[intel352]

Summary

• Add parent-bound database identities, explicit user/admin credential epochs and sensitive output/input routing.
• Add exact-target App Platform one-off jobs with durable status, cancellation and component-only cleanup after restart or ambiguous responses.
• Enforce read-only live Droplet pricing and mandatory released-wfctl saved-plan proof in the existing credential-free Go-test job.

Scope

Original PR3, Tasks7-9 of the approved recovery plan: 26 tasks, 15 PRs, locked 2026-10-04T04:48:25Z. This does not deploy staging, apply infrastructure, rotate credentials or authorize spend.

Design and plan

Verification

• Corrected builder full native-enabled race: 1,419 passing cases, no failures or skips. Lead independently reran 38 helper/native cases plus build and vet successfully.
• Actual downloaded wfctl v0.86.1 and production SDK/plugin own saved-plan apply, state reload, restart, failed reset and retry. Epochs 2/3/3/4; six reset attempts; zero plaintext; owned children and listener reaped. Only the DigitalOcean HTTP dependency is a loopback fixture.
• Lead actual Go cache experiment: unchanged run/attempt cached; changed run and changed attempt each executed a new native proof. Required CI rejects overrides and unsupported platforms rather than skipping.
• Complete CI/trust/script bytes remain equal to immutable base 5e5887a5. That base's actual policy scanner passes all five candidate workflows.
• Full lint is not globally clean: unchanged baseline findings remain; golangci-lint --new-from-rev=5e5887a5 reports zero introduced issues.
• Original provider/runner findings and the initial adapter review remain closed. The actual first Linux failure traced to wfctl's godog initialization querying Go under an isolated HOME: the build-only toolchain pin caused a read-only runtime download. A two-file regression-tested correction uses runtime GOTOOLCHAIN=local, retains the exact build toolchain and checks the compiled plugin's GoVersion. One targeted 15-class changed-code recheck returned SHIP-IT; ordinary cleanup and fresh run/attempt cache proofs pass.
• Exact corrected head 5d5e99735c4bedde25a1695ebec6cea3f47b2863: all eight PR checks pass. Hosted Linux/amd64 run 37184948049, test job 111384823433, passed race/native, vet and policy checks. Earlier failed run 37181771108 remains recorded, not relabeled as acceptance.

Hosted Linux/amd64 mandatory native CI is satisfied at the corrected head. Immutable release verification and the operator-only read-only live price check follow merge; YAML custom-resource discovery waits for the separately planned upstream successor. Live pricing is not claimed: the existing operator token channel must be available, and a nonempty actual provider price quote must be observed; CLI plan/exit0 alone is insufficient.

Doc-reconciliation: clean. Actual runtime report excerpt from the independently executed released-host consumer:

{
  "result": "PASS",
  "wfctl_version": "v0.86.1",
  "saved_plan_latest_epoch": "2",
  "rotated_epoch": "3",
  "failed_reset_retained_epoch": "3",
  "retry_epoch": "4",
  "owned_children_reaped": true,
  "owned_listener_reaped": true,
  "plaintext_in_state_plan_logs": false
}

No live cloud credentials or mutations were used.