Authenticate current reusable checkout logs before WASM publication

docs/atlas/catalog.json

@@ -1 +1 @@
-{"records":["0863093e69a16355fa9b90f8e7e29156ea4ad88c4523bc4883568bde831bdf35","231df3792931ad2333d00970a5993b3e13fa9dc38f687899f9fa2c966ed9fbfa","24fdc3980640ba58bedcae6f16d5b467eb7383c31161fb9b6ff10fd2e667b0e5","2b7dfb3a2f76368cb603161cdb6f8fa8c2b8afc3e96659dd37c975921ba5ba66","33df463263533529cca24a0b09937573f836d197cc1a739e9960b1cdd4deb1fd","343077d02ddd266b21d8677f7c256854134f7e3e2d18137b55ebe3f32564c5c0","34391bda3fb56135a2bddf74ab790958c175bc6a69c38175e6f8db792cfd50a0","36a19fefd7024f54f3391ffed19019c10222a514719edd7a44f0cde2a1c48258","3d3a0a302c02cd0bfee86715d09b0211baa8dad3e47402c638fc95c7cfa02e87","3de8718fb3ca9b15212e8bd84fba205995d24636087090a61c63c28a96a745b1","3df4f31fda99ad137c651322ad29809e36380400516399274870b4a4332b4a92","3f09ee199e3c2e808e0f6e74f197f2fdd8158ae099a7195c498ce9466bb78b03","44bda82d6f9a9625a83283bf56a15a1831f287037214dc134eeeae87f1faa869","6c5b38ee260d1f15f8029d699ec1cebceafb5e1407a6341dc7a4b96f4d9d3521","72742cbaa561237f10251e94aa5c61153ab5c7f14fc5771b7a5ebdece1e1cb11","87d6de6f3730cecd75d9a4411bf4dbac4e058127a3ce9f46b07f6de110bc26de","95115e1052b5ea4fcd393f5c9b9c6f0298657f0028eee84e16215ede97576cfa","c01c2c98f13a65b49113916a2f295e46a03fc4c185ece880267dd86c3f3dee8b","d557525e3ebfad227c8d6db9bb6350d42506fb02b1de8058cb443f4f008c0f67"],"schema":"fsgg.atlas/1"}
+{"records":["0863093e69a16355fa9b90f8e7e29156ea4ad88c4523bc4883568bde831bdf35","231df3792931ad2333d00970a5993b3e13fa9dc38f687899f9fa2c966ed9fbfa","24fdc3980640ba58bedcae6f16d5b467eb7383c31161fb9b6ff10fd2e667b0e5","2b7dfb3a2f76368cb603161cdb6f8fa8c2b8afc3e96659dd37c975921ba5ba66","33df463263533529cca24a0b09937573f836d197cc1a739e9960b1cdd4deb1fd","343077d02ddd266b21d8677f7c256854134f7e3e2d18137b55ebe3f32564c5c0","34391bda3fb56135a2bddf74ab790958c175bc6a69c38175e6f8db792cfd50a0","36a19fefd7024f54f3391ffed19019c10222a514719edd7a44f0cde2a1c48258","3d3a0a302c02cd0bfee86715d09b0211baa8dad3e47402c638fc95c7cfa02e87","3de8718fb3ca9b15212e8bd84fba205995d24636087090a61c63c28a96a745b1","3df4f31fda99ad137c651322ad29809e36380400516399274870b4a4332b4a92","3f09ee199e3c2e808e0f6e74f197f2fdd8158ae099a7195c498ce9466bb78b03","44bda82d6f9a9625a83283bf56a15a1831f287037214dc134eeeae87f1faa869","6c5b38ee260d1f15f8029d699ec1cebceafb5e1407a6341dc7a4b96f4d9d3521","72742cbaa561237f10251e94aa5c61153ab5c7f14fc5771b7a5ebdece1e1cb11","87d6de6f3730cecd75d9a4411bf4dbac4e058127a3ce9f46b07f6de110bc26de","8b1cf51c5f03c0ae19c46ca3ea4a1158acbb6e47bf109ca8c506c5417b51cf9f","95115e1052b5ea4fcd393f5c9b9c6f0298657f0028eee84e16215ede97576cfa","ab4502eff76606ac8e58b623878f3d76e1e0b18f30796aec7c446e2aab8b57c8","c01c2c98f13a65b49113916a2f295e46a03fc4c185ece880267dd86c3f3dee8b","d557525e3ebfad227c8d6db9bb6350d42506fb02b1de8058cb443f4f008c0f67"],"schema":"fsgg.atlas/1"}

docs/atlas/records/8b1cf51c5f03c0ae19c46ca3ea4a1158acbb6e47bf109ca8c506c5417b51cf9f.json

