ts, mcp-principal-authorization.test.ts: 3 files /83 tests, all passed. The third is adjacent regression coverage; fix(auth): allow trailing slashes on MCP CSRF exemptions #7533 itself changes the first two test files and the middleware implementation.
• Registration/scope/immutable regression checks 3/3, full-range scope and immutable-artifact gates, docs navigation 55/55, adjacent signing/release-nav/instrumentation 30/30, and both typechecks passed.
• Seven Node syntax checks, helper Bash syntax/ShellCheck 0.9.0, conventional title and whitespace checks passed. Actionlint 1.7.12 workflow parsing uses only the narrow queue parser exception; the release suite independently asserts queue: max and cancellation false. Combined Actionlint/inline ShellCheck has four unchanged baseline findings (SC2011, SC2086, SC2129, SC2155), exit 1; candidate and f789 output are byte-identical. Syntax validation was also run separately from embedded ShellCheck. No workflow edits occurred during qualification.
• Environment correction: the initial release attempt was145/149, with all four failures reporting missing jq; installing jq1.6 and rerunning the unchanged candidate passed. IPv6 loopback was enabled only inside the test-container network namespace during canonical tests, before server tests, and an explicit ::1 bind passed. No test expectations were changed.
• bash scripts/with-timeout.sh 3600 npm test completed with exit 0 in 1,749.268s (29m 9.268s), ADCP_TIMEOUT_SCALE unset. Canonical suites passed; root units 1,063/1,063 across 71 files; server units 9,476 passed, 31 skipped across 617 files (server duration 1,005.66s); OpenAPI and both final typechecks passed. This is exact 22047 evidence, not inherited from f789.

Fresh-context independent read-only reviewer /root/release_cdcc_review found no blockers on exact head/tree22047/2d4e. It independently verified all nine equal commits, zero overlap, complete dist preservation, CSRF integration and release safeguards. Separate evidence audit found no count or head mismatch. This is AI review, not required human approval. The existing CodeQL mock comment-store thread is resolved/outdated; its exclusive temporary write and atomic rename remain unchanged. Fresh exact-head GitHub CodeQL remains required.

Authorized leased push completed on2026-09-15; post-push checkpoint 2026-09-15T04:25:17.138953+00:00 confirms exact head22047, maincdcc, Draft=true and auto-merge=null. Expected-old-head lease was the complete f7890344fd472dbadc12f8dc43f5f571b0d35774 on refs/heads/conductor/fix-release-publication-gate. The unchanged version/scope/docs pre-push hook ran in Docker; only the playbook-documented advisory local storyboard replay was skipped with ADCP_SKIP_STORYBOARD_MATRIX=1. Fresh exact 22047cc647fdcb23aebb6582476af8f1fe341e54 CI is terminal green at 2026-09-15T04:47:21Z: 56 successful rollup contexts (55 CheckRuns + IPR), 1 expected Draft Ladon skip, 0 pending/failed/cancelled checks. All 13 Actions runs completed on attempt 1 (12 success, 1 Draft skip). Build, migration smoke, and the authoritative storyboard run passed; storyboards finished all 22 jobs successfully. Exact-head CodeQL reports no new alerts in changed code and zero annotations. No new inline findings appeared; the previous mock-store thread remains resolved/outdated. Historical f789 check results below do not qualify this head.

Native requests to @bmilekic and @EmmaLouise2018 were renewed at 2026-09-15T04:48:55Z, after terminal exact-head CI and an independent terminal audit. New native timeline events 31147555089 and 31147555118 are verified. Both are current non-author human admins; their requests remain pending and neither has approved this head. Pending requests were removed/re-added; no review history was dismissed. Keep Draft/auto-merge off. User authorization covers this PR's leased rebase publication, evidence and CI monitoring only. No merge, readiness change, Release/Deploy/Recover dispatch or rerun, software-release/tag, recovery, R2/CDN or held-peer mutation is authorized. #7404 remains open; no affected public-card result is claimed.

Local records: .context/release-7510-cdcc-evidence/ (preservation hashes, range-diff, per-command logs/results, full-run record, baseline lint comparison and independent review). Conductor workspace · session.

Historical base2da/headf789 qualification and incident/recovery handoff (not current-head evidence)

The records below are retained from the previous qualification. Their “current” timestamps/heads, composition tests, writer reconciliation and object inventories refer to that historical window. They do not establish the new head's CI, current external bytes, deployment, human authority, or any recovery authorization.

