cesnimda
38 lines
5.0 KiB
Markdown
38 lines
5.0 KiB
Markdown
# P9-REQUAL-01 — Hosted CI and Phase 9 Requalification
|
||
|
||
Approved specification: owner's P9-REQUAL-01 mission and implementation plan in this conversation.
|
||
Baseline: `549b2cba5a791862ba3f854312ea819a86dc42a0`; branch `fix/p9-ci-and-requalification`.
|
||
Main must remain `5f835e54a9b74e6b71418422e28431b2af06453f`.
|
||
|
||
## Tasks
|
||
|
||
1. Verify baseline/raw evidence; register RD01–RD28, Phase9 findings, M09-01–10 and57 preservation groups with independently sourced Phase9/Phase10/production/debt gates.
|
||
2. Investigate Gitea1.26/act_runner0.4.1 service isolation. Change only the database-test workflow. Prefer private runner-managed services after isolation/lifecycle proof; otherwise retain BLOCKED and provide an operator handoff. Never add a host socket, privileges, public ports, DinD or production access.
|
||
3. Map RD21 closure; reproduce safe outstanding observations, minimally repair confirmed in-scope defects, provide human test cards, and run a15minute isolated MariaDB workload with250 applications/two paced readers and exact before/after state checks.
|
||
4. Freeze rebuilt source/artifacts; run full backend/frontend/browser/contracts/MariaDB/sidecar/security/types/lint/build/PDF/preservation lanes. Retain exact membership, failures, exclusions, process exits and source/report hashes.
|
||
5. Independent whole-branch review; bounded fixes and affected successors; publish dated addendum, five verdicts, next action, exact commit/remote/main verification.
|
||
|
||
## Boundaries and accounting
|
||
|
||
No Phase10 implementation, SQLite retirement, DB-version change, production operations, main merge or force push.
|
||
No manual/physical-device/provider semantics claim from automation. C11/P5-13 stays withheld.
|
||
Existing1,123backend/32MariaDB/1MariaDBbrowser/18diagnostic/3volume results are historical, not fresh runs.
|
||
Use fresh `.artifacts/p9-requal-01/` paths, zero hidden retries/skips and independent durable reads.
|
||
Production-only gates do not automatically veto Phase9. Conditional Phase10 requires explicit authoritative carry-forward eligibility.
|
||
|
||
## Execution ledger
|
||
|
||
- Entry: clean baseline/remote equality and RD21 ancestry verified during planning; clean entry rechecked before branch creation.
|
||
- Ruling: use the clean existing checkout on the explicitly requested dedicated branch; retain installed tooling and historical raw evidence, without creating another checkout or asking for routine confirmation.
|
||
- Pre-flight: CI transport changes may affect fixture guards; keep default loopback protection and require verified private lifecycle before adding any CI-service endpoint. Performance source is separate; execute its workload without other qualification workloads.
|
||
- Task1: started. Task2: started. Task3: started. Task4/5: pending.
|
||
- Task2: complete safe workflow checkpoint `75cd04c`; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker.
|
||
- Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass.
|
||
- Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items.
|
||
- Source checkpoint `1a1b7c8`: register/manual/harness package published; later Python advisory review adds its independent open security gate. Hosted849 confirms the isolation blocker at this source checkpoint.
|
||
- Harness findings: record schema ownership before diagnostic writes; make nested config server working directories explicit; compare canonical Career storage using its actual null-property omission, keeping exact before/after SQL equality. All failures and predecessor manifests retained; independent review confirms the narrow fixes.
|
||
- Actual provider defect: sustained preflight `/documents` fails with mixed-collation UNION on MariaDB. Three real RED cases reproduce it; provider-only name-projection repair `2b26953` passes those cases and the full35-case provider suite. Backend1123 also passes; no schema or table-collation migration.
|
||
- Hardened harness checkpoint `5ac1154` published. Fresh frontend934/105, backend1123, MariaDB35, sidecar56, types/lint/build and existing security helpers pass. Fresh static/API artifacts plus1043 runtime inputs and14 qualification-helper inputs are frozen before a new complete serial browser regression. Register now58 findings; all57 preservation groups/33 routes retained. Performance/Linux/final publication remain pending their actual results.
|
||
|
||
- Final checkpoint: all runtime lanes completed; ordinary362, real MariaDB35 plus browser1/HTTP2/workload PASS. Linux producers5 PASS but unchanged PDF oracles13/24 PASS; Python advisory gate OPEN. Register59; Phase9/Phase10/production NO-GO, hosted BLOCKED, bounded RD21 RESOLVED. Final deliverables and publication receipt are indexed in README.md. No Phase10 work.
|