From 3e59845454f5315e955734db7fe598ec4ba4cf70 Mon Sep 17 00:00:00 2001 From: fwazb Date: Mon, 20 Jul 2026 18:05:26 -0700 Subject: [PATCH] Record PR 182 rebuild state --- docs/workstreams/gcp-leoclean/goals.md | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/docs/workstreams/gcp-leoclean/goals.md b/docs/workstreams/gcp-leoclean/goals.md index 4539be9..662d787 100644 --- a/docs/workstreams/gcp-leoclean/goals.md +++ b/docs/workstreams/gcp-leoclean/goals.md @@ -20,25 +20,24 @@ cut over safely and retire the VPS after soak. - Complete: PR #179 least-privilege PostgreSQL authority is merged on main. - Complete: the revision-bound, structurally no-send runtime from PR #183 is merged into `main` at `2d88c9765bd9b43641d1efb04a1118c5ce0bce39`. -- Published for human review: PR #182 was rebuilt directly on that baseline at - `5bcdaa4`; the required identity and OCI corrections are being integrated - locally before exact-revision review. +- Rebuilt from current `main`: PR #182 contains only the four functional + no-send service-package commits. The two stale proof-only commits were not + replayed; this file is the single replacement evidence update. - PR #193 is source material only. It must not be merged wholesale; only the required identity-binding and OCI-lifecycle corrections belong in the narrow #182/#183 stack. -- In progress locally: the narrow package correction based on `d962555` now - binds every packaged and synthetic-identity source byte to its reviewed Git - blob and makes container health bind the packaged/live config plus the exact - sealed no-send tool and plugin surface. Independent review found these gaps; - the corrective diff still requires exact-revision tests before publication. +- Complete in the rebuilt code candidate: the narrow package correction binds + every packaged and synthetic-identity source byte to its reviewed Git blob; + container health binds the packaged/live config plus the exact sealed + no-send tool and plugin surface; and the disposable image smoke binds the + bootstrap user, entrypoint, command, healthcheck, and stop signal. - Separate follow-up: candidate release finalization does not inspect Artifact Registry. A narrow deployment-evidence slice must bind the immutable remote digest, `linux/amd64` manifest/config, labels, input hash, and source revision before any unit can be installed. -- Next gate: commit the local correction with the configured human Git - identity, run focused/full and disposable OCI proof against that exact - revision, then stop for publication approval. No publication, merge, or - deployment is implied by local validation. +- Current gate: obtain a clean exact-head CI run and exact-revision human + review. Rebuilding or publishing the branch does not authorize merge or + deployment. - Not yet live-proven: staging VM/container engine, IAM/Secret Manager, Cloud SQL effective identity, restart behavior, or model/database parity.