diff --git a/.artifacts/task-15/automated-gates.json b/.artifacts/task-15/automated-gates.json index 7fbeabc7..d43db3c2 100644 --- a/.artifacts/task-15/automated-gates.json +++ b/.artifacts/task-15/automated-gates.json @@ -1,13 +1,21 @@ { - "schema": "thothii-task15-gates-v2", + "schema": "thothii-task4-certification-v1", "generated_on": "2026-08-18", + "started_at_utc": "2026-08-18T09:26:00Z", + "ended_at_utc": "2026-08-18T09:48:36Z", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "source_immutability": { + "status": "PASS", + "tracked_changes_after_freeze": false, + "allowed_untracked": [".playwright-cli/", ".thothctl/"] + }, "source_commits": { - "authentication_round1": "2b618c5a0f6f07045700cfe7146ca517fb5f78ab", - "fix_round2": "fe190e7046acc173f510dddcb32f46ed142858c1", - "maintenance_profile_follow_up": "4d230b87afdcd24f02264f8f937c8628b92db05a", - "fix_round3_and_final_docker": "e20bf33e2a00102192e5be66b178037aeca3a7b1", - "fix_round4_streamed_archive_privacy": "54698e73400a54ce7c3e6c10099e14eb471ce8b9", - "fix_round5_retained_handle_private_creation": "74b062f1a737103524cbe706346cfd65f87cdfd1" + "task4_candidate": "b31b27e5845ffd3adf311429367319beaba263c7", + "task1": "d43738eeae6d14bb5e470093058b069a983f5372", + "task2": "5f9a3ae066a060b43a11a959b60a1efadd1c2425", + "task3": "0d8e707533fada938c99eb06f8457150e7ef2b40", + "task3_follow_up": "b31b27e5845ffd3adf311429367319beaba263c7", + "historical_task15_final": "74b062f1a737103524cbe706346cfd65f87cdfd1" }, "versions": { "node_contract": "v24.16.0", @@ -16,6 +24,59 @@ "pi": "0.80.3" }, "retained_report": ".superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md", + "task4_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md", + "workflow": { + "run_id": "32122302381", + "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381", + "event": "workflow_dispatch", + "head_sha": "b31b27e5845ffd3adf311429367319beaba263c7", + "status": "completed", + "conclusion": "failure", + "windows_job": { + "name": "Windows clone and Compose contract", + "job_id": "95665197885", + "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885", + "conclusion": "failure", + "native_step": "Run native Windows retained-capability tests", + "native_step_conclusion": "failure", + "command": "go test ./internal/safeio ./internal/backup -count=1", + "requested_packages": ["internal/safeio", "internal/backup"], + "executed_packages": ["internal/safeio", "internal/backup"], + "not_executed_packages": ["internal/authstorage"], + "focused_tests_observed": [ + "TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion", + "TestRemoveCanonicalPrivateClaimPreservesOrphan", + "TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup" + ], + "failure_categories": [ + "safeio retained-capability tests failed with unsafe file", + "backup retained-staging tests failed with unsafe file", + "backup TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup timed out after 10m0s", + "some backup fixture tests could not read their external-secret declarations" + ] + }, + "lf_compose_docs_typescript_job": { + "name": "LF, Compose, docs, and TypeScript", + "job_id": "95665197839", + "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197839", + "conclusion": "failure", + "failed_step": "Verify Compose and installation contracts", + "category": "baseline_ci_contract", + "detail": "unified Compose contract passed; test-no-deployment-coupling-scope.sh stopped on TMPDIR: unbound variable", + "downstream_steps": "skipped" + }, + "linux_docker_job": { + "name": "Linux Docker deployment and rollback", + "job_id": "95665197846", + "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197846", + "conclusion": "failure", + "failed_step": "Run unified deployment smoke", + "category": "infrastructure_prerequisite", + "detail": "Task 13 smoke failed before deployment because rg is required", + "cleanup": "PASS", + "image_manifest": "not_generated" + } + }, "docker_image_evidence": { "authentication_smoke": { "status": "PASS", @@ -23,100 +84,130 @@ "reason": "no_docker_images_exercised" }, "unified_docker_smoke": { - "status": "PASS", - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1", - "run_id": "20260818070637-66409-30058", + "status": "FAIL", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "run_id": "32122302381", + "workflow_job_id": "95665197846", "manifest": ".artifacts/task-15/unified-docker-images.json", - "manifest_sha256": "9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6", - "images": 5, - "cleanup": "PASS" + "reason": "workflow attempt stopped before deployment because rg is required", + "cleanup": "PASS", + "images": 0, + "historical": { + "status": "PASS", + "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1", + "run_id": "20260818070637-66409-30058", + "manifest_sha256": "9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6", + "images": 5, + "cleanup": "PASS" + } } }, "gates": { - "task13_lifecycle_carry_ins": { + "posix_registry_ownership": { "status": "PASS", - "evidence": "focused_backup_red_green_full_go_race_build" + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "evidence": "backend Node 24 full suite including local-registry ownership coverage" }, - "platform_private_restore_staging": { + "stagearchive_unix_retained_capability": { "status": "PASS", - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1", - "evidence": "safeio_unix_ancestor_swap_red_green_and_windows_rootdirectory_static_cross_compile" + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "evidence": "focused safeio/backup tests, Go race suite, and Unix ancestor-swap coverage" }, - "provider_fixture": { - "status": "PASS", - "tests": 6, - "node": "v24.16.0" + "windows_claim_retained_capability": { + "status": "FAIL", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "evidence": "native Windows workflow step failed" }, - "backend_node24_round1": { - "status": "PASS", - "tests": 1081, - "files": 75 + "workflow_lf_compose_docs_typescript": { + "status": "FAIL", + "classification": "baseline_ci_contract", + "reason": "TMPDIR was unset after the unified Compose contract passed" }, - "frontend_node24_round1": { - "status": "PASS", - "tests": 444, - "files": 61 + "workflow_linux_docker": { + "status": "FAIL", + "classification": "infrastructure_prerequisite", + "reason": "runner did not provide rg; cleanup proof passed and no image manifest was generated" }, - "authentication_and_f1_smoke": { + "go_security_build": { "status": "PASS", - "playwright": 8, - "files": 2, - "node": "v24.16.0", - "sentinel_leak_scan": "PASS", - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1" - }, - "go_race_build": { - "status": "PASS", - "packages": 18, - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1" + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "focused_packages": 3, + "race_packages": 18, + "focused_test": "PASS", + "race": "PASS", + "vet": "PASS", + "host_build": "PASS" }, "windows_cross_compile": { "status": "PASS", - "packages": 18, - "execution": "cross_compile_only_not_native_execution", - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1" + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "focused_test_packages": 2, + "cli_build": "PASS", + "execution": "cross_compile_only_not_native_execution" }, - "shell_and_compose_contracts": { + "backend_node24": { "status": "PASS", - "checks": [ - "shell_syntax", - "unified_smoke_self_test", - "default_compose", - "unified_compose", - "compose_secret_policy" - ], - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1" + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "node": "v24.16.0", + "files": 76, + "tests": 1092, + "typecheck": "PASS", + "build": "PASS", + "note": "an initial full run had one workspace-registry timeout; focused rerun and complete rerun passed" + }, + "frontend_node24": { + "status": "PASS", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "node": "v24.16.0", + "files": 61, + "tests": 444, + "typecheck": "PASS", + "build": "PASS" + }, + "authentication_and_f1_smoke": { + "status": "PASS", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "node": "v24.16.0", + "filtered_e2e": "1 passed", + "sentinel_leak_scan": "PASS" + }, + "harness_pytest": { + "status": "FAIL", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "passed": 951, + "failed": 1, + "skipped": 4, + "subtests": 232, + "failure": "test_column_decisions::test_f4_emits_column_types: workflow.yaml not found from harness test