@@ -0,0 +1 @@
+{"citations":[{"path":"scripts/wasm-release/promotion.py","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"ad769165fafec8007f575e9eef014114dbfe9f5ca443e5a3a82d33771981d681"},{"path":"tests/release/wasm/test-release-promotion.py","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"072bb58f9567902afb9177f0e92b37389edb4e98508b04a99c7dbac6bf06ef44"},{"path":"scripts/wasm-release/bind-installed-release.py","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"a6cccd825a226ae8d021ab101c66f77c0d787dec6e119ca1978e28911dfa3206"},{"path":"scripts/wasm-release/readback.sh","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"d09da75f8681d4d488ac5dee993ec286d36886363a758459356fedb47fab14fc"},{"path":"scripts/wasm-release/qualify-supervisor-installed.sh","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"09f8eeab75334891f26da42b43dc39e8ccdec93f4a62f6029c72a687e719cd04"},{"path":"docs/roadmaps/wasm-shared-01.md","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"2fbf17a8d3794bb7709a6fafe8c20b1506ff112a40d3783e093f6311d3d38260"},{"path":".github/workflows/release-wasm.yml","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"8a914479ddb212047706e6ec51440a7425c68df53a8cb5a25c8f4d14cc8fdf17"},{"path":".github/workflows/wasm-shared.yml","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"119acca0349717cec587562d59bd21c58d413b4a6c5f9e95205c95da5042d520"}],"conflictsWith":[],"id":"game/current-wasm-custody-source-boundary","kind":"boundary","recordedAt":"2026-10-17T07:13:35Z","repository":"FS-GG/FS.GG.Game","schema":"fsgg.atlas/1","status":"recorded","summary":"The current-only 0.4 publisher consumes complete protected-main qualification originals with producer=executor=workflow source, never an old-custody/new-reader overlay. PR713 delivered terminal/coherent0.4 source to protected5e2ebd8d1df0412d4725b31bcb8d380b3c85e48a, tree1b15f6d4d10982178021e496e08aae376472c9b4. Full PR qualifier39009544440/a1 and protected qualifier39010989001/a1 passed; the latter job117333290828 passed all11 maintained gates and froze artifact12092849150. Independent data review accepted its39-member closed custody, originals, hashes, source/installed CLR-Fable, current0.3 API classifications, fresh53/16 trace checks and real browser suites. Generation was skipped; seven generation inputs and71 accepted outputs remain unchanged. A subsequent read-only native19 preflight refused the real current reusable lock-range checkout log: its group uses actions/checkout@v7 while native runner setup resolves that exact ref to the accepted full action SHA3d3c42e5aac5ba805825da76410c181273ba90b1. The old reader accepted only the full-SHA group label. The connected source repair admits only current refs fullpin/v7 with one matching runner-setup resolution before Run groups, one declared+synced Game repository and its own exact git-log result; it excludes the separate shared-repository checkout. Wrong/missing/conflicting/late resolution, foreign repo, duplicate Game blocks and script echoes refuse. All19 authentic original log shapes were inspected:16fullpin,2resolvedv7 Game+Shared,1metadata-only PR subject. Focused inert controls, recorded native19 replay and full static preflight passed; installed/both-feed readers delegate current transaction/executor and package/signature checks, with no second checkout parser. Successful old qualification/custody and original preflight refusal retain their identities. Changed reader source awaits independent exact-source review, ordinary delivery and new complete protected qualification/custody before fresh native19 admission can authorize publication. Organization reads returning403 remain Unknown; genuine admission must prove complete occupancy and OIDC before writers. No publication, tag/feed mutation, fresh served-feed installation or consumer activation occurred. Preflight has the platform timeout default, admission15min and five promotion stages45min each; these are not a whole-workflow bound. Publication remains separately selected with original-run observation and effect-aware failure handling.","supersedes":["0863093e69a16355fa9b90f8e7e29156ea4ad88c4523bc4883568bde831bdf35"],"tags":["wasm","custody","publication","source","installed","preflight"],"title":"Current WASM 0.4 source retains protected originals and separates native acceptance"}

