Qualify the selected current SVG successor through the full public Wizard route #4709

Activity

1. EHotwagner

   added a parent issue on Oct 19, 2026

   • [SVG-RELEASE-D] Qualify and activate the current Release-D coherent receiver successor #4644
2. EHotwagner commented on Oct 21, 2026

   

   EHotwagner

   on Oct 21, 2026

   ContributorAuthor

   More actions

   For the FS-GG.Rendering repository owner / GitHub provider: please supply an authenticated terminal receive-pack decision for the original Rendering tag intent in run 39541842303 / attempt 1, job 119031172204.

   The request was refs/tags/fs-gg-ui/v0.32.3 → 4ec6eafbbbf02264db9b0db4780c590abe0bf9cd, requested 2026-10-21 04:02:47.727566 UTC, and returned exit 1 / Unknown by 04:02:48.642629 UTC. We need evidence tied to that original transaction establishing acceptance or definite rejection/no effect, including whether any write was accepted. Retained evidence contains classification/counts only; present ref absence does not settle the original outcome. If provider evidence is unavailable, please state that explicitly.

   Please acknowledge availability by 2026-10-21 12:00 UTC. If investigation is needed, provide the actual provider-result ETA. Programme/root will check this thread at that deadline or on a reply notification; no indefinite watcher is planned.

   No credential value, grant change, new tag, retry or publication is requested. This asks only about this exact original transaction and leaves the existing Blocked hold intact.
3. EHotwagner commented on Oct 21, 2026

   

   EHotwagner

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Decision/redesign intake requested by the user on 2026-10-21. Keep this existing owner and board item for the SVG publication uncertainty rather than creating a duplicate release task.

   Decision to prepare: compare obtaining the authenticated original receive-pack disposition with qualifying a maintained SAME-original-intent settlement/uncertainty-admission route. If the owner proposes a distinct replacement release instead, first document the consequences of both releases existing, immutable candidate/tag/package identities, consumer/default migration and how original uncertainty remains accounted for. A new version or intent is not itself settlement and must not be used as a replay workaround. Present the concrete supported option and its cost/remaining evidence to the user before selecting any release effect.

   Current original operation and complete acceptance remain those in this issue. Candidate browser/accessibility success does not establish publication or full Wizard adoption. This comment records requested decision work only: no retry, publication, tag mutation, original-operation release, acceptance waiver or Status change. The existing full promise, supplier/source owners and original failures remain intact.
4. EHotwagner commented on Oct 21, 2026

   

   EHotwagner

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Home targeted triage #4516 (comment) supplies no authentic original receive-pack decision or new custodian evidence. The original run39541842303/a1/job119031172204/firstref4ec transaction and exact cut interval remain held; Programme/root and @EHotwagner/Rendering repository owner/GitHub provider retain the existing recovery route. Current ref absence or credential grants cannot settle the historical effect; no blind replay or new identity is selected.
5. EHotwagner commented on Oct 22, 2026

   

   EHotwagner

   on Oct 22, 2026

   ContributorAuthor

   More actions

   User-authorized safe redesign selects source implementation of SAME-original-intent convergence, retaining effectrendering-0323-original39509314882-a1 and original run39541842303/attempt1/job119031172204. Historical transport outcome remains Unknown unless authenticated provider evidence arrives. A separate verified current convergence claim may be accepted only under maintained qualified source, exact original receipt/producer/ref binding, immutable create-only destination policy, old-actor interference proof, and bounded workflow/event disable-drain-readback-restore gates. Present absence alone still authorizes no replay.

   Rendering source owner is WORKING in an isolated branch from765eda5; Templates PR728 and its owner remain unchanged. Root owns source review/integration, actual endpoint capability/effective policy checks, effect admission and full public receiver acceptance. Native repository metadata reports current principal admin access; endpoint capability is still separate. No workflow state, policy, credential, tag, package, notification or reservation effect has been changed. Original19 archives,186/45/15/4/27 evidence and full4709 promise remain.
6. EHotwagner commented on Oct 22, 2026

   

   EHotwagner

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Programme/root 2026-10-22: Rendering PR #1460 (read-only release-tag/App capability observer) merged as 6ff674d6f040e059e51029f5bbdd367dab9efa1f from exact head 7a0391c0. An independent exact-head review APPROVED it with no material findings: the GET-only adapter is closed, App secrets are scoped to one step after the guards, canaries are causal, the census pins exactly the two changed workflows, and settlementEligible/tagMutation/publication are hard-false. 20/20 checks pass. This is SOURCE only. Remaining, each separately root-admitted: one post-merge metadata observer dispatch to observe the actual App/installation grants; admin-identity confirmation of the ruleset digest before any admission bytes; the original receive-pack outcome stays Unknown; publisher eligibility, the public default and full #4709/#4644 acceptance stay open. Status stays In progress.
7. EHotwagner commented on Oct 22, 2026

   

   EHotwagner

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Programme/root 2026-10-22: one root-admitted post-merge observer run 39739259199 ran at attempt 1 on exact main 6ff674d6 and succeeded: result=observed, no gaps, 9 GET requests, no installation token minted, no tag or workflow mutation, no publication. Sanitized report SHA-256 1f1f5b59…ed67 is retained privately. Observed facts: App and installation identities matched; the installation has repositorySelection=all and includes the target. The grants on both are contents:write, administration:write, issues:write, pull_requests:write, organization_projects:write, packages:read, organization_administration:read, metadata:read, and no workflows permission. As a result writerPermissionCeilingCompatible=false, because the ceiling requires contents:write AND workflows:write. The Rendering ruleset census (job token, includes_parents) is empty, so immutablePolicyReady=false and digestJoinCandidate=false. Workflow inventory: 26 workflows, digest 7bc4c6eb…. Supplier inputs required before any settlement admission (org/repo admin = user): (1) grant the dispatcher App workflows: write, or select a different, correctly scoped writer route; (2) create an immutable release-tag ruleset on FS.GG.Rendering (deletion, non_fast_forward and update, with no bypass actors), as .github's release-tags-are-immutable ruleset does. Root then reconfirms the ruleset digest under the admin identity, and a fresh observer run is separately admitted. The original receive-pack outcome stays Unknown. Status → Blocked on these admin inputs.
8. EHotwagner commented on Oct 22, 2026

   

   EHotwagner

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Programme/root 2026-10-22: both admin inputs are now supplied by the user and verified. (1) The fs-gg-cross-repo-dispatch App and its FS-GG installation both grant workflows: write. Root-admitted observer 39744253808 (attempt 1, main 6ff674d6, no gaps) reports writerPermissionCeilingCompatible=true. (2) Tag ruleset 25621755 release-tags-are-immutable is active on FS.GG.Rendering with rules deletion, non_fast_forward and update. Admin-identity read: bypass_actors=[] and current_user_can_bypass=never. The include list is ~ALL plus one redundant literal pattern. The observer's immutablePolicyReady/digestJoinCandidate are false only because the job token cannot see bypass_actors, which is the expected job-token limitation; the admin read closes it, and settlement recomputes the digest as administrator anyway. Next, root separately admits same-original-intent settlement under the merged route. The original receive-pack outcome remains Unknown, and no tag was created or changed. Status → Ready.
9. EHotwagner commented on Oct 22, 2026

   

   EHotwagner

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Programme/root 2026-10-22: settlement admission ready, parked on two user-only credentials

   The user approved running the settlement now. Root prepared everything that doesn't need credentials:

   • Ruleset: release-tags-are-immutable now includes the three exact refs the settlement script requires (refs/tags/fs-gg-ui/v0.32.3, refs/tags/fs-gg-ui-template/v0.32.3, refs/tags/v0.32.3), plus ~ALL. It is active, has no bypass actors, and restricts update and deletion.
   • Admission: built and validated offline against the script's own admission() / immutable_policy() / identity / inventory checks. Admission sha256 8a1bbb69…d30c8, executor 6ff674d6, policy f081b403…, inventory 7bc4c6eb…. It is kept privately with an admin-PAT preflight tool.
   • Preconditions: all live preconditions were verified read-only:
     • no prior settlement run;
     • fenced workflows idle;
     • original artifacts unexpired and matching;
     • all three tags absent.
   • Settlement tests pass: 25/25 and 46/46.