Exact historical candidate:

• Base: 2da35544ffb7257861324786a33cae9db0457bac
• Head: f7890344fd472dbadc12f8dc43f5f571b0d35774
• Tree: 9f0fce37063bccdc21e9d3b20ab8f5b328611b1e
• Canonical git diff --binary --full-index BASE...HEAD: 153,720 bytes, SHA-256 8dbd5f38d01cedb350fafa2f17756557d1dc5ec22e2f4455c107726e0c98e4ad.
• Ordinary git -c core.abbrev=10 diff --binary BASE...HEAD: 152,820 bytes, SHA-256 80044fabc06b08c7da1986223746f477c437ecba04424d30d03ba9c2f191d4fa.
• Nine clean rebased commits from independently reviewed 32496b54 on base336: all nine range-diff entries equal, all 15 resulting changed blobs identical, and the canonical patch unchanged. The 19 paths added by fix(addie): finish agent registration with secure credential entry #7529 on current main have zero overlap. The narrow CodeQL fixture correction—initialized comment store, direct read, exclusive temporary write and atomic rename—is preserved exactly.
• dist tree remains 16839080cf3ce1c9f1e140080e14988f56eacddf; all 2,097 original rc.3 path/mode/blob records are identical to 71f. No release content, migration, dependency, lockfile or package-version changes; package metadata changes only test registration. Diff: 15 files, +3,238/-122.

Current-base local evidence (exact base2da/headf789; prior-base results remain historical):

• Release command: 149/149 ordering/fence and 9/9 published-compliance tests, promotion and release/forward-merge immutability passed.
• Registration/scope/immutable checks 3/3; full-range classifier passed; docs navigation 55/55; broader signing/release-nav/instrumentation 30/30; both typechecks passed.
• Node/Bash syntax, helper ShellCheck and diff checks passed. Actionlint 1.7.12 uses only the narrow unexpected key "queue" for "concurrency" section exception; a parsed-YAML contract requires exactly queue: max / cancel-in-progress: false. Official GitHub documentation documents the 100-pending limit and incompatible cancellation setting. No blanket parser suppression is used; unchanged base inline ShellCheck findings are separate.
• Independent separate-session exact security/rebase/delta review approved f7890344 for Draft lease-push only, with no blockers, issues or nits. It verified all nine range entries, 15 blobs, unchanged patch/dist/rc.3 inventory, security semantics, current-base tests and exact held-peer composition. Report: .context/release-ordering/independent-review-current-2da.md; review session. All previous evidence is retained.
• Current-main impact selection passed 7 files / 237 tests. Full release passed 149/149 ordering/fence/recovery and 9/9 compliance, promotion and immutability. Held-peer composition passed 149 + 53 + 9 tests and registration 1/1; registration/scope/immutable checks, both typechecks, docs navigation, broader signing/release navigation/instrumentation, syntax and static checks passed.

Held #7509 composition with unchanged 3b6fd2d124c691370d97b8e57d0fa23bc0a2563f produces tree 3e75f741bcef6f5ddfb7ec55636dab443198506c on current base2da. The sole conflict is package.json; resolution retains ordering/fence/CDN/Worker registration exactly once. All 2,411 materialized files match the tree; the full index contains 99,716 entries. The actual combined release command passed 149 ordering/fence + 53 JSONL/Worker + 9 compliance tests, promotion/immutability and registration 1/1, with zero failures or skips. No synthetic commit is pushed. #7509 remains held until #7510 actually lands and it requalifies; prior-base compositions are historical.

Fresh exact f7890344 CI is terminal green: 56 successful rollup contexts (55 check runs plus IPR status), one expected Draft Ladon skip, and zero pending/failed/cancelled contexts. All 13 Actions runs finished on attempt 1: 12 success and Ladon skipped. Build 34908986750, migrations 34908986751, and storyboards 34908986708 passed; the authoritative storyboard run completed all 22 jobs successfully. Live CodeQL check 104193618061 passed on this exact head, reporting no new alerts and zero annotations. The terminal owner snapshot at 23:51:48 UTC reconfirmed main2da/headf789, Draft/auto-off and zero active/queued Release/Deploy/Recover or schema-bundle writers. Prior 32496b54 results remain evidence on base336 only.