docs/atlas/records/ab4502eff76606ac8e58b623878f3d76e1e0b18f30796aec7c446e2aab8b57c8.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tests/Wasm.Lifecycle.Correspondence/InstalledHostControls.fs","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"fd065fce79373f70e7f8a75a825d17544e568a069c5f22b1d6792cffeee27f58"},{"path":"tests/Wasm.Supervisor.Compatibility/CompatibilityCorrespondence.fs","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"72ac04f2de32c5b4efcd3e53fbc7449db5c9dfda005947ee6e2df6c24f15926f"},{"path":"scripts/verify-wasm-supervisor.sh","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"f75f084b021c3e22754897753cfbf9b91060a2a9d8600cd790ab1ffc834d2409"},{"path":".github/workflows/wasm-shared.yml","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"119acca0349717cec587562d59bd21c58d413b4a6c5f9e95205c95da5042d520"},{"path":"docs/roadmaps/wasm-shared-01.md","repository":"FS-GG/FS.GG.Game","revision":"4292129d3a8cc494054e5681429a56c5b152492f","sha256":"2fbf17a8d3794bb7709a6fafe8c20b1506ff112a40d3783e093f6311d3d38260"}],"conflictsWith":[],"id":"game/shared-control-compile-boundary","kind":"lesson","recordedAt":"2026-10-17T07:13:35Z","repository":"FS-GG/FS.GG.Game","schema":"fsgg.atlas/1","status":"recorded","summary":"Shared current source/installed F# controls must model each real caller profile, explicitly type ambiguous public records and accumulate singleton effect callbacks. PR713 qualifier39006292599/a1 failed late source compilation after earlier contract/model/browser/package gates; only its final60 compiler lines survived. Connected fixes annotated all include contexts, accumulated captured commands with a nonempty Post/Arm omission control, removed obsolete installed0.2 fallback and frontloaded the existing source/installed build+CLR/Fable suites once genuine inputs exist. Same-job source/tree/version/status/DLL guards protect reuse, one coherent pack and fresh locked cache remain, and all final model/Core/browser gates share the unchanged35-minute deadline. Actual helper-based inert refusal controls passed. Original early39008574356/a1 then exposed conditional-field/projection type errors, with same-head required shell lint39008574510/a1 exposing mkdir parent/mode misuse; corrected sources retain those failed outcomes.39008813238/a1 actually built source but failed an incomplete callback-refusal assertion: source inspection establishes ordered owner-unavailable then disposed precheck errors with unchanged state/effects. The control now checks full exact refusal, retired projection and mechanical/result stability.39009007033/a1 again built source then failed CLR with RequestOwnerUnavailable; source inspection exposed hardcoded SC2 ABI and queue assumptions in a generic BAR caller. The whole cohort now shares one typed ready fixture deriving descriptor ABI and immediately asserting worker/generation, compiled/initialized/idle/live state, exactly two successful setup settlements and no armed timers. An explicit applicability table retains all five SC2 reentry histories on default/selected SC2 through both facades; BAR uses queue-free timer/ancestor histories plus actual Busy refusal. That admitted-update refusal retains one Refused settlement while preserving current worker/request and no extra Post/Arm/termination; it must not be confused with effect-free precheck errors. A fresh subsequent BAR terminal dispatches once, preserves actual outcome and retires. All success/rejection/adapter/synchronous-result, cleanup/exact-once controls and downstream current suites remain, with case/profile/facade diagnostics. Whole-cohort independent source review and clean static/inert+canonical lock checks passed; no local CLR/Fable/model/browser workload ran. Seven generation inputs and71 accepted outputs are unchanged. Every original failure remains failed. Subsequent full PR qualifier39009544440/a1 and protected-main qualifier39010989001/a1 at5e2ebd8d1df0412d4725b31bcb8d380b3c85e48a actually passed the repaired cohort through source and exact-candidate installed CLR/Fable, full model/Core/browser suites and custody freeze/upload. The protected job took829seconds under the35-minute limit; independent data review accepted its original39-member artifact12092849150. This is one observed fit, not a general cold-cost guarantee. A later read-only publication preflight exposed a current checkout-log reader defect; its connected source correction requires fresh P=E qualification/custody and cannot reuse old package custody under a new executor. Publication and fresh both-feed served installation remain owed. Early failures now precede costly stages, but runtime/cost savings are not measured.","supersedes":["33df463263533529cca24a0b09937573f836d197cc1a739e9960b1cdd4deb1fd"],"tags":["wasm","fsharp","inference","correspondence","preflight","pipeline","current"],"title":"Shared source and installed controls need explicit boundary types and early current qualification"}

