[ORESoftware]

Purpose

Reproduce the final source-byte and render evidence from a second zed-pkg-test repository. This consumes the exact immutable test package rather than copying or reimplementing its fixture logic.

Immutable inputs

zed-pkg-test/zed-pkg-e2e@153d65ad2b3cf5fc139efb0dbdf29fa816ce55d2
ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577

Three-platform reproduction

Ubuntu 24.04, macOS 15, and Windows Server 2025 each:

• verify the immutable test-package and cluster identities;
• execute the exact owner-repo endpoint/NetworkPolicy regression files by source Git blob identity;
• execute the independent test-org endpoint-policy tests;
• require NATS 4222 and OTLP HTTP 4318 to be permitted by the NetworkPolicy;
• install checksum-pinned Kustomize v5.8.1;
• validate .gitmodules, indexed gitlink, catalog inventory/source, and source snapshot parity;
• render twice and require byte-identical namespace-scoped output;
• reject cluster-scoped resources and plaintext Kubernetes Secrets; and
• require every checkout to remain pristine.

Safety

All checkouts disable persisted credentials. No user PAT, private-repository token, registry credential, Kubernetes credential, Cloudflare token, DNS permission, R2 key, or database access is used. The workflow performs no apply, push, publication, deployment, or reconciliation operation.

The snapshot does not claim live private-repository reachability; that remains a separately provisioned GitHub App contract.

Coordination

• Primary test package: test(DEN-2724): render checksum-pinned private source on three platforms zed-pkg-e2e#155
• Owner source repair: https://github.com/daedalus-fab/fabrication-server.rs/pull/11
• Stacked cluster pin: chore(DEN-2724): pin fabrication OTLP egress repair ORESoftware/k8s-cluster#1211
• Baseline catalog/trigger repair: fix(DEN-2724): keep GitOps catalog aligned with deployment gitlinks ORESoftware/k8s-cluster#1209
• Current-main adversarial matrix: test(DEN-2724): certify current-main GitOps fail-closed behavior #6
• Roadmap: [GitOps roadmap] Submodule-backed app catalog, ApplicationSets, and zed gitops validate ORESoftware/k8s-cluster#1097
• Linear: DEN-2724, DEN-2725, DEN-630

[linear-code]

DEN-2724

[ORESoftware]

Modern-runner reproduction is green on all three operating systems

Run 31279961078 passed on Ubuntu 24.04, macOS 15 ARM64, and Windows Server 2025 against:

zed-pkg-test/zed-pkg-e2e@153d65ad2b3cf5fc139efb0dbdf29fa816ce55d2
ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577

Every runner executed the exact owner regression files by source Git blob ID, the independent endpoint-policy implementation, checksum-pinned Kustomize installation, catalog/gitlink/source provenance, deterministic double render, resource/namespace restrictions, and pristine-checkout checks.

The output matches the primary package and alternate-runner matrix:

render SHA-256: 440b6306c5306a6aef01c83f96cb3a00eb2b42c38be78aebf9ef1e4682920415
render bytes:   4745
resources:      4
source blobs:   7
NATS / OTLP:    4222 / 4318, both permitted

Artifact archive digests:

Linux X64:    sha256:4b9dfa4211c1643459ff57539f636d3138a57dab1f45a502b04eef8bc7bb0924
macOS ARM64:  sha256:e194594a82976d1aee9b3d5dcf6d07fa7ceaee3e7f13f56f6cbfe5314e3e1d79
Windows X64: sha256:f33315997d5987980cb8c0db0def12e2646e6478c648af0dbb85926d6c982dcd

This PR is ready for review. It reproduces the immutable package from a second test repository and performs no private checkout, deployment, publication, or cloud/cluster mutation.