cwd" + }, + "authentication_docs": { + "status": "PASS", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7" + }, + "shell_syntax": { + "status": "PASS", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7" + }, + "authentication_smoke_runtime": { + "status": "PASS", + "node": "v24.16.0", + "sentinel_leak_scan": "PASS" + }, + "compose_default": { + "status": "FAIL", + "reason": "required THT_WORKSPACE_GIT_REMOTE was not available" + }, + "compose_unified": { + "status": "FAIL", + "reason": "compose.unified.yaml is absent from the frozen source" }, "unified_docker_smoke": { - "status": "PASS", - "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1", - "run_id": "20260818070637-66409-30058", - "images": 5, - "cleanup": "PASS" - }, - "harness_pytest_round1": { - "status": "PASS", - "passed": 921, - "l2_deselected": 4 - }, - "authentication_docs_round1": { - "status": "PASS" - }, - "windows_native": { - "status": "PENDING", - "reason": "required_host_prerequisites_unavailable" - }, - "l2": { - "status": "PENDING", - "reason": "configured_secret_layout_unavailable" - }, - "manual_psd": { - "status": "PENDING", - "reason": "real_identity_or_access_unavailable" - }, - "provider_readiness": { - "status": "PENDING", - "reason": "unrelated_host_port_occupied" + "status": "FAIL", + "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7", + "workflow_run_id": "32122302381", + "reason": "remote workflow attempted the smoke but stopped before deployment because rg is required", + "cleanup": "PASS", + "image_manifest": "not_generated" }, "ruff": { "status": "FAIL", @@ -125,25 +216,49 @@ }, "mkdocs_strict": { "status": "FAIL", - "warnings": 69, - "classification": "known_baseline" + "classification": "not_reached_after_stop", + "historical_status": "FAIL", + "historical_warnings": 69 }, "canonical_install_docs": { "status": "FAIL", - "classification": "existing_manual_wording_mismatch" + "classification": "not_reached_after_stop", + "historical_status": "FAIL" }, "workspace_install_docs": { "status": "FAIL", - "classification": "existing_manual_wording_mismatch" + "classification": "not_reached_after_stop", + "historical_status": "FAIL" }, "pi_user_auth_compose": { "status": "FAIL", - "classification": "existing_model_policy_mismatch" + "classification": "not_reached_after_stop", + "historical_status": "FAIL" }, "deployment_coupling": { "status": "FAIL", - "classification": "protected_ignored_local_material" + "classification": "not_reached_after_stop", + "historical_status": "FAIL" + }, + "l2": { + "status": "PENDING", + "reason": "configured secret layout unavailable; gate not run after stop" + }, + "manual_psd": { + "status": "PENDING", + "reason": "approved real identity/access unavailable; gate not run after stop" + }, + "provider_readiness": { + "status": "PENDING", + "reason": "provider prerequisite unavailable; gate not run after stop" } }, - "release_complete": false + "review": { + "three_important_findings_closed": false, + "verdict": "CHANGES_REQUIRED", + "reason": "native Windows retained-capability tests failed; the frozen workflow omits internal/authstorage from its native command" + }, + "release_complete": false, + "authentication_implementation_complete": false, + "release_readiness": "FAIL" } diff --git a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md index a3fa7f34..38549610 100644 --- a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md +++ b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md @@ -1,5 +1,35 @@ # Task 15 retained release-gate report — fix round 5 (sanitized) +## Task 4 recertification addendum — frozen source `b31b27e5845ffd3adf311429367319beaba263c7` + +This addendum supersedes the earlier source-bound matrix for current certification while preserving +the fix-round-5 material below as historical provenance. + +- Certification status: `FAIL` / `CHANGES_REQUIRED`; no tracked source changed after the freeze. +- Native Windows workflow run `32122302381` was dispatched on the exact frozen SHA and concluded + `failure`. Job `Windows clone and Compose contract` (`95665197885`) executed the native + `safeio`/`backup` test command, which failed; `internal/authstorage` was not part of that frozen + workflow command. +- Local current