   Freeze until the run: no merges to FS.GG.Rendering main and no edits to ruleset 25621755. Either one invalidates the admission.

   User steps:

   1. Admin PAT. Create a fine-grained token at https://github.com/settings/personal-access-tokens/new.
      • Resource owner: FS-GG. Repository: only FS.GG.Rendering. Expiry: 1 day.
      • Repository permissions: Actions: Read and write, Administration: Read, Contents: Read, Metadata: Read.
      • Save it as the Rendering secret FSGG_SETTLEMENT_ADMIN_TOKEN at https://github.com/FS-GG/FS.GG.Rendering/settings/secrets/actions.
   2. Writer. This must be an installation token of the dispatcher App, with exactly contents:write, workflows:write, metadata:read on FS.GG.Rendering. It expires after 1 hour, so do this step last, right before telling root.
      • Mint it with the App's private key (App settings → Generate a private key) via POST /app/installations/{id}/access_tokens with {"repositories":["FS.GG.Rendering"],"permissions":{"contents":"write","workflows":"write","metadata":"read"}}.
      • Save it as the secret FSGG_SETTLEMENT_WRITER_TOKEN.
      • Never paste either token into chat or an issue.
   3. Tell root. Root then runs the admin-PAT preflight, dispatches exactly one settlement run with the admission bytes, independently reviews the result, and asks the user to delete both secrets afterwards.

   The original receive-pack outcome stays Unknown until settlement establishes same-intent convergence. Status stays Ready, parked on the user.
10. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    Programme/root 2026-10-22 decision (user-delegated): the settlement will not use user-provisioned credentials. A reviewed Rendering source change will derive three separately scoped credentials inside the job:

    • writer: an App installation token, minted in-job, scoped to FS.GG.Rendering with exactly contents:write, workflows:write and metadata:read;
    • workflow pause/restore: the job's GITHUB_TOKEN with actions:write only;
    • ruleset bypass reads: a separately minted App token with administration:read only.

    Each minted token's actual permissions are verified, both App tokens are revoked at job end, and causal controls plus an independent security review apply. The previously prepared admission (8a1bbb69…) is superseded because the executor will change. Root rebuilds and re-validates it on the reviewed merge, then admits one run. The parked request for user credentials is withdrawn.
11. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    Programme/root 2026-10-22: Rendering PR #1461 merged as 34db86d0 (main tree readback equal to head tree 2b9338bf). Independent security review: APPROVE-WITH-NITS, then APPROVE on the delta. All 20 checks pass; 42/42 mutants killed. Settlement now derives three credentials in-job, each confined to a closed route set:

    • actions: the job's GITHUB_TOKEN with actions:write and contents:read only;
    • reader: an App token with administration:read and metadata:read;
    • writer: an App token with contents:write, workflows:write and metadata:read, limited to the three admitted create-only ref POSTs.

    Each mint response is checked for exact permissions and a single repository; tokens are masked; both are revoked before restore, even on failure. No user credentials are needed. The prior admission (executor 6ff674d6) is superseded.

    Before dispatching the single-use settlement: the policy digest must be the one the minted reader identity sees, because ruleset bodies can differ by caller. A refusal would burn the one run. Root therefore dispatched a source change so the rerunnable read-only observer mints the same reader token, reports the exact readerPolicySha256, and revokes it. Root then rebuilds the admission on executor 34db86d0 (or its successor), has it independently reviewed, and dispatches exactly once.
12. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Rendering PR #1462 merged as 7905b726 (independent APPROVE; 79 controls; 34/34 mutants killed). Observer run 39770740316 succeeded at attempt 1 on 7905b726: result observed, no gaps; the reader token was minted with exactly {administration:read, metadata:read} and revoked. Finding: the reader identity's ruleset body has no bypass_actors field (same field set as the job token; readerPolicySha256 92d96d90…, immutablePolicyReady=false). A settlement run would therefore refuse with 'no-bypass proof missing' and burn its single run. The observer caught this safely, which is why it was added. fdev decision: mint the reader with administration:write, which GitHub requires for bypass_actors visibility, while keeping its code-enforced confinement to GET-only ruleset/ref routes. The job already holds the App key, so this adds no capability. A source PR is dispatched. The observer is then re-run, and must show immutablePolicyReady=true and a reader digest, before the admission is rebuilt and the settlement is dispatched once.
13. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Rendering PR #1463 merged as 9e8bd516 (independent APPROVE; 20/20 CI; 12/12 mutants killed). The reader is minted with exactly {administration:write, metadata:read}, with code-enforced confinement to GET-only ruleset/ref routes. Observer re-run 39773558346 (attempt 1, 9e8bd516, observed, no gaps): reader now sees bypass_actors; readerPolicy.immutablePolicyReady=true, readerPolicySha256 2fad9ce0…, token revoked, writer ceiling compatible, workflow inventory 7bc4c6eb…. The admission is being rebuilt on executor 9e8bd516 with policySha256 = the reader digest and validated offline. It then gets an independent review, and the settlement is dispatched exactly once. Freeze: no merges to Rendering main and no edits to ruleset 25621755 until the settlement completes.
14. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: same-original-intent settlement COMPLETE. The single-use run 39774890888 ran at attempt 1 on executor 9e8bd516, with admission sha256 43af866d…. Before dispatch, an independent review returned GO; the admission was validated offline and the reader policy digest reproduced. All live preconditions were re-checked immediately before the one POST (HTTP 204).

    Receipt (settlement.json sha256 02d2a9b191ae70b662f31e6a3bf5135f6d76ebadae2bf5592ede75f3e3009255, retained privately):

    • result: passed, sameIntentConvergence: Verified;
    • refs/tags/fs-gg-ui/v0.32.3, refs/tags/fs-gg-ui-template/v0.32.3 and refs/tags/v0.32.3 → 4ec6eafbbbf02264db9b0db4780c590abe0bf9cd (the original producer intent), with pendingSubordinateRefs: [];
    • the fenced workflows (release-tags, release, template-dispatch) were disabled, drained and restored to active; cleanup: restored;
    • the writer and reader App tokens were both revoked (DELETE → 204);
    • publication and notification not-performed.

    originalTransportOutcome stays Unknown: settlement proves convergence, not what the original push did. Live readback confirms all three tags at 4ec6eafb and all fences active. The stray repo secret FSGG_SETTLEMENT_ADMIN_TOKEN (unused by the derived-credential route) is deleted. Remaining for #4709 (unchanged and separately admitted): publisher eligibility, public default, and the full public Wizard qualification. The Rendering main freeze is lifted.
15. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: 0.32.3 publisher eligibility: local read-only rehearsal passed. Publication not dispatched, awaiting root admission.