The supplemental full npm test completed with exit 0: canonical suites passed, root unit tests passed 1,063/1,063 across 71 files, server unit tests passed 9,464 with 31 skips across 617 files, and both final typechecks passed. This is current exact-head local evidence, recorded in current-2da-root.log; it does not establish any production deployment or affected-agent outcome.

The branch update succeeded using an explicit expected-head lease against 32496b54e8fcdef46a12b077a9426eb7193ac522, a fresh current-main check, and zero active or queued Release/Deploy/Recover and schema-bundle writers. The immediate pre-push checkpoint passed at 23:27:45 UTC and the post-push checkpoint passed at 23:27:58; main/head and Draft/auto-off were exact. Version/scope/docs pre-push hooks remain enabled. The playbook-documented ADCP_SKIP_STORYBOARD_MATRIX=1 skips only the advisory local storyboard replay for this Draft push; no full local matrix pass is claimed. The authoritative GitHub storyboard run subsequently passed all 22 jobs. The supplemental full-root canonical run was non-terminal before push and subsequently completed successfully, as recorded above. No dependency, version floor, source, release artifact or workflow behavior changed in the rebase.

Current incident and recovery handoff—no live recovery authorized:

0. Latest writer reconciliation on base2da: Release 34903186410 completed at 22:16:42 UTC after its release job was skipped for an app-only push. Deploy 34903894825 completed at 22:45:43; its old bulk R2 step ran 22:39:17–22:45:39, with 89 AWS commands. This is scope evidence only, not a fresh object inventory. The earlier 20:42 byte audit below is historical and was not repeated. Version Packages (rc) #7508 remains exact 15fcf330d generated from336; this app-only advance does not establish rc.4 bundle-content drift. Current writer state must be rechecked before any later action.
1. Legacy Release 34885829473 on336 completed at 20:36:10 UTC. Its only relevant mutation was the old unleased force-push ffa19d518 → 15fcf330d9950f6c12f0903b0a3fef30fb03ab8f at 20:36:05. #7508 remains Draft/auto-off with no reviews at the final snapshot: candidate rc.4, sole parent 336, tree 8db92ddd365ad461d323d09dc37423f22dd2847a, one commit / 2,113 files / +2,776,220/-6. Signing/tag/GitHub Release/R2/CDN steps were skipped. All 94 release authority/asset records were unchanged. No active Release/Deploy remained at reconciliation; recheck before any later operation. Preserve Version Packages (rc) #7508 HOLD; this work does not mutate it.
2. Earlier legacy Deploy 34887471948 completed bulk R2 publication 19:48:37–19:53:18. Its 89 AWS commands cover 80 destinations, including versioned roots. Quiet logs establish scope, not every changed object. New fences do not retroactively control old-code runs.
3. Original rc.3 run 34844149713, initially cancelled, later completed external attempt 4 triggered by bokelley: GitHub Release 388609904 was public at 18:11:49, assets uploaded through 18:11:58, followed by legacy bulk R2. Tag v3.2.0-rc.3 targets original 71f; all four downloaded assets match committed bytes. This session performed none of those operations. Do not recreate or retag the existing release.
4. A corrected direct R2 GET byte audit at 20:42:22–20:42:39 covered all 2,093 schema/compliance + four protocol = 2,097 original 71f paths: 2,096 equal, one missing JSONL, zero different bytes/read errors. Missing: compliance/3.2.0-rc.3/test-vectors/reporting-reconciliation/rows.jsonl. The earlier temporary-reader attempt failed locally and is retained separately; only the completed corrected report establishes equality. This observation window is not an atomic snapshot or repair authorization. Evidence: legacy-final-rc3-r2-audit.json.
5. Separate rc.4 routing audit: public rc.4 schema/compliance indices serve exact old rc.3 bytes, differing from candidate 15fcf. Direct R2 reads of those exact rc.4 keys and its protocol tarball return NoSuchKey; public index headers retain 13:10/13:13 rc.3 modification times and revalidation policy. This is consistent with existing missing-version fallback routing. It does not establish rc.4 object publication or authorize overwrite/deletion. rc.4 tag/GitHub Release are absent; public protocol rc.4 is 404. Routing/deployed-Worker attribution remains a separate audit. Evidence: legacy-rc4-routing-audit.json and public curl responses.
6. Ordinary rc.3 dispatch remains quarantined. Version Packages (rc) #7485 approved head e7d42 has parent decd95; release merge 71f has parent eb3 and a different full tree. The strict provenance gate rejects this shape. Previous dispatch-only guidance is withdrawn. Existing external publication does not provide an exception: obtain fresh maintainer authority in a separately reviewed plan binding the exact original 71f tree and exposed bytes before any repair. Preserve matching objects; no regeneration, overwrite, deletion or retagging.
7. Historical rc.0–rc.2 JSONL repair is a separate, explicitly approved one-key operation per version, backed by existing tag/GitHub Release and exact historical tree/four-asset bytes. Require a complete inventory and an execution boundary allowing conditional creation only of the confirmed missing key. --version alone is not a one-key allowlist. Any other missing object or ambiguous read stops for a separate plan; never replay historical workflows.