docs/roadmaps/wasm-shared-01.md

@@ -1,12 +1,49 @@
 # WASM-SHARED-01 — producer qualification successor
 
+## Protected qualification and current checkout-reader correction
+
+PR713 delivered the reviewed terminal correction and coherent 0.4 source to
+protected main `5e2ebd8d1df0412d4725b31bcb8d380b3c85e48a`, tree
+`1b15f6d4d10982178021e496e08aae376472c9b4`. The complete PR qualifier
+[39009544440](https://github.com/FS-GG/FS.GG.Game/actions/runs/39009544440)
+and protected-main qualifier
+[39010989001](https://github.com/FS-GG/FS.GG.Game/actions/runs/39010989001),
+both attempt 1, passed. The latter's job `117333290828` passed all eleven
+maintained qualification gates, froze the eligible originals and uploaded artifact
+`12092849150`. Independent data review accepted its exact 39-member closure,
+original packages, SDK, manifest, hashes and bounded evidence. This includes actual
+source/installed CLR and Fable controls, current 0.3 API classification, fresh
+53-default/16-selected trace checks and real browser suites; generation was skipped.
+The earlier failures below remain failures. Publication, fresh both-feed installed
+acceptance and product adoption have not occurred.
+
+A subsequent read-only publication preflight found a current native-check reader
+defect before any publication operation. The required lock-range job
+`117328885864` records `actions/checkout@v7`, with the runner resolving that ref
+to the accepted full action SHA. The reader recognized only the full-SHA group
+label. All nineteen original required-job logs were inspected: sixteen use the
+full-SHA label, two reusable jobs use the resolved `v7` label and check out Game
+plus the shared repository, and one validates PR metadata without checkout.
+The correction must authenticate the native ref-to-pin resolution and select
+Game's actual checkout, preserving ambiguous, foreign and wrong-pin refusals.
+Installed and both-feed reader paths were included in the connected sweep.
+
+The successful original qualification/custody remains truthful historical evidence.
+Changed publisher source requires a new reviewed protected producer equal to its
+executor and fresh complete qualification/custody; the accepted old originals cannot
+be overlaid with the new reader. Seven generation inputs and all 71 independently
+accepted outputs remain unchanged, so this correction requires no new generation.
+Organization occupancy remains unknown where local reads return 403. Native
+publication admission must establish current protection, occupancy and credentials
+before writers; source delivery grants no publication authority.
+
 ## Coherent 0.4 candidate and current published-baseline classification
 
-The unpublished terminal API selects stable coherent 0.4.0 before final source CI.
+The terminal API selects stable coherent 0.4.0; it remains unpublished.
 Both .NET packages, Contracts source-profile metadata, SDK version, Rust helper and
 both Rust examples move together. Browser's exact same-version Contracts dependency
 continues to derive from `WasmSharedVersion`; no new package identity is introduced.
-This is source preparation, not a published version or a product consumer pin.
+This is qualified source, not a published version or a product consumer pin.
 