    Executor is protected Rendering main 9e8bd5167179b0283f0eb2537a184c9ed6289305. The accepted settlement is run 39774890888/a1, artifact 12423109248 (sha256 245a4dbd…56ee), receipt 02d2a9b1…9255. The checks below ran locally against the maintained release.yml publisher entry points, using GET-only reads and a simulated executor context (GITHUB_*, run id 1). They are not hosted proof.

    • Static source guard (--font-disposal-attempt --executor-fence, source 4ec6, version 0.32.3): pass. Plan sha 89369de0…, 19 roster entries.
    • Publisher custody step (--acquire-bound-artifacts): pass.
      • accepted_tag_settlement: native run/artifact provenance, receipt bytes, and live refs all match. All three 0.32.3 refs (fs-gg-ui/v0.32.3, fs-gg-ui-template/v0.32.3, v0.32.3) resolve to commit 4ec6eafb.
      • Original producer artifact 12305198394 and qualification artifact 12315224479: both unexpired, with exact digests.
      • All 19 archives match custody 7dbd4329…, and release-custody verify passes.
      • Qualification facts: 186 / 15·15·15 / 15 AT / 4 speech / 27 members.
    • F# entry release-nuget-verify-key.fsx:
      • Controls: 5/5 PASS.
      • Pre-credential entry: passed the executor, input, settlement, journey and toolchain joins, then refused at stage=credential as expected, because no key is present locally. The local runtime is 10.0.12 and the receipt was relabelled to the hosted 10.0.13 for this rehearsal.
      • A mutated receipt digest refused at stage=input.
    • Publish-job gates on the 19 original archives:
      • [cross-repo] Advance registry fsgg-contracts version + package-version 2.0.1 → 2.1.0 (2.1.0 now live on the feed) — and correct the 2.0.1 annotation, which claims a '.fsi surface unchanged' that grew by 78 lines #1010 packed-template clean-checkout FSI contract: PASS.
      • .fsi api-surface: 18/18 PASS.
    • Release lane (FS_GG_VERSION_COHERENCE_RELEASE_LANE=1) at the executor:
      • Version coherence: COHERENT (pin 0.32.3 == latest tag).
      • Template payload pins: STRUCTURAL OK.
    • Package.Tests, release-lane equivalent at the executor (-c Release, FS_SKIA_RUN_PACKAGE_CONSUMER_SMOKE=1, release lane on, local packed feed): 534/534 passed. Not rehearsed locally: template-product-tests. The executor 9e8bd516 changes no product paths from 4ec6 (only workflows, scripts, docs and eng/release). The job passed in source run 39509314882, and the gate's "Generated product gate" passed at 9e8bd516.
    • nuget.org flat-container: all 19 0.32.3 archives are absent. The GitHub Packages census still needs the hosted job token, because my local PAT gets 403 on the org packages API.

    Findings:

    1. The existing preflight-only route can no longer be used for 0.32.3. release-preflight.py refuses any existing tag ("tag collision") and the font attempt refuses scope-only mode. After settlement, hosted eligibility is therefore only established inside the publish job, before its first writer. That job runs the fresh 19 verify-key GETs, the complete census, and admitFontDisposal, all before any push.
    2. While the tags have no packages, gate.yml's non-required "Release publish gate" will report drift on the next Rendering main/PR run.

    Nothing in this rehearsal published anything, pushed a tag, minted a credential, or changed workflow or settings state. The original receive-pack outcome stays Unknown. Rendering main must not move between root's readback and the single dispatch. The full #4709/#4644 Done when stays open: public default and full public Wizard qualification follow publication through their existing owners.

    Proposed single admission (root to decide, not dispatched): POST repos/FS-GG/FS.GG.Rendering/actions/workflows/release.yml/dispatches.

    • ref=main, which must read back as 9e8bd516.
    • Inputs: version=0.32.3, font-disposal-attempt=true, source-sha=4ec6eafbbbf02264db9b0db4780c590abe0bf9cd, expected-executor-sha=9e8bd5167179b0283f0eb2537a184c9ed6289305, and accepted-tag-settlement set to the coordinates above (run 39774890888, attempt 1, artifact 12423109248, executor 9e8bd516).
    • All other inputs false or absent.

    It pushes the 19 original archives, GitHub Packages first and then nuget.org, with readback. Package versions are immutable, so there is no rollback. Any recovery is forward only, through the same probe/compare publisher, and needs separate admission. No resend on uncertainty.
16. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: 0.32.3 publication dispatch: NO-GO on executor 9e8bd516 (independent review), fix in progress.

    • Verified: the executor and gate order, the settlement run/artifact/receipt (02d2a9b1…), the three tags → 4ec6eafb, nuget.org occupancy (404 for all 19 at 0.32.3), and that 0.32.3 is the correct next step for Templates [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728's font cases.
    • Defect: under attempt 0323, every --record-event re-verifies the settlement with 6 GITHUB_TOKEN API calls. That is about 191 calls × 6 ≈ 1,150 requests, against the 1,000/h repo limit. It would likely fail mid nuget.org push, leaving an irreversible partial publication. The unit test mocks this path, so it was never exercised.
    • Remedy: a reviewed Rendering change so record reuses the custody-verified settlement file, with no network. Then a dispatch with the new executor SHA and the same settlement, after fdev re-review.
17. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: The publish dispatch is still held. Its fix is reviewed but cannot merge: Rendering's required gate cannot pass until 0.32.3 is published.

    Independent dispatch review returned NO-GO on executor 9e8bd516. Every --record-event call re-ran the settlement's native authentication: about 191 calls × 6 GITHUB_TOKEN requests, roughly 1,150, against the 1,000/h repository limit, inside the push loops. Fix: Rendering #1464.

    • Record calls now reuse the receipt this job already authenticated, with no network. They join it on the receipt digest, this attempt's input binding, the 7 executor identity fields, and the receipt claims.
    • Tests run 191 real record calls with all transport counted and refused, plus 12 refusal cases. Suites: 62/53/80/26 OK. Native F# boundary: 47/47 locally.
    • Real-artifact local rerun at 456deaf6: 191 records, 0 gh calls. A different run id or a tampered cache refuses.
    • Independent fsgg-critic-best review: REQUEST-CHANGES at 4e4cfeb4 (committed .pyc files; fixed), then APPROVE at 456deaf645c60c37bbc8693da7d5a1c9750ad9c7.

    Merge blocker (structural, not caused by the PR). The required Deterministic gate fails at "API-surface mirror": NU1102, FS.GG.UI.* >= 0.32.3 not found on nuget.org.

