Task 4 authentication remediation recertification (sanitized)

Fix-round-2 recertification — remediation PASS

Exact source: 2a9359071257f9b8a71d36ec2bbb25b161003f81 on feat/thoth-auth.
Authorized workflow: completed run 32147345625, https://github.com/mptyl/ThothII/actions/runs/32147345625, exact matching head SHA.
Native job: Windows clone and Compose contract, job 95744249248.
Required native step: Run native Windows retained-capability tests — PASS.
Exact unfiltered command: go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1.
Package evidence: internal/safeio PASS (22.058s), internal/backup PASS (7.161s), internal/authstorage PASS (16.088s). This includes explicit native Windows StageArchive retained-capability and concurrent claim-consume coverage.
The later Verify Windows clone contract step failed independently at scripts/test-windows-clone-contract.ps1:208: PowerShell parsed $remoteYaml: as an invalid variable reference. This baseline deployment-contract failure does not change the native Go package result.
The optional Native Windows Docker Desktop/WSL2 startup job was skipped by workflow conditions. It is NOT_RUN / BLOCKED, because no Docker Desktop/WSL2 command executed.
The workflow reached completed with conclusion failure: the native authentication step is PASS, while the later clone-contract, LF/Compose, and Linux Docker baseline steps are FAIL.
Existing LF/Compose job 95744249458 and Linux Docker job 95744249354 failures repeated before downstream work. Skipped commands are NOT_RUN / BLOCKED, not executed failures. External L2/PSD/provider gates remain PENDING.

Finding disposition is explicit: the three original remediation Important findings remain RESOLVED; the fix-round-2 lifecycle Important is ADDRESSED; and the temporary Windows diagnostic-matrix Minor is ADDRESSED. Authentication remediation is PASS. This does not change overall release readiness: executed baseline gates remain FAIL, while unavailable external/manual gates remain PENDING.

The section below is retained as historical evidence for the pre-fix frozen source.

Historical pre-fix result

Frozen source under test: b31b27e5845ffd3adf311429367319beaba263c7 on feat/thoth-auth.
Freeze check: PASS. No tracked source changed during certification. The only untracked paths retained are .playwright-cli/ and .thothctl/.
Certification window: 2026-08-18T09:26Z to 2026-08-18T09:48:36Z (UTC; the start marker is minute-precision because no earlier second-level operator timestamp was captured).
Overall result: FAIL / CHANGES_REQUIRED. The three Important findings are not closed and authentication is not implementation-complete or release-complete.

Local gate matrix

Gate	Result	Sanitized evidence
Go focused security tests	PASS	`safeio`, `backup`, and `authstorage`; 3 packages
Go race/vet/host build	PASS	18 race-tested packages; vet and host CLI build exit 0
Windows amd64 cross-compile	PASS	focused safeio/backup test binaries and CLI build; compile-only
POSIX registry ownership	PASS	Node 24 backend suite includes local-registry ownership coverage
Unix StageArchive retained capability	PASS	focused safeio/backup and race coverage passed on host
Backend Node 24	PASS	76 files / 1092 tests; typecheck and build passed
Frontend Node 24	PASS	61 files / 444 tests; typecheck and build passed
Authentication/F1 browser smoke	PASS	Node `v24.16.0`; filtered E2E 1 passed; sentinel scan passed
Harness pytest	FAIL	951 passed, 1 failed, 4 skipped, 232 subtests; `test_f4_emits_column_types` could not find `workflow.yaml` from its test cwd
Ruff	FAIL	192 errors; known baseline
Authentication docs smoke	PASS	required-term and forbidden-word checks passed
Shell syntax	PASS	`bash -n scripts/*.sh`
Default Compose contract	FAIL	required `THT_WORKSPACE_GIT_REMOTE` was unavailable
Unified Compose contract	FAIL	`compose.unified.yaml` is absent from the frozen source
Unified Docker smoke	FAIL	workflow attempted it on the frozen SHA but stopped before deployment because `rg` was unavailable; cleanup proof passed and no new image manifest was generated
L2 / PSD manual / provider readiness	PENDING	required external secrets, identities/access, or provider prerequisites unavailable/not reached

The first full backend Vitest attempt had one workspace-registry timeout. The focused test and a fresh complete rerun passed, so the current backend result above is the fresh complete rerun.

Native Windows authority

The authorized dispatch was bound to the frozen SHA:

Run: 32122302381
URL: https://github.com/mptyl/ThothII/actions/runs/32122302381
Head SHA: b31b27e5845ffd3adf311429367319beaba263c7
Workflow conclusion: failure
Job: Windows clone and Compose contract, job 95665197885
Job URL: https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885
Native step: Run native Windows retained-capability tests — failure
Executed command: go test ./internal/safeio ./internal/backup -count=1
Observed focused failures include TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion and TestRemoveCanonicalPrivateClaimPreservesOrphan.
The backup package timed out in TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup after 10m0s.
Additional backup failures included retained-staging unsafe file results, Windows temporary-file cleanup reporting that a file was still in use, and fixture cases that could not read external secret declarations. The first two categories are remediation/security-boundary failures; the fixture declaration failures are recorded as an accompanying CI-fixture issue.
internal/authstorage was not requested by the frozen workflow step and therefore has no native Windows execution evidence. Cross-compilation does not substitute for this gate.

This native failure is the blocking gate. No source fix was attempted, and no later Docker smoke was run locally after the failure.

Other workflow failures

LF, Compose, docs, and TypeScript (job 95665197839) failed in Verify Compose and installation contracts after the unified Compose contract itself passed. test-no-deployment-coupling-scope.sh aborted on TMPDIR: unbound variable; this is classified as a baseline/CI contract prerequisite, and later docs/TypeScript steps were skipped.
Linux Docker deployment and rollback (job 95665197846) failed before deployment because the runner did not provide rg (Task 13 smoke failed: rg is required). The sanitized cleanup proof passed and no Docker image manifest was generated. This is classified as an infrastructure prerequisite failure, not as evidence of a remediation regression.

Evidence and provenance

Current machine-readable matrix: .artifacts/task-15/automated-gates.json; SHA-256 6c516db5c2064c4a4a2e5f25961b993cd4a8fe020bbbb822fbac7faa0c119599.
Current requested report: this file (SHA-256 recorded after the evidence commit if needed for external indexing).
Current fix-round report: .superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-2-report.md.
Historical Docker image manifest: .artifacts/task-15/unified-docker-images.json, unchanged because no new immutable-source Docker smoke ran. Its retained historical SHA-256 is 9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6, bound to historical source 74b062f1a737103524cbe706346cfd65f87cdfd1, not to this Task 4 candidate.
The historical Task 15 report remains provenance for earlier source SHAs; its current addendum records this recertification separately.

No credentials, tokens, internal endpoints, provider identities, registry names, raw environments, or browser traces are retained here.

Separate verdicts

Three Important findings: CHANGES_REQUIRED. Native Windows retained-capability authority failed, and the frozen workflow omits the required authstorage package from its native command.
Overall release readiness: FAIL with additional PENDING gates. The native Windows remediation gate failed; the remote Docker attempt failed on a missing runner prerequisite; existing Ruff/harness/Compose failures and external/manual prerequisites remain unresolved; and no successful new unified Docker image evidence exists.

8.4 KiB Raw Blame History