results: Go focused/race/vet/build and Windows cross-compile PASS; Node 24 backend + `76 files / 1092 tests`, frontend `61 files / 444 tests`, typechecks/builds and authentication + smoke PASS; harness `951 passed / 1 failed / 4 skipped`, Ruff `192` errors, and Compose contracts + FAIL; authentication docs and shell syntax PASS. +- The same run's `LF, Compose, docs, and TypeScript` job (`95665197839`) failed on an unset `TMPDIR` + in the deployment-coupling scope script after its unified Compose contract passed; this is a + baseline/CI contract issue. Its Linux Docker job (`95665197846`) stopped before deployment because + `rg` was unavailable; cleanup proof passed and no image manifest was generated, so this is an + infrastructure prerequisite issue rather than a source-bound Docker result. +- The remote unified Docker smoke attempt therefore failed before deployment; the existing image + manifest below remains historical and is not evidence for the new source. +- Current machine-readable evidence and the requested Task 4 report are recorded in + `.artifacts/task-15/automated-gates.json` and + `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`. +- Current automated-gates SHA-256: `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`. +- Historical unified Docker manifest SHA-256: `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`. + +The complete sanitized Task 4 matrix and the separate remediation/release verdicts are in the +requested Task 4 report. + - Final tested source commit: `74b062f1a737103524cbe706346cfd65f87cdfd1`. - Historical retained source commits: fix-round-2 `fe190e7046acc173f510dddcb32f46ed142858c1`, maintenance follow-up `4d230b87afdcd24f02264f8f937c8628b92db05a`, prior final Docker @@ -7,7 +37,7 @@ archive privacy `54698e73400a54ce7c3e6c10099e14eb471ce8b9`. - Versions: Node contract `v24.16.0`; host default Node `v25.6.1`; Go `go1.26.5`; Pi `0.80.3`. -- Automated gate artifact: `.artifacts/task-15/automated-gates.json`; +- Historical automated gate artifact: `.artifacts/task-15/automated-gates.json`; SHA-256 `7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`. - Docker image manifest: `.artifacts/task-15/unified-docker-images.json`; SHA-256 `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`. diff --git a/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md new file mode 100644 index 00000000..d01a831d --- /dev/null +++ b/.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md @@ -0,0 +1,97 @@ +# Task 4 authentication remediation recertification (sanitized) + +## Result + +- Frozen source under test: `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`. +- Freeze check: PASS. No tracked source changed during certification. The only untracked paths + retained are `.playwright-cli/` and `.thothctl/`. +- Certification window: `2026-08-18T09:26Z` to `2026-08-18T09:48:36Z` (UTC; the start marker is + minute-precision because no earlier second-level operator timestamp was captured). +- Overall result: `FAIL` / `CHANGES_REQUIRED`. The three Important findings are not closed and + authentication is not implementation-complete or release-complete. + +## Local gate matrix + +| Gate | Result | Sanitized evidence | +|---|---|---| +| Go focused security tests | PASS | `safeio`, `backup`, and `authstorage`; 3 packages | +| Go race/vet/host build | PASS | 18 race-tested packages; vet and host CLI build exit 0 | +| Windows amd64 cross-compile | PASS | focused safeio/backup test binaries and CLI build; compile-only | +| POSIX registry ownership | PASS | Node 24 backend suite includes local-registry ownership coverage | +| Unix StageArchive retained capability | PASS | focused safeio/backup and race coverage passed on host | +| Backend Node 24 | PASS | 76 files / 1092 tests; typecheck and build passed | +| Frontend Node 24 | PASS | 61 files / 444 tests; typecheck and build passed | +| Authentication/F1 browser smoke | PASS | Node `v24.16.0`; filtered E2E 1 passed; sentinel scan passed | +| Harness pytest | FAIL | 951 passed, 1 failed, 4 skipped, 232 subtests; `test_f4_emits_column_types` could not find `workflow.yaml` from its test cwd | +| Ruff | FAIL | 192 errors; known baseline | +| Authentication docs smoke | PASS | required-term and forbidden-word checks passed | +| Shell syntax | PASS | `bash -n scripts/*.sh` | +| Default Compose contract | FAIL | required `THT_WORKSPACE_GIT_REMOTE` was unavailable | +| Unified Compose contract | FAIL | `compose.unified.yaml` is absent from the frozen source | +| Unified Docker smoke | FAIL | workflow attempted it on the frozen SHA but stopped before deployment because `rg` was unavailable; cleanup proof passed and no new image manifest was generated | +| L2 / PSD manual / provider readiness | PENDING | required external secrets, identities/access, or provider prerequisites unavailable/not reached | + +The first full backend Vitest attempt had one workspace-registry timeout. The focused test and a +fresh complete rerun passed, so the current backend result above is the fresh complete rerun. + +## Native Windows authority + +The authorized dispatch was bound to the frozen SHA: + +- Run: `32122302381` +- URL: https://github.com/mptyl/ThothII/actions/runs/32122302381 +- Head SHA: `b31b27e5845ffd3adf311429367319beaba263c7` +- Workflow conclusion: `failure` +- Job: `Windows clone and Compose contract`, job `95665197885` +- Job URL: https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885 +- Native step: `Run native Windows retained-capability tests` — `failure` +- Executed command: `go test ./internal/safeio ./internal/backup -count=1` +- Observed focused failures include `TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion` + and `TestRemoveCanonicalPrivateClaimPreservesOrphan`. +- The backup package timed out in + `TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup` after `10m0s`. +- Additional backup failures included retained-staging `unsafe file` results, Windows temporary-file + cleanup reporting that a file was still in use, and fixture cases that could not read external + secret declarations. The first two categories are remediation/security-boundary failures; the + fixture declaration failures are recorded as an accompanying CI-fixture issue. +- `internal/authstorage` was not requested by the frozen workflow step and therefore has no native + Windows execution evidence. Cross-compilation does not substitute for this gate. + +This native failure is the blocking gate. No source fix was attempted, and no later Docker smoke +was run locally after the failure. + +## Other workflow failures + +- `LF, Compose, docs, and TypeScript` (job `95665197839`) failed in + `Verify Compose and installation contracts` after the unified Compose contract itself passed. + `test-no-deployment-coupling-scope.sh` aborted on `TMPDIR: unbound variable`; this is classified + as a baseline/CI contract prerequisite, and later docs/TypeScript steps were skipped. +- `Linux Docker deployment and rollback` (job `95665197846`) failed before deployment because the + runner did not provide `rg` (`Task 13 smoke failed: rg is required`). The sanitized cleanup proof + passed and no Docker image manifest was generated. This is classified as an infrastructure + prerequisite failure, not as evidence of a remediation regression. + +## Evidence and provenance + +- Current machine-readable matrix: `.artifacts/task-15/automated-gates.json`; SHA-256 + `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`. +- Current requested report: this file (SHA-256 recorded after the evidence commit if needed for + external indexing). +- Historical Docker image manifest: `.artifacts/task-15/unified-docker-images.json`, unchanged + because no new immutable-source Docker smoke ran. Its retained historical SHA-256 is + `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`, bound to historical source + `74b062f1a737103524cbe706346cfd65f87cdfd1`, not to this Task 4 candidate. +- The historical Task 15 report remains provenance for earlier source SHAs; its current addendum + records this recertification separately. + +No credentials, tokens, internal endpoints, provider identities, registry names, raw environments, +or browser traces are retained here. + +## Separate verdicts + +- Three Important findings: `CHANGES_REQUIRED`. Native Windows retained-capability authority + failed, and the frozen workflow omits the required `authstorage` package from its native command. +- Overall