    • refresh-api-surface-mirror.fsx reads the exact-head local feed only while the pin is ahead of the fs-gg-ui/v* tags.
    • The settlement created fs-gg-ui/v0.32.3, which closed that window. From now on, any Rendering PR, and main itself, needs 0.32.3 published before this gate can pass.
    • Template payload restore gate and Release publish gate (both non-required) fail for the same reason.

    The second required failure, API compatibility gate, timed out at the native-boundary 140-second budget on both attempts. The same timeout occurred on main pushes 7905b726 and 3464058d before this change, so it is intermittent and pre-existing.

    The publisher route itself is unaffected: Package.Tests passed 534/534 locally in the release lane with the tags present.

    Decision needed from root (no action taken):

    • (A) Admin merge of Record new-sdd-workspace 0.7.0 publication #1464 at 456deaf6 over the Deterministic gate failure, after a green rerun of the API compatibility gate. This is a branch-protection bypass and needs root admission.
    • (B) Extend the existing tagged-recovery mirror input (qualify-retained-api-mirror.py --select-original730, built for 0.32.0) to the settled 0.32.3 original archives, so the required gate passes normally. This is larger source work in a required gate path.
    • (C) Dispatch on 9e8bd516 despite the NO-GO. Not recommended.

    The original receive-pack outcome stays Unknown. No publication, tag, credential or settings effect occurred.
18. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Revised 0.32.3 publish dispatch, ready for re-review. Not dispatched.

    Rendering PR #1464 merged as fc2b177e22d66032fe8c2ead4fc3e9845fc2a350. Live refs/heads/main reads back as that SHA, and its tree is identical to the independently approved head 456deaf6.

    Fresh read-only readback:

    • All three 0.32.3 tags still point to commit 4ec6eafb.
    • Settlement artifact 12423109248, producer artifact 12305198394 and qualification artifact 12315224479 are unexpired, with matching digests.
    • release.yml, release-tags.yml and template-dispatch.yml are active.
    • The last release.yml run is still 39541203598, so no publish attempt exists.
    • nuget.org fs.gg.ui/0.32.3 returns 404.

    Proposed single operation: POST repos/FS-GG/FS.GG.Rendering/actions/workflows/release.yml/dispatches

    • ref: main, which must read back as fc2b177e22d66032fe8c2ead4fc3e9845fc2a350 immediately before the POST. No Rendering merges in between.
    • Inputs:
      • version: 0.32.3
      • font-disposal-attempt: true
      • source-sha: 4ec6eafbbbf02264db9b0db4780c590abe0bf9cd
      • expected-executor-sha: fc2b177e22d66032fe8c2ead4fc3e9845fc2a350
      • accepted-tag-settlement: {"run":39774890888,"attempt":1,"artifact":12423109248,"artifactSha256":"245a4dbdd0d52fafcc3517a4af28b7c256e4aa4bf9c4ce1492166034012b56ee","receiptSha256":"02d2a9b191ae70b662f31e6a3bf5135f6d76ebadae2bf5592ede75f3e3009255","executorSha":"9e8bd5167179b0283f0eb2537a184c9ed6289305"}
      • All other inputs false or absent: source-only, preflight-only, successor-attempt, bound-attempt.
    • The settlement executorSha stays 9e8bd516. It is compared with the settlement run's head, not with the publisher executor. The local acquisition at executors 00c4967b and 456deaf6 passed with it.

    Effects. In order:

    1. The static guard checks the settlement natively, once.
    2. package-tests and template-product-tests run.
    3. publish-packages acquires the original 19 archives, runs the [cross-repo] Advance registry fsgg-contracts version + package-version 2.0.1 → 2.1.0 (2.1.0 now live on the feed) — and correct the 2.0.1 annotation, which claims a '.fsi surface unchanged' that grew by 78 lines #1010 and .fsi gates, mints the OIDC nuget.org key, runs the F# verify-key, census and eligibility checks, and only then pushes to GitHub Packages and nuget.org, with readback.
    4. Event records now make no network requests.

    There is no rollback for immutable package versions. Recovery is forward only, through the same probe and compare-matched publisher, and needs separate admission. No resend on uncertainty.

    Timeout exposure (re-GO question), checked against release.yml at fc2b177e:

    • The 47-run native boundary harness (test-release-source-guard.py --native-font-disposal-boundary) is only in gate.yml:807. release.yml does not run it.
    • release.yml has no timeout-minutes (0 occurrences), so GitHub's default 360-minute job limit applies.
    • The publish path runs dotnet fsi once each at release.yml:1020 (5 verify-key controls, no wall-clock budget) and at :1021-1023 (release-nuget-verify-key.fsx).
    • Those scripts have network limits only: NuGetVerifyKey.fs:66 sets 10 s per request, and ReleasePackageCensus.fs:66-67 sets 15 s per request and 120 s for the whole census. Exceeding them refuses with exit 3.
    • The step at :1013 runs under set -euo pipefail (:1019), so any fsi failure or timeout ends it.
    • The first feed writer is dotnet nuget push at :1073, in the next step (:1037). That step is skipped after a prior failure.
    • Earlier dotnet fsi uses (:969 [cross-repo] Advance registry fsgg-contracts version + package-version 2.0.1 → 2.1.0 (2.1.0 now live on the feed) — and correct the 2.0.1 annotation, which claims a '.fsi surface unchanged' that grew by 78 lines #1010 product build, :988 .fsi check) and the needs: jobs package-tests (:210) and template-product-tests (:350) also come before any push.

    So a timeout or refusal costs only the admission and a short-lived OIDC key, not a partial publication.

    The original receive-pack outcome stays Unknown.
19. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: 0.32.3 publication dispatched once, after an independent delta GO-WITH-CONDITIONS on executor fc2b177e (Rendering #1464).

    • Readback just before the POST: main = fc2b177e, the workflow is active, and there was no prior release run since 2026-10-21.
    • POST at 16:52:58Z: HTTP 204, giving run 39817794639 (workflow_dispatch, head fc2b177e).
    • Inputs: exactly as in 6346251493.
    • No re-dispatch or re-run without a separate admission. fdev will monitor and verify both feeds.
20. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Rendering 0.32.3 published to both feeds and independently verified on nuget.org. This completes the publication step only. #4709 stays open.

    Run. 39817794639, attempt 1, workflow_dispatch on protected main executor fc2b177e22d66032fe8c2ead4fc3e9845fc2a350, 16:53:00Z to 17:32:03Z, conclusion success.

    • Jobs: static guard, generated product, package consumption and publish all succeeded. Preflight and source custody were skipped by design.
    • The run used producer 4ec6eafb, original artifact 12305198394, and accepted settlement 39774890888 (receipt 02d2a9b1…9255).

    Run receipts (attempt artifact 12445821375, sha256 9babb0db…b2d0; my own download and read):

    • artifacts/packages: all 19 archives are byte-identical to the original producer archives. Custody 7dbd4329…98c9 is unchanged.
    • publisher-events.jsonl (e8640e9a…1d08): 191 events from executor fc2b177e, effect rendering-0323-original39509314882-a1.
      • github: probe requested 19, probe absent 19, push requested 19, push acknowledged 19, readback matched 1 (all19).
      • nuget: probe requested 38, probe absent 19, push requested 19, push acknowledged 19, readback matched 19.
    • nuget-key-scope.json (0e125953…3fc6): verify-key passed, with 19 of 19 HTTP 200 and no package mutation.
    • fresh-package-census.json (f7cf460b…3334): taken before any writer, under the Actions GITHUB_TOKEN. Overall ABSENT, mutation none.
    • github-packages-readback.json (13c459e0…5da): result pass, source nuget.pkg.github.com/FS-GG, 19 packages, all 19 original SHA-256 values present.
    • input-binding.json joins settlement 39774890888, receipt 02d2a9b1…, and run/attempt 39817794639/1.

