68 lines
4.0 KiB
Markdown
68 lines
4.0 KiB
Markdown
# Task 15 retained release-gate report — fix round 3 (sanitized)
|
|
|
|
- Final tested source commit: `e20bf33e2a00102192e5be66b178037aeca3a7b1`.
|
|
- Fix-round-2 commits retained unchanged: `fe190e7046acc173f510dddcb32f46ed142858c1`
|
|
and follow-up `4d230b840f99f33005a7c66566c16c48177e990b`.
|
|
- Versions: Node contract `v24.16.0`; host default Node `v25.6.1`; Go `go1.26.5`;
|
|
Pi `0.80.3`.
|
|
- Automated gate artifact: `.artifacts/task-15/automated-gates.json`;
|
|
SHA-256 `73c5c4f2b497aeda114e725f718f1e542a4c05691bd9257b6e607e55b1d02236`.
|
|
- Docker image manifest: `.artifacts/task-15/unified-docker-images.json`;
|
|
SHA-256 `835790fbff5980c494c32f4473b46675ce7d568e7e6e39e30000ff0400b4dbb7`.
|
|
|
|
## Fix-round-3 evidence
|
|
|
|
- PASS: backup staging RED/GREEN focused set `4/4`; full backup package; full Go race and build
|
|
across `18` packages. Staging now uses the repository `safeio` owner-only directory mechanisms,
|
|
rejects a symlinked installation ancestor on Unix, and includes a Windows-only owner-DACL test.
|
|
- PASS: Windows amd64 static test/build cross-compile across `18` packages. Native execution of
|
|
the Windows-only ACL test was not available and is therefore PENDING, not PASS.
|
|
- PASS on Node `v24.16.0`: deterministic provider security fixture `6/6`; authentication smoke
|
|
`8/8` across `frontend/e2e/auth.spec.ts` and authenticated `frontend/e2e/f1.spec.ts`. The
|
|
runtime sentinel was the exact fixture OIDC client secret and group bearer, and the retained
|
|
output leak scan passed.
|
|
- PASS: shell syntax, unified-smoke safety self-tests, default/unified Compose contracts, and
|
|
Compose secret policy.
|
|
- PASS: final unified Docker deployment smoke run `20260818054002-16619-2452`, bound to source
|
|
commit `e20bf33e2a00102192e5be66b178037aeca3a7b1`. It exercised the maintenance authentication
|
|
isolation check, restore, registry lifecycle, bad-candidate rollback, image revalidation, and
|
|
task-scoped cleanup.
|
|
- PASS: Docker image traceability for all `5` images exercised by the final unified run. The
|
|
authentication browser smoke exercised no Docker images and is explicitly retained as an empty
|
|
image set.
|
|
|
|
## Sanitized Docker image identities
|
|
|
|
- `sha256:2008d4ef3b7c37ff2504a5257a3e946650795c1dbd16706fd22792e5503cbfa6`;
|
|
roles `compose-runtime`, `fixture-runtime`.
|
|
- `sha256:57f573b47f1f71ebb445789f279fe3e596a8beab182f7cf486db9205bad87c5a`;
|
|
role `compose-runtime`.
|
|
- `sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c`;
|
|
role `compose-runtime`.
|
|
- `sha256:98b79ea45d588a71ba2a5218e4b56365cb55dd00eead4a8fd5a4381b1bb0d79d`;
|
|
role `compose-runtime`.
|
|
- `sha256:c3cbe1cc1aa588a64951ac6286e0df7b27fe2e6324b1001c619bb358770c0178`;
|
|
role `rollback-candidate`.
|
|
|
|
For each image, the retained repository-digest component equals the listed image digest. Registry
|
|
names and credentials are deliberately omitted.
|
|
|
|
## Complete observed matrix
|
|
|
|
- PASS: Task13 lifecycle carry-ins; platform-private restore staging; provider fixture `6/6`;
|
|
backend Node24 round-1 suite `75 files / 1081 tests`; frontend Node24 round-1 suite
|
|
`61 files / 444 tests`; current authentication/F1 browser smoke `8/8`; Go race/build
|
|
`18 packages`; Windows static cross-compile `18 packages`; harness round-1 suite
|
|
`921 passed / 4 L2 deselected`; authentication docs round-1 gate; shell/Compose contracts;
|
|
unified Docker smoke; five-image traceability; Docker cleanup.
|
|
- FAIL: Ruff `192` known-baseline errors; MkDocs strict `69` known-baseline warnings; existing
|
|
canonical/workspace install wording checks; existing Pi model-policy check; deployment-coupling
|
|
scan against preserved ignored private material.
|
|
- PENDING: native Windows execution because required host prerequisites are unavailable; L2
|
|
because the configured secret layout is unavailable; real PSD/manual acceptance because no real
|
|
identity/access is available; isolated provider readiness because an unrelated host port is
|
|
occupied.
|
|
|
|
The authentication feature is **not release-complete** while required FAIL or PENDING gates remain.
|
|
No secret values, real identities, internal endpoints, or registry names are retained.
|