release readiness: `FAIL` with additional `PENDING` gates. The native Windows remediation + gate failed; the remote Docker attempt failed on a missing runner prerequisite; existing + Ruff/harness/Compose failures and external/manual prerequisites remain unresolved; and no + successful new unified Docker image evidence exists. diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md index 79866ea7..1477cc68 100644 --- a/PROJECT_STATE.md +++ b/PROJECT_STATE.md @@ -7,70 +7,41 @@ > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato. -> Last updated: 2026-08-18 (Task 15 and final whole-branch reviews recorded; both are CHANGES -> REQUIRED and the authentication feature is not implementation- or release-complete). +> Last updated: 2026-08-18 (Task 4 recertification recorded; native Windows authority failed and +> the authentication feature is not implementation- or release-complete). > Point a fresh session here ("read PROJECT_STATE.md") before substantial work. -### Task 15 authentication — automated smoke PASS, final review CHANGES REQUIRED (2026-08-18) +### Task 4 authentication recertification — FAIL, native Windows CHANGES REQUIRED (2026-08-18) -- Task 13 carry-ins are closed with focused TDD: restore acquires the lifecycle lock before - target-dependent preflight; stages the immutable candidate and recovery archives under that lock; - accounts their combined capacity before mutation; and uses an opaque installation-bound - transaction capability. Fix-round-5 makes private archive creation retain its validated parent - through the full create/metadata/failure-cleanup sequence: Unix uses `openat` plus descriptor - `fchmod`/`fstat` and `unlinkat`; Windows uses NT `RootDirectory`-relative traversal and final - create with the owner-only DACL applied in that same operation. Capacity, lifecycle, rollback, - and streaming tests pass, but the final review found that StageArchive drops the retained - capability before pathname-based staging cleanup; an ancestor swap can therefore strand the - secret-bearing archive or redirect cleanup. Deterministic StageArchive swap-and-cleanup tests are - still required on Unix and native Windows. -- Final tested source is `74b062f1a737103524cbe706346cfd65f87cdfd1`; fix-round-4 - `54698e73400a54ce7c3e6c10099e14eb471ce8b9`, prior final Docker source - `e20bf33e2a00102192e5be66b178037aeca3a7b1`, fix-round-2 - `fe190e7046acc173f510dddcb32f46ed142858c1`, and follow-up - `4d230b87afdcd24f02264f8f937c8628b92db05a` remain historical provenance. The final unified - Docker smoke is PASS for run `20260818070637-66409-30058`, exactly bound to `74b062f...`, - including maintenance auth isolation, restore, registry lifecycle, rollback, five-image - revalidation, and task-scoped cleanup. -- PASS on pinned Node `v24.16.0`: provider security fixture 6/6 and current authentication/F1 - Playwright smoke 8/8 with the runtime sentinel used as the exact fixture credential and absent - from retained output. Round-1 full suites remain PASS: backend 75 files / 1081 tests, frontend - 61 files / 444 tests, harness 921 passed / 4 L2 deselected. The host default Node is `v25.6.1`; - it is not the release contract and no tracked `v24.19.0` pin exists. -- PASS: focused RED then GREEN Unix ancestor-swap creation test; full backup/safeio tests; - final-source Go race/vet/native-host build across 18 packages; Windows amd64 static test/build - cross-compile across 18 packages; Node 24 authentication smoke; shell syntax and unified safety - self-tests; default/unified Compose and secret-policy contracts; final unified Docker smoke and - cleanup. Windows results are compile-only; the native retained-handle - `ValidatePrivateRegular` test was not executable on this host and remains PENDING. -- Durable sanitized evidence is tracked at `.artifacts/task-15/automated-gates.json` - (`7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`), - `.artifacts/task-15/unified-docker-images.json` - (`9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`), and - `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md` - (`9e4737e84bb9fb866eb0ee9ba2660f0fcfdef0c081dde11f19f6078c59b1bf56`). Authentication smoke - exercised no Docker images; the final unified run retained