    Independent feed verification (my own fetches; any credential was passed only to a child process and never recorded):

    • nuget.org: all 19 FS.GG.UI* 0.32.3 archives are present on the flat-container. Compared entry by entry against the original archives, excluding .signature.p7s, all 19 match. All 19 public copies carry the nuget.org repository signature, so whole-file digests differ as expected.
    • GitHub Packages: I could not read it independently. My fine-grained PAT gets HTTP 403 from nuget.pkg.github.com/FS-GG. The evidence is the run's own native restore readback above, which matched all 19 original digests whole-file. Open: an independent whole-file readback needs a principal with read:packages.

    Done-when status:

    • The compatible public Rendering successor is met for publication: 0.32.3 is on both feeds with original-byte custody. The original receive-pack outcome stays Unknown.
    • Unmet: Templates consumer repin to 0.32.3 and Release C re-run on Templates #728. This goes to its existing owner.
    • Unmet: public Workspace.Template, registry and Wizard/SDD default adoption, with omitted/default and explicit lifecycle/bundle behaviour mapped to read-back package and default identities.
    • Unmet: full public Wizard SVG creation and actual workspace runtime assertions.
    • Unmet: downstream notification (template-dispatch) and the registry fs-gg-ui-template published-version update. Each needs separate admission.

    Parent #4644 also stays open.
21. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Templates consumer repin to published Rendering 0.32.3 is merged. The genuine late-font cases now pass.

    fdev took over Templates #728 (takeover recorded on the PR) and merged it as 2f8d400a6a670568044d607a1ac0eb2c7c655a29 from reviewed head ae856f2e. The main tree a3bd53f9 equals the clean merge of ae856f2e with main c6dabf45.

    • The repin is commit 370a3f90. It moves the public Rendering axis from 0.32.1 to 0.32.3:
      • the provider pin via bump-rendering-pin.sh, the README and a written PIN HISTORY entry;
      • the SvgFoundation and Studio defaults and the CodecProbe and Tactical refs;
      • six regenerated lockfiles (version and contentHash lines only);
      • the external-reference public identity (source 4ec6, custody 7dbd, signed raw and lock hashes), its verifier and workflow rows;
      • the Release C pin assertions;
      • tests, including refusals for the old 0.32.1 pin.
    • The merge of main (ae856f2e) satisfied the routine-eligibility base join.
    • Independent fsgg-critic-best review: APPROVE-WITH-NITS at 370a3f90, and again on the delta at ae856f2e. The reviewer recomputed every new hash from nuget.org and ran locked restores. The nits are stale prose in two roadmaps and one error message, plus duplicated public-identity constants.

    Release C public producer source qualification, run 39827412768 at ae856f2e: success. In Chromium, Firefox and WebKit alike, 16 expected / 0 unexpected / 0 flaky / 21 skipped, and all 7 Studio font cases passed on their single attempt. That includes the three genuine late-font cases (timeout, replacement, stale completion), which failed against public 0.32.1 (13/3/21). Nothing was waived. The earlier run 39824703384 at 370a3f90 had the same browser result; its later soldier-route NU1004 failure was pre-existing on main and is gone after the merge.

    All required checks passed (composition, kit / coordination-kit, materialize / receiver-validate), as did Release C installed receiver, D.5 clean-start, routine-eligibility and the static controls.

    One pre-existing failure, not caused by this PR: "Installed typed SDD package receivers". The unpinned Wizard 0.11.1 now installs the published Workspace.Template 0.19.1 (published 08:29Z), but historical-receiver-maintenance.py expects LEGACY_VERSION 0.19.0. Main's last green run was at 08:04Z, before that publication. It needs a separate Templates owner fix, and will drift again with every Workspace.Template release.

    Read-only feed occupancy: run 39835034835 at 2f8d400a reports FS.GG.Workspace.Template 0.19.2 ABSENT on GitHub Packages (complete active and deleted census) and on nuget.org (complete index).

    Next steps for #4709 (none started):

    1. Source: a "Prepare Workspace 0.19.2" PR, following Phase 3b — the flip: --engine=fs becomes the default, once divergence --fleet is actually green #730. It bumps FS.GG.Templates.csproj 0.19.1 → 0.19.2 and the five providers' FS.GG.Workspace.Template:: self-pins, then goes through normal review and merge.
    2. Admission required (publication, and in effect the public default): push tag fs-gg-templates/v0.19.2 at that merged prep commit.
       • release.yml then runs route → pack → gate → publish to GitHub Packages and, with NUGET_ORG_PUBLISH, nuget.org.
       • The Wizard installs the latest stable Workspace.Template unpinned, so this publication also changes the public Wizard default.
       • Rollback: none; package versions are immutable, and nuget.org only allows unlisting.
       • Recovery: workflow_dispatch operation=replay with the original tag and source run, separately admitted.
    3. Full public Wizard qualification after publication: svg-release-d5-public-default.yml workflow_dispatch, with public_pins JSON binding the published 0.19.2 archive, source and provider hashes.
    4. Registry: the feed-autofix bot (daily, around 12:30Z) is the maintained route to flip fs-gg-ui-template to 0.32.3. The fs-gg-workspace-template row (still 0.19.0, while 0.19.1 is already published) needs a reconcile PR.

    #4709 and #4644 stay open.
22. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Admission request: publish FS.GG.Workspace.Template 0.19.2. Prepared, not executed; awaiting root GO review.

    Source state. Each item below merged with an independent fsgg-critic-best review on its exact head and passing required checks:

    • Templates #735 prepares 0.19.2: csproj <Version> 0.19.1 → 0.19.2 and the five providers' self-pins. Review: APPROVE.
    • Templates #736 pins the historical Wizard receiver to its two-archive legacy feed. Review: APPROVE-WITH-NITS. "Installed typed SDD package receivers" is green again.
    • .github #4808 is the registry reconcile: fs-gg-workspace-template 0.19.1 and fs-gg-ui-template 0.32.3. feed-autofix is audit-only since GS2-08.9 and cannot flip rows. Review: APPROVE after repair; merged as 338a9a51.
    • Templates main is d15f085ff4d64b7736e09ff263644b3c86a576a6 (tree 2975587b). It carries [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728 (Rendering 0.32.3 defaults and the Studio font fix), renovate: a {{ secrets.X }} in a DESCRIPTION is not prose — it is an interpolation target (#576 follow-up) #736 and renovate: FS.GG.* are PUBLIC on nuget.org — the credential four freezes chased was never needed (#576) #735.
    • All main workflows at d15f085f are green. composition passed on its second attempt: the first attempt failed only the fable-game two-client startup budget (first-play-interaction-ms), a hosted-timing flake that also passes on the PRs.

