[ORESoftware]

Purpose

Add a non-duplicative post-merge regression gate for the GitOps catalog and root dispatcher. The original exact-parent feature canary is already merged and green; this lane validates the current product head and uses disposable worktrees to prove that policy remains fail closed after later repository changes.

Drift found by the first run

The first exact-current run pinned:

zed-pkg/zed-cli@5d1d13119be5784f545a7d812cdfaae3ca120693
ORESoftware/k8s-cluster@18f1fa1dc8360c4817e1adbc1351b93f7d8604de

All product/native quality gates and release builds passed, then real catalog validation correctly rejected a stale declaration:

catalog inventory/source pin: 32be546f5ee020c1de3b099a47e6760d00e3f6e4
indexed fabrication-server gitlink: 5e305b9bf40d28139bdabf9342c304f759cbfee5

The repair is proposed in ORESoftware/k8s-cluster#1209. It aligns the catalog to the indexed child SHA and adds remote/deployments/** to the GitOps workflow path filters so future gitlink-only changes cannot bypass validation.

Current certification pair

zed-pkg/zed-cli@5d1d13119be5784f545a7d812cdfaae3ca120693
ORESoftware/k8s-cluster@4bc664a651cd912e8c16a15dd8f0dfcb1e1870b5

Matrix

Ubuntu 24.04, macOS 15, and Windows Server 2025 each run:

• exact checkout verification;
• rustfmt, focused dispatcher/validator tests, strict Clippy, and package-graph validation;
• native k8s-cluster GitOps tests;
• locked release builds of zed and zed-gitops;
• real repaired-catalog validation through standalone, root-dispatched, and native validators;
• deterministic preview/count parity;
• inert/unreferenced ApplicationSet checks; and
• seven disposable policy-failure scenarios plus Unix symlink escape.

Required fail-closed scenarios

• source.pin-drift
• inventory.gitlink-drift
• argo.project and argo.namespace
• migration.inert-sync
• policy.infra-is-not-app
• migration.static-application
• catalog.empty
• Unix-only catalog symlink escape before record loading

For policy scenarios, standalone and root-dispatched Zed reports must be byte-identical and both Zed and native validators must return policy status 2 with the expected rules.

Safety

Public exact-commit checkouts use persist-credentials: false. Product subprocesses are stripped of credential-shaped environment variables. Scenarios use detached disposable Git worktrees. The workflow performs no private submodule read, registry/publication write, Kubernetes or Argo mutation, Cloudflare request, DNS change, R2 access, database write, or persistent namespace operation.

The ApplicationSet remains inert. Passing this PR does not authorize activation.

Coordination

• Catalog repair: fix(DEN-2724): keep GitOps catalog aligned with deployment gitlinks ORESoftware/k8s-cluster#1209
• Product merge: feat(DEN-2725): route root gitops commands safely on current main zed-pkg/zed-cli#242
• Original exact-parent canary: test(DEN-2725): repin GitOps canary after offline tool profiles zed-pkg-e2e#134
• Cluster contract: [DEN-2724] Add exact-pin GitOps composition contract and inert ApplicationSet pilot ORESoftware/k8s-cluster#1109
• Roadmap: [GitOps roadmap] Submodule-backed app catalog, ApplicationSets, and zed gitops validate ORESoftware/k8s-cluster#1097
• Linear: DEN-2724, DEN-2725, DEN-630

[linear-code]

DEN-2724

[ORESoftware]

Three-platform exact-SHA evidence is green

Run 31278571056 passed against:

zed-pkg/zed-cli@5d1d13119be5784f545a7d812cdfaae3ca120693
ORESoftware/k8s-cluster@4bc664a651cd912e8c16a15dd8f0dfcb1e1870b5

Results

• Ubuntu 24.04: 13 checks, 8 adversarial scenarios.
• macOS 15 ARM64: 13 checks, 8 adversarial scenarios.
• Windows Server 2025: 12 checks, 7 adversarial scenarios; the filesystem-symlink escape is intentionally Unix-only.
• All runners passed immutable checkout verification, formatting, focused dispatcher/validator tests, strict Clippy, package-graph validation, native cluster tests, release sibling builds, real positive validation, clean-checkout proof, and evidence upload.
• Root zed gitops and standalone zed-gitops reports were byte-identical for the baseline and every policy scenario.
• Native and Zed validators agreed on one catalog record and the deterministic renderer emitted one preview.
• The ApplicationSet pilot remained inert and unreferenced.

Identical cross-platform baseline digests:

native report  e23b6a4972395ee14cde004b5459efdb3973f7035863ddf0b3863b33199859be
Zed report     9a58230e23fa03cc45bd4aecea01102938490b58d247d0827e278a12253d840c
preview        d6ccd90da1dacb5215e6f80e649a9cfe33dd405dbe8c7477d5944877b98aea15

Required failures were observed for source pin drift, indexed gitlink drift, default Argo project/namespace, inert sync activation, *-infra app classification, unsafe parent path, and empty catalog. Linux and macOS also rejected an escaping catalog symlink before record loading.

Artifacts are retained for 14 days with commit-addressed names and archive digests. This PR is ready for review. It remains read-only and performs no private-submodule, registry, cluster, Argo, Cloudflare, DNS, R2, database, or production-credential operation.