 Current release classification compares actual 0.3.0 from producer
 `16a401692f4c0dee7f6da1a86d0cd49e6ea3ec2c`, tree
@@ -16,8 +53,9 @@ The selected policy binds the actual public served archives: Browser SHA256
 `74a11425bfb64c152ffbeab5be2753434e08f55f806e85113cdc25cacbc86fa5`
 and Contracts SHA256
 `90839f0bef2688447a55568dcb370941efec6f4e043742b9b4b8969c247acfa1`.
-Read-only archive/nuspec inspection established these inputs; native API comparison
-of the new DLLs remains unexecuted. Actual classification is reported by the native
+Read-only archive/nuspec inspection established these inputs. The complete PR and
+protected-main qualifiers subsequently classified both current DLL comparisons as
+compatible; that observed result grants no old-version compatibility obligation. Actual classification is reported by the native
 comparison, with unavailable or unexpected results refused. Historical 0.2 and 0.3
 policy bytes remain explicit read-only evidence mappings, without granting current
 publisher authority or promising compatibility for old callers.

scripts/wasm-release/promotion.py

@@ -300,21 +300,36 @@ def metadata_head(log,head,expected):
     need('  SELF_REPO: '+REPO in lines, 'metadata-only repository differs')
 
 
+CHECKOUT_SHA = '3d3c42e5aac5ba805825da76410c181273ba90b1'
+
+
 def checkout_commit(log):
-    """Read the pinned checkout action's own git-log result, never a script echo."""
+    """Join runner download resolution to the Game checkout's own git-log result."""
     lines=job_log_lines(log)
-    starts=[i for i,line in enumerate(lines) if line=='##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1']
-    commits=[]
-    for start in starts:
+    # Only runner setup can resolve a mutable action ref. A later script echo
+    # cannot supply the missing resolution for an executed checkout step.
+    setup_end=next((i for i,line in enumerate(lines) if line.startswith('##[group]Run ')),len(lines))
+    resolutions={}
+    for line in lines[:setup_end]:
+        match=re.fullmatch(r"Download action repository 'actions/checkout@([^']+)' \(SHA:([0-9a-f]{40})\)",line)
+        if match:resolutions.setdefault(match[1],[]).append(match[2])
+    starts=[(i,line.removeprefix('##[group]Run actions/checkout@')) for i,line in enumerate(lines) if line.startswith('##[group]Run actions/checkout@')]
+    selected=[]
+    for start,ref in starts:
         end=next((i for i in range(start+1,len(lines)) if lines[i].startswith('##[group]Run ')),len(lines))
         block=lines[start:end]
-        if 'Syncing repository: '+REPO not in block: continue
-        need(block.count('Syncing repository: '+REPO)==1, 'ambiguous checkout repository')
+        repositories=[line.removeprefix('Syncing repository: ') for line in block if line.startswith('Syncing repository: ')]
+        if REPO not in repositories:continue
+        need(repositories==[REPO], 'ambiguous checkout repository')
+        header_end=next((i for i,line in enumerate(block) if line=='##[endgroup]'),len(block))
+        declared=[line.removeprefix('  repository: ') for line in block[:header_end] if line.startswith('  repository: ')]
+        need(declared==[REPO], 'checkout declared/synced repository mismatch')
+        need(ref in (CHECKOUT_SHA,'v7') and resolutions.get(ref)==[CHECKOUT_SHA], 'checkout ref lacks exact accepted native download resolution')
         positions=[i for i,line in enumerate(block) if re.fullmatch(r'\[command\].*(?:/|\\)git(?:\.exe)?"? log -1 --format=%H',line)]
         need(len(positions)==1 and positions[0]+1<len(block), 'checkout commit missing/ambiguous')
-        commit=block[positions[0]+1];sha(commit,40);commits.append(commit)
-    need(len(commits)==1, 'actual selected repository checkout missing/ambiguous')
-    return commits[0]
+        commit=block[positions[0]+1];sha(commit,40);selected.append(commit)
+    need(len(selected)==1, 'actual selected repository checkout missing/ambiguous')
+    return selected[0]
 
 
 def verify_protection(native,binding):

tests/Wasm.Supervisor.Compatibility/README.md

@@ -54,7 +54,7 @@ baseline qualification root, coherent candidate custody and candidate version,
 and a fresh output outside source. It limits local .NET work to one process
 with node reuse and shared compilation disabled. The second consumes the
 first gate's installed Fable output, requires pinned WASI SDK 34, independently
-builds its guest, extracts the exact candidate Worker assets and runs all eight
+builds its guest, extracts the exact candidate Worker assets and runs all ten
 pinned Playwright controls from a fresh external public directory. Its looping
 initialization/process and enclosing-budget cases assert containment, without
 claiming exact wall-clock scheduling latency.