    Pre-push eligibility (read-only). Feed occupancy run 39838476767, checked out at d15f085f, reports FS.GG.Workspace.Template 0.19.2 ABSENT:

    • GitHub Packages: complete active and deleted census, 4×200.
    • nuget.org: complete version index.

    Tag fs-gg-templates/v0.19.2 is currently absent.

    Important: the tag-push run has no occupancy census of its own. Its pushes use --skip-duplicate, so an occupied version would only be caught by the payload readback, after the push. Root should re-run the read-only occupancy check (release.yml dispatch, operation=feed-occupancy, candidate_version=0.19.2) immediately before the tag push and require ABSENT on both feeds.

    Exact operation.

    • Create the annotated tag fs-gg-templates/v0.19.2 on exactly d15f085ff4d64b7736e09ff263644b3c86a576a6, then push only that ref: git push origin refs/tags/fs-gg-templates/v0.19.2.
    • Templates has no tag ruleset, so verify the peeled tag target after the push.
    • The tag push triggers release.yml (event push). Line numbers below are at d15f085f:
      1. route (:64): accepts only fs-gg-templates/v<semver> and sets publish=true.
      2. pack (:235):
         • verify the canonical Python fixture;
         • run the focused ProviderTool tests;
         • tag ⇔ csproj <Version> coherence (:294), which refuses unless the tag says 0.19.2;
         • restore in locked mode (:326);
         • pack once and record the SHA-256 (:330);
         • upload the immutable artifact fs-gg-templates-<run> (:387).
      3. gate, named release-route (:397):
         • download the artifact and verify its checksum (:445/:451);
         • grade provider minimumFsggSdd floors against the org registry (:459);
         • install the FS-GG CLIs;
         • run the composition suite against those exact bytes (:543).
      4. publish (:550), entered only if pack and gate succeeded:
         • re-verify the artifact checksum (:571);
         • push to GitHub Packages (:580, --skip-duplicate);
         • NuGet OIDC login (:597);
         • push the byte-identical archive to nuget.org (:604; vars.NUGET_ORG_PUBLISH=true);
         • read back the payload: GitHub Packages up to 60 tries (:612), nuget.org up to 180 (:660);
         • create the GitHub Release with the asset (:709);
         • retain the readback receipts (:729).
    • Nothing is written to a feed before step 4. Steps 1–3 cover every pre-push check, including pack-once custody and the full composition run against the archive.

    Recovery and replay.

    • If the gate fails: pack succeeded, gate failed and publish was skipped. A separately admitted release.yml workflow_dispatch with operation=replay, release_tag=fs-gg-templates/v0.19.2 and source_run_id=<that run> re-gates the same checksum-bound artifact and then publishes. Route (:77) enforces exactly that state. This covers a repeat of the composition timing flake.
    • If publish fails partway: there is no maintained replay, because route requires a skipped publish. Any re-run of the publish job, which would re-download the same verified artifact with idempotent --skip-duplicate pushes and readbacks, needs its own explicit admission. No resend on uncertainty.
    • No rollback once published. Package versions are immutable, and nuget.org only allows unlisting. The tag must not be moved or deleted after any push.

    Public-default consequence.

    • Wizard new-sdd-workspace (unpinned) installs FS.GG.Workspace.Template without a version, and SDD scaffold runs dotnet new update. Both resolve the newest stable.
    • Publishing 0.19.2 therefore immediately becomes the public default for new workspaces: Rendering provider FS.GG.UI.Template 0.32.3, fable-game SvgFoundation/Studio defaults at Rendering 0.32.3, and the Studio font-disposal fix.
    • Unaffected: explicitly pinned --pinned --ref scaffolds and existing workspaces until dotnet new update. The historical typed-receiver Wizard is now pinned by renovate: a {{ secrets.X }} in a DESCRIPTION is not prose — it is an interpolation target (#576 follow-up) #736.

    After publication (each separately):

    1. Verify both feeds independently.
    2. Run the read-only svg-release-d5-public-default.yml qualification, with public_pins for the published 0.19.2 archive, source and provider hashes.
    3. A source PR moving the published-version bindings (ReferencePublication.fs wasmSuccessors, fable-reference-public.yml TEMPLATE_VERSION), as Phase 4.1 — generated projections: the docs and skills are EMITTED from the typed model (retires 54 vendored copies) #731 did for 0.19.1.
    4. A registry reconcile of fs-gg-workspace-template to 0.19.2.
    5. Full public Wizard qualification.

    #4709 and #4644 stay open.
23. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Workspace.Template 0.19.2 publication started, after an independent GO-WITH-CONDITIONS review. All conditions were met:

    1. Fresh read-only occupancy run 39845263408 at d15f085f: overall: ABSENT, with complete GitHub Packages and nuget.org censuses. fdev's own nuget.org check: the nupkg returns 404, and the index tops out at 0.19.1.
    2. Tag: confirmed absent immediately before.
    3. Annotated tag fs-gg-templates/v0.19.2: object c91b4b04… on exactly d15f085ff4d64b7736e09ff263644b3c86a576a6, created 20:02:49Z. Only that ref was pushed, and it peels on the remote to d15f085f.
    4. Exactly one release run: 39845406998 (push, the tag, d15f085f).
    5. Rules: no tag move or delete. Any gate replay or publish re-run needs a separate admission.

    Once it lands on nuget.org, 0.19.2 becomes the public Wizard default (Rendering 0.32.3 plus the Studio font fix). Next comes feed verification, then the read-only public-default qualification.
24. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: Workspace.Template 0.19.2 is published and verified, and the registry is reconciled. The public Wizard-qualification clause is not yet met, so #4709 stays open.

    (1) Independent verification of release 39845406998/a1 (push on tag fs-gg-templates/v0.19.2; route, pack, release-route and publish all succeeded):

    • Original: artifact 12455007005 (zip bd26a015…) holds FS.GG.Workspace.Template.0.19.2.nupkg. Its 0af2a10e402a055f0b86c56a28cd5c46e023f185c117741e565ee08eb54cd8fd equals the in-run SHA256SUMS.
    • nuget.org: the signed archive ef5c5c2fb2de372a427c5abaf8bb4cdf91d7776b5628f07c016d4eb9ac87469a equals the original across all 512 entries excluding .signature.p7s. Its nuspec says 0.19.2 at commit d15f085f. The packed fable-game SvgFoundation and Studio defaults are Rendering 0.32.3.
    • GitHub Packages: the run's own readback (artifact 12457070450) reports 0af2a10e…, 512 entries, payloadExact. I cannot read that feed independently (403).
    • GitHub Release fs-gg-templates/v0.19.2: not a draft or prerelease; asset digest 0af2a10e….
    • Tag and occupancy: annotated tag c91b4b04… peels to d15f085f. Pre-tag occupancy run 39845263408 reported ABSENT on both feeds.

    Registry. .github #4809 merged as 65ef0b6d. It records fs-gg-workspace-template source/package/tag 0.19.2, keeps 0.19.1 as history, and updates the edge and coherence notes. Independent fsgg-critic-best review: APPROVE-WITH-NITS, then APPROVE on the delta. All 8 required checks passed. The only feed failure is the unrelated governance-reference-gate-set 1.7.0-vs-1.8.0 drift, which also fails on main.

    (2) Public-default qualification: not dispatched, because no maintained route accepts 0.19.2.

