[intel352]

Summary

Task 27 / PR 16 adds bounded released-wfctl version diagnostics and isolates the native test fixture from optional background update notices. No production provider behavior, dependencies, workflows, policy files, credentials, or cloud resources change.

The admitted native v0.86.1 executable returned exit 0 with 92 stderr/combined bytes: its version plus a v0.86.2 update notice. Setting the documented WFCTL_NO_UPDATE_CHECK=1 in the existing allowlisted fixture environment removes the optional lookup. Strict raw combined-output equality, exact binary SHA/size admission, SDK/state/restart/replay checks, and cleanup requirements remain intact. This local reproduction does not recover the lost output of merged CI run 37212700162.

Verification

• Actual native original symptom RED; removing only the opt-out reproduces RED; restored fixture completes the real saved-plan/state/restarted-plugin/replay proof.
• Lead independent go test -race ./... -count=1, native proof enabled: six test packages pass, two packages have no tests.
• go build ./..., go vet ./..., format and diff checks pass.
• Changed-file/new-issue lint: zero issues with golangci-lint 2.12.2. Full-tree baseline retains 32 existing issues; this is not a globally clean-lint claim.
• Diagnostic subprocess tests cover separate streams, extra/wrong/malformed/empty output, nonzero exit, timeout, cancellation, start failure, overflow and known-value privacy. Raw admission bytes are never redacted or filtered.
• Immutable public-workflow policy and its fixtures pass; .github, go.mod and go.sum are unchanged.
• Local Darwin native execution requires TMPDIR=/private/tmp: the longer default temporary parent produced a separate plugin-handshake failure after version admission. This disclosed harness boundary is not a product fix or a hosted CI success claim.

One initial adversarial code review and the opt-out-only closure found no warranted Important/Critical issue. Final restored flag and source hashes were independently checked by the lead. Hosted exact-head CI and normal protected merge remain required.

Scope

Design: https://github.com/GoCodeAlone/workspace/blob/docs/workflow-compute-recovery-0a-closeout-20261002/docs/plans/2026-10-02-workflow-compute-recovery-design.md

Plan: https://github.com/GoCodeAlone/workspace/blob/docs/workflow-compute-recovery-0a-closeout-20261002/docs/plans/2026-10-02-workflow-compute-recovery-0a.md

PR Count: 16
Tasks: 27
Status: Locked 2026-10-04T20:02:20Z

PR	Title	Task	Branch
16	Diagnose and repair released-host CI version evidence	Task 27	fix/released-host-version-evidence-20261004

ADR 0160 authorizes only this source-only slice. No DigitalOcean token/API access, provisioning, deployment, spend, protection bypass or policy relaxation. Immutable v2.1.19 is not retargeted. Original recovery and slimming gates remain open; any necessary successor and consumer-pin reconciliation follow verified merge/release.

Doc-reconciliation: clean.