all five exercised image identities. -- FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69 - warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth - Compose has the existing model-policy mismatch; deployment coupling sees preserved ignored private - material. -- PENDING: native Windows execution because required host prerequisites are unavailable; real - PSD/manual acceptance because no real identity/access is available; L2 because its configured - secret layout is unavailable; isolated provider readiness because an unrelated host port is - occupied. These are not PASS claims. -- Final Task 15 review after fix round 5 is **CHANGES REQUIRED**. In addition to the StageArchive - cleanup race above, Windows claim removal closes validated retained parent handles before using - pathname-based `DeleteFile`, leaving an ancestor-swap race. The five-round breaker is exhausted; - no sixth implementation round was started. -- Final whole-branch review found one additional Important defect: on POSIX, the local-user registry - checks type, link count, and mode but not effective-UID ownership for `users.yaml` and its parent. - A foreign-owned `0600` registry can therefore remain writable by that owner and alter local - credentials or roles, including administrator access. Add fail-closed ownership checks on every - POSIX registry path and foreign-owner rejection coverage. -- **Implementation/release state: NOT COMPLETE.** Resolve both Important code-review findings and - the registry-ownership finding, rerun the affected tests/reviews, then make every required - FAIL/PENDING gate PASS in an eligible environment before marking authentication complete or - release-accepted. The branch is not ready to merge. +- Frozen source under test is `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`. + No tracked source changed during certification; only `.playwright-cli/` and `.thothctl/` remain + untracked. +- Local PASS: Go focused security tests for `safeio`, `backup`, and `authstorage`; Go race across + 18 packages; `go vet`; host build; Windows amd64 cross-compile; Node `v24.16.0` backend + `76/1092` and frontend `61/444` with typecheck/build; authentication/F1 smoke and sentinel + scan; authentication docs smoke; shell syntax. +- Local FAIL: harness `951 passed / 1 failed / 4 skipped` (the F4 column-decision test cannot find + `workflow.yaml` from its test cwd); Ruff `192` errors; default Compose missing its required + workspace-remote variable; unified Compose references absent `compose.unified.yaml`. +- Authorized workflow run `32122302381` (URL in the Task 4 report) has the exact frozen SHA and + conclusion `failure`. Its `Windows clone and Compose contract` job `95665197885` really ran the + native `safeio`/`backup` command and failed, including a 10-minute backup lifecycle-lock + timeout. The frozen workflow does not request `internal/authstorage`, so that native evidence is + absent rather than inferred from cross-compilation. +- The same run's LF/Compose/docs/TS job failed on an unset `TMPDIR` after its unified Compose + contract passed (baseline/CI contract). Its Linux Docker job failed before deployment because + `rg` was unavailable; cleanup proof passed and no new image manifest was generated (runner + prerequisite). The historical five-image manifest remains bound to source + `74b062f1a737103524cbe706346cfd65f87cdfd1` and was not rewritten for this candidate. L2, real + PSD/manual acceptance, and provider readiness remain `PENDING` where prerequisites are unavailable. +- Durable current evidence is tracked in `.artifacts/task-15/automated-gates.json` and + `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`; the historical + Task 15 report contains a separate Task 4 addendum. Current automated-gates SHA-256 is + `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`; the unchanged historical + Docker manifest SHA-256 is `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`. +- **Implementation/release state: NOT COMPLETE.** The three Important findings remain + `CHANGES_REQUIRED`; overall release readiness is `FAIL` with additional `PENDING` gates. No + source fix was attempted in Task 4. ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)