    • svg-release-d5-public-default.yml is read-only (contents: read, no secrets, nuget.org downloads only, artifact upload only). But d5-public-pins.py and its verifier hard-require the historical D.5 cohort: Templates 0.15.0, SDD 2.0.2, Wizard 0.12.0, and SDD.Artifacts/2.0.2. A 0.19.2 dispatch would be refused at preflight. Its assertions are also creation plus locked restore/build only, with no workspace runtime.
    • fable-reference-public.yml is the route with full Wizard and browser/WASM runtime. It is closed to its own cohorts: full means 0.18.1 + SDD 2.1.0 + Wizard 0.16.0, and wasm means 0.19.1. ReferencePublication.fs refuses an unselected 0.19.2.
    • So the single pre-authorized dispatch was not spent on a guaranteed refusal.

    Done-when status.

    • Met: the selected compatible public Rendering successor 0.32.3 is published (39817794639/a1) and independently read back.
    • Met: the public Templates successor 0.19.2 is published and read back, and as newest stable it is the Wizard's public default. It carries the Rendering 0.32.3 defaults and the Studio font repair. The genuine late-font cases passed in source qualification at [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728's head (Release C 39827412768: Chromium, Firefox and WebKit each 16/0/0/21, all 7 font cases).
    • Unmet: full public Wizard SVG creation and actual workspace runtime assertions for the exact published successor (Templates 0.19.2 with a selected current public SDD and Wizard), with omitted/default and explicit lifecycle/bundle behaviour mapped to read-back identities. No existing run qualifies this cohort, and the Templates-only source result cannot substitute for it.

    Needed to close it:

    1. Root decision: select the current compatible cohort. Templates is 0.19.2. The registry records Wizard (new-sdd-workspace) as 0.21.0; nuget.org's latest SDD.Cli is 2.4.0, and its compatibility with Wizard 0.21.0 needs confirming.
    2. A source PR adding that cohort to the runtime-bearing fable-reference-public route: closed tables, ReferencePublication.fs successor list, preflight and fixtures, as Phase 4.1 — generated projections: the docs and skills are EMITTED from the typed model (retires 54 vendored copies) #731 did. The alternative is generalising D.5 and adding runtime assertions.
    3. One read-only full dispatch binding the published 0.19.2, SDD and Wizard archive/source/descriptor hashes.

    #4709 and #4644 stay open.
25. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-22: #4709 public Wizard qualification: PASSED on the exact public pairing. Hosted read-only run 39859903416/a1 on Templates main 62573a75; evidence artifact 12462046618 (27e00a35…).

    Which pairing a public user gets today (primary sources; qualified as-is, not hand-picked):

    • dotnet tool install --global FS.GG.NewSddWorkspace resolves Wizard 0.21.0, the newest listed version (raw 4326f57d…, commit 12480a20).
    • Its source defaults --ref to main. Templates main's fable-game descriptor (e8dbf895…) pins Workspace.Template 0.19.2 (ef5c5c2f…, d15f085f).
    • Unpinned, it self-updates SDD.Cli 2.4.0 (1df2e74f…, c1fee66a).
    • A local run of exactly that documented flow (isolated HOME; only --no-coordination added) scaffolded and built cleanly.

    Findings (reported, not papered over):

    1. Pinned precondition. Wizard 0.21.0 --pinned with an omitted or typed-sdd fable-game lifecycle requires the sole exact public Workspace.Template 0.18.2 knowledge registration; otherwise it refuses, even with --no-governance. The qualification reproduces this precondition with the hash-pinned 0.18.2 (496aad0e…). Unpinned public users never reach this check. It is a documented precondition, not an incompatibility.
    2. Lifecycle split. Wizard 0.21.0 records lifecycle=sdd when the lifecycle is omitted (its typed-sdd rule is special-cased to descriptor 0.15.0), while the provider descriptor's omitted default is typed-sdd. Both are asserted as actual behaviour. Owner intake for the Wizard is suggested; see follow-ups.

    Route. Templates #739 (merged 62573a75; independent fsgg-critic-best review APPROVE-WITH-NITS, then APPROVE-WITH-NITS again on the merge with main #738; all checks passed) adds this cohort as a closed second fable-reference-public full cohort. Every identity above is bound in source. public-reference is contents: read, uses no secrets and makes no feed or repo writes.

    Done-when, assertion by assertion (all from the hosted run's evidence):

    Assertion	Result
    Exact package/default identities read back	readback.sha256: template ef5c5c2f…, descriptor e8dbf895…, SDD 1df2e74f…, Wizard 4326f57d…. All four Wizard hives end with a single 0.19.2 registration whose bytes equal the published archive.
    Full-Wizard SVG creation	Wizard 0.21.0 created four receivers: complete with default lifecycle, complete --lifecycle none, complete --lifecycle typed-sdd, and the public default (no lifecycle, no bundle). Each passed reference-receiver-check (source closure, including Complete WASM, provenance, generator SDD.Artifacts 2.4.0) or the public-default assertions.
    Omitted/default lifecycle	Wizard omitted → sdd; provider omitted → typed-sdd (provider.json).
    Explicit lifecycle	provider none, Wizard none, Wizard typed-sdd, direct none: all exact.
    Bundle	Explicit complete on every route. Omitted bundle → player (public default), with Studio and WASM absent and SVG input default Rendering 0.32.3.
    Workspace runtime, complete (direct, provider, Wizard)	each build.sh: Domain 19/19, Protocol 26/26, Server 20/20; browser 16 passed / 0 failed / 21 skipped; FourD reference journey 1 passed with 0 skipped per route.
    Workspace runtime, public default (Wizard)	build.sh: Domain 18/18, Protocol 26/26, Server 20/20; browser 2 passed / 0 failed / 18 skipped.

    Evidence limits:

    • The hosted logs use the dot reporter, so they have counts but no per-case names. The identical cohort run locally (passed, 490s) listed all 7 Studio/font cases among the 16 passes, including the three late-font cases. It matches Release C 39827412768's per-case report.
    • The public-default receiver is the pinned equivalent (--ref fs-gg-templates/v0.19.2, no SDD self-update, --no-governance), not the literal unpinned flow. Today the identities are identical; the unpinned flow, with governance on, was exercised locally only.
    • The 21 or 18 skips are the template's standing population for this host, not new.

    Also merged today (independently reviewed, required checks green):

    • Templates #735 prepares 0.19.2. Published by root-admitted release 39845406998 and verified on nuget.org.
    • Templates #736 pins the historical Wizard receiver.
    • .github #4808 and #4809 are registry reconciles: Rendering 0.32.3 and Workspace 0.19.2.
    • .github #4810 flips governance-reference-gate-set 1.7.0 → 1.8.0, published by Governance run 39757858397. feed is green on that head.

    Status. In my assessment, every #4709 Done-when clause is now met for the exact current public successor:

    • Rendering 0.32.3 is published;
    • Workspace.Template 0.19.2 is published and is the public default;
    • the full-Wizard SVG creation, lifecycle/bundle mapping and workspace runtime are qualified against read-back identities.

    Closure, and the #4644 reconciliation, are root's call. Nothing was closed and no Status was changed.