Current exact-head independent review and fresh CI/CodeQL are clean. Independent post-push audit at 23:52:45 UTC reconfirmed exact head/base/main, all terminal CI/CodeQL and full local pipeline results, both pinned diff identities, Draft/auto-off and zero active/queued writers. Under the user’s earlier rebase/qualification authorization, native requests to @bmilekic and @EmmaLouise2018 were renewed at 2026-09-14T23:53:44Z, after green CI and the independent audit. Pending requests were removed/re-added and fresh native timeline events verified; no review history was dismissed. Both are current human admins. Their requests remain pending; neither has approved. Keep Draft/auto-off. No readiness or merge claim is made without exact-head, non-author human maintainer approval. #7510 remains the hard predecessor of #7507/#7509, and #7507 additionally requires human-reviewed #7506 landing and web/worker deployment. #7404 remains open; no live affected-card verification or closure is claimed. No #7506/#7507/#7508/#7509 state, merge, deploy, recovery/publication, tag/release, workflow rerun/cancel, R2/CDN or branch-rule mutation is performed by this task.

[bokelley]

RC5 train refresh: merged current main (0f4512093) into the release fence; current head is 642a2edbc. Conflict resolution preserves the validated release target checkout, strict current-head/human-approval/provenance gates, draft-first GitHub Release staging, Changesets containment/recovery, and concurrency.queue: max. Local release validation passed 149/149 fence tests plus 9/9 published-compliance tests and promotion/immutability checks. The broader suite passed 666 files / 11,018 tests with 31 skipped after supplying linked-worktree-local tsx; no code failures. The local advisory storyboard pre-push matrix is currently blocked by the existing seller capability fixture ending at 3.2-rc.3 while the package is 3.2.0-rc.4; authoritative exact-head CI is now running. All review threads are resolved/outdated. Requesting final human review for the RC5 prerequisite.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated-path approval gate is not satisfied.

This PR modifies three files under .github/workflows/**, which are deterministically under a hard approval gate (gated_paths: true), and review_decision is REVIEW_REQUIRED (not APPROVED). Per decision rule row 2, the outcome must be escalate — human/CODEOWNERS review is required before this can merge.

Escalation reasons

• .github/workflows/deploy.yml (modified) — under hard approval gate .github/workflows/**; requires human/CODEOWNERS approval.
• .github/workflows/recover-protocol-cdn.yml (modified) — same gate.
• .github/workflows/release.yml (modified) — same gate.

Findings
No blocking or medium code defects were reported. The reviewer verified the freshness fence, provenance/approval gates, the Changesets lease-and-quarantine transaction, and the disabled bulk backfill against the 149-case harness. No protocol-surface or dist/** changes. Two non-blocking follow-ups were noted (changeset-scope narrowing for release.yml; main-only dispatch constraint on recover-protocol-cdn.yml), neither rising to a Medium.

The escalation is driven purely by the unsatisfied gated-path gate, not by code quality. Once a human/CODEOWNERS approval flips review_decision to APPROVED, this clean diff can fall through to approve on a subsequent run.

Why human review

• .github/workflows/deploy.yml (modified) is under the hard approval gate .github/workflows/** and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.
• .github/workflows/recover-protocol-cdn.yml (modified) is under the hard approval gate .github/workflows/** and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.
• .github/workflows/release.yml (modified) is under the hard approval gate .github/workflows/** and review_decision is REVIEW_REQUIRED — human/CODEOWNERS approval required.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/deploy.yml (modified) matches .github/workflows/**; .github/workflows/recover-protocol-cdn.yml (modified) matches .github/workflows/**; .github/workflows/release.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.