    Follow-ups (non-blocking):

    • The comment at Templates ReferencePublication.fs:28-29 still says "direct-only".
    • The qualification receipt does not yet record the 0.18.2 overlay identity or the command shape.
    • Wizard intake for the pinned-omitted overlay quirk and the sdd/typed-sdd split.
    • The registry templates -> governance edge does not match Templates' real pins.
    • The SDD tool row and the templates -> sdd pins were not reviewed here.
26. EHotwagner commented on Oct 22, 2026

    

    EHotwagner

    on Oct 22, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-23: ACCEPTED: #4709 is complete, after an independent acceptance review (ACCEPT-WITH-GAPS) that verified every clause from the artifacts of read-only run FS-GG/FS.GG.Templates 39859903416 (artifact digest 27e00a35…), not from prose.

    Done-when clause	Evidence
    Exact selected current public successor	The published cohort was re-downloaded from nuget.org and hash-matched: Workspace.Template 0.19.2 ef5c5c2f… (descriptor e8dbf895…), SDD.Cli 2.4.0 1df2e74f…, Wizard 0.21.0 4326f57d…. Each is the newest listed, with Rendering 0.32.3. All 4 Wizard hives end on the published 0.19.2 bytes.
    Full-Wizard SVG creation	Receiver checks are valid for direct none, provider typed-sdd, provider none, wizard sdd, wizard none and wizard typed-sdd, plus the public default (sdd/player, no Studio or WASM, SVG input Rendering 0.32.3).
    Actual workspace runtime	Direct, provider and wizard build.sh: 19/19, 26/26, 20/20; browser 16 passed, 0 failed. Public default: 18/26/20; browser 2 passed, 0 failed. The FourD journey passed 1/1, 0 skipped, on each route.
    Omitted/default and explicit lifecycle/bundle mapped to read-back identities	Provider omitted → typed-sdd; Wizard omitted → sdd; explicit none/typed-sdd exact; explicit complete; omitted bundle → player.
    Reuse receiver setup, no Templates-only substitute	full mode on the existing fable-reference-public route, including the Wizard routes.

    The chain behind it:

    • the Rendering tag settlement (39774890888);
    • Rendering 0.32.3 published after a NO-GO, the fix (Record new-sdd-workspace 0.7.0 publication #1464) and a GO (39817794639);
    • Templates [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728 (Release C, the late-font cases);
    • Workspace.Template 0.19.2 published (39845406998);
    • the registry (Reconcile published Workspace.Template 0.19.1 and Rendering 0.32.3 in the registry (Refs #4709) #4808, Reconcile published Workspace.Template 0.19.2 in the registry (Refs #4709) #4809, Flip governance-reference-gate-set 1.7.0 -> 1.8.0 after publication (Refs #4709) #4810);
    • the public-pairing cohort (Templates chore(deps): update dependency microsoft.net.test.sdk to 18.8.1 #739).

    Recorded gaps:

    1. The Wizard lifecycle split is filed as Wizard omitted-lifecycle default falls back to sdd for current templates (typed-sdd only for Workspace.Template 0.15.0) #4811 and blocks [SVG-RELEASE-D] Qualify and activate the current Release-D coherent receiver successor #4644's default-activation claim. Omitted Wizard creation gives sdd, not the D.5 typed-sdd, because typed-sdd is pinned to Workspace.Template 0.15.0 only. It doesn't contradict this issue's "mapped" clause.
    2. The explicit none/typed-sdd receivers had creation and structural checks, with no build.sh runtime.
    3. Font-case names are local only; the hosted run gives counts, and per-case proof is in Release C (39827412768).
    4. The hosted public-default receiver is the pinned equivalent with governance off; the literal unpinned flow was run locally only.
    5. The receipt doesn't record the 0.18.2 overlay identity or the command shape.
    6. GitHub Packages isn't independently readable (classic read:packages needed).
    7. This issue's "Current deliverable", "Next action" and "Blocked on" sections are historical: Rendering PR Simplify redundant new-sdd-workspace wizard prompts #1460 and everything after it are merged or published. This comment supersedes them.

    Status: Done is written through the guarded writer, then the issue is closed. Parent #4644 stays open, with #4811 linked.
27. EHotwagner

    closed this as completedon Oct 22, 2026
28. EHotwagner commented on Oct 23, 2026

    

    EHotwagner

    on Oct 23, 2026

    ContributorAuthor

    More actions

    fdev 2026-10-23: Successor trail: the current public pairing on Workspace.Template 0.19.3 is PASSED. This is the one read-only hosted run fdev selected (#4710); the issue is not reopened.

    Pairing qualified:

    • Wizard 0.21.0 (4326f57d…, 12480a20);
    • Workspace.Template 0.19.3 (9594ec20…; tag 386e32b7 peels to 7be0bcf5; descriptor 6b3d8f2d…), now the newest public default under fdev's decision that the current-public cohort adopts 0.19.3. 0.19.2 stays an accepted historical successor;
    • SDD.Cli 2.4.0 (1df2e74f…, c1fee66a).

    Run: 39915065069/a1, on Templates main 15113cbc (after #748 → #749 → publication 39910502481 → pin PR #750).

    • public-reference succeeded, 07:00:57 → 07:18:22Z.
    • It is contents: read, with no secrets and no feed or repo writes.
    • Evidence artifact: 12485400761, sha256:c52dd682d6c5e38c2069b6eb11a6796c26476ab069ea881ebe42dbe1c3b650ed, kept until 2027-01-21.

    Assertion	0.19.3 (this run)	0.19.2 (39859903416), for comparison
    qualification.json	disposition: passed, mode: full, wizardQualification: passed, version 0.19.3, at 7be0bcf5	passed, at 0.19.2
    Read-back identities (readback.sha256)	template 9594ec20…, descriptor 6b3d8f2d…, SDD 1df2e74f…, Wizard 4326f57d…	ef5c5c2f…, e8dbf895…, same SDD and Wizard
    Wizard hives	all four (default, none, typed-sdd, public) end on a single 0.19.3 registration	0.19.2
    Receiver checks	direct, provider (typed-sdd and none), Wizard (sdd, none, typed-sdd), plus the public-default assertions (sdd/player, no Studio or WASM, SVG input Rendering 0.32.3): all passed	same
    Runtime, browser tests	direct, provider and Wizard: 16 passed each (21 conditional skips); FourD journey 1/1 per route, 0 skipped	identical
    Public default runtime	2 passed (18 conditional skips)	identical
    Lifecycle mapping	Wizard omitted → sdd; provider omitted → typed-sdd, as current behaviour	same

    Scope and gaps:

    • The current Wizard default lifecycle expectation stays sdd. The Wizard omitted-lifecycle default falls back to sdd for current templates (typed-sdd only for Workspace.Template 0.15.0) #4811 fix, owned elsewhere, was not pre-empted.
    • The 0.18.2 pinned-overlay precondition is reproduced as before.
    • The 0.19.2-run gaps carry over unchanged: explicit none/typed-sdd receivers get no build.sh runtime; font-case names are local only; the hosted public default is the pinned equivalent with governance off; the receipt does not record the overlay identity or command shape; GitHub Packages is not independently readable.
    • The registry is reconciled to 0.19.3 by .github#4814 (6e5dbe6a).