[DO NOT MERGE][upstream-sync] Reviewed schema-forward rollback artifact

[fineas-bot]

Outcome

Final rollback artifact under review; do not merge into forward main. Signed bridge head 08fed5c267fd0d338a0c4923f893b1d4fa61bec5 pins final forward head 46d5932719cfcbb8a8067e68f98a4c7c2c20c853, carries #68's least-privilege Slack ETL rules on the bridge schema, and passes the exact final forward-schema rehearsal. Run 29204217256 published the final four-row runnable-linux/arm64 descriptor with SHA-256 37aa422c59ef3e7113419b5a81a02321a631355dc7035cc2429ed6c4068f4306.

This is a parallel, schema-forward emergency rollback branch rooted at TipLink Centaur ba2c01f5a8d0fb90c1ea4bab8f73d069b9bc7900. Merging it into forward main would mix the legacy runtime tree into the adopted upstream architecture. Keep the exact head reachable through its immutable publication tag during the rollback window, then close this PR unmerged only after the bridge-retirement gate.

Frozen provenance

• Legacy baseline: ba2c01f5a8d0fb90c1ea4bab8f73d069b9bc7900
• Reviewed forward: 46d5932719cfcbb8a8067e68f98a4c7c2c20c853
• GitHub-verified bridge head: 08fed5c267fd0d338a0c4923f893b1d4fa61bec5
• Remote/local tree: eb337793a429ecca76036f70e9893c3bcf13fedc
• Audited local source commit: b522b0d7e2ee1bacaf76dd4c702385cf10e6c79f
• Immutable publication-attestation tag: rollback-bridge-publish-live-scope-verified-08fed5c267fd0d338a0c4923f893b1d4fa61bec5-forward-46d5932719cfcbb8a8067e68f98a4c7c2c20c853-at-1783881426

The remote head is a nine-commit GitHub-verified reconstruction rooted at the unchanged baseline. .github/rollback-bridge-reviewed-forward-commit stores the exact reviewed-forward SHA used by provenance CI, the cross-version rehearsal, and publication gates.

Safety contract

• RUN_MIGRATIONS=true is rejected before listener binding or database access. The bridge always runs with migrations disabled.
• CENTAUR_ROLLBACK_BRIDGE_PAUSE_WORKFLOWS=true is mandatory. Paused startup creates no queues, workers, schedule ticks, metadata reconciliation, or workflow mutations.
• The bridge uses a distinct CENTAUR_CONTROL_API_KEY; missing or reused service credentials fail startup.
• Release and assignment are compare-and-swap fenced. A sandbox-stop failure returns HTTP 503 with ok=false, and the operator helper verifies the complete response.
• Drain permanently fences warm-pool replenishment and waits for in-flight allocation boundaries.
• The API cutover requires zero old/new overlap because this bridge does not implement the forward runtime's stdout-owner lease protocol.
• Console remains on the reviewed forward image; only API, Slackbot v2, sandbox, and IronProxy use bridge images.

Schema and workflow compatibility

SQLx migrations 0033–0043 and the checksum ledger are byte-identical to the frozen forward head; 0001–0032 remain the deployed legacy history. The bridge embeds the forward manifest only so SQLx accepts an already-migrated database. It never applies or down-migrates schema.

Exact-head CI runs the final forward 46d59327 -> bridge 08fed5c -> same final forward rehearsal against disposable databases. It applies schema 1–43, validates owner-fenced release and assignment, preserves representative pending/running/sleeping workflow state, and proves the same final forward runtime resumes. No predecessor-equivalence assumption remains.

Final reviewed descriptor

All rows use tag reviewed-08fed5c267fd0d338a0c4923f893b1d4fa61bec5 and OCI revision 08fed5c267fd0d338a0c4923f893b1d4fa61bec5:

Component	Runnable linux/arm64 child
API	sha256:b3da58be89320aafa47df80f6911c55b8e801bc78b2c9af74db5e3b4e8b14422
Slackbot v2	sha256:0b2a141647b9076a4271143ba91d402bee905e7149d685d6400087e73dce7ac8
Sandbox	sha256:cfe82e62bcc48a2d9070491e809121fe3c02b3ef47af57dbecc6ef2945c5c96d
IronProxy	sha256:90b31ca427d068eccbb16f6f9637e0418c97cb01ed3c42257b9b47fc8831fe82

Artifact 8263446588 contains the exact four-row descriptor. Authenticated GHCR inspection proved every reviewed tag is a multi-platform index with exactly one matching linux/arm64 child and the exact OCI revision.

Publication and rollout boundary

Publication is globally serialized and refuses pre-existing tags. The release gate requires this exact GitHub-verified, open, non-draft PR head plus exact-head CI success, Console CI success, and Image validation success; CodeQL is intentionally not queried or gated.

Before the one-time attestation tag was created, the infra helper read the live child Application and proved Image Updater excluded every bridge repository and the exact reviewed-<full-sha> tag. Publication created inert registry artifacts only. It did not authorize Git/Argo consumption or mutate Kubernetes.

The paired foundation is TipLink/fineas-centaur-infra#136. It digest-locks these four rows, keeps forward Console and the observed legacy overlay, requires the admission freeze, and supplies the zero-overlap rollback/runbook gates.

Verification

• Exact-head CI, Console CI, and Image Validation aggregates passed.
• Native amd64/arm64 packaged-agent probes passed with Codex 0.144.1, Claude Code 2.1.198, the reviewed browser path, and no model turn.
• The exact forward-schema rehearsal and API integration tests passed.
• The Scope Slack ETL token rules #68 bridge carry passed permission-manifest translation, docs parity, formatting, bridge trigger/safety, and frozen-forward checks.
• Publication trigger tests reject wrong-forward, annotated, reused, stale, future, and overflow-capable tags.
• The coupled infra suite checks stage-specific pins, registry children, updater scope, migration state, release semantics, quiescence, and live image IDs.

Superseded evidence

The earlier signed head 63ef84d040228e71ae1e1888051c97c4c6508ce4, run 29198475211, and descriptor SHA-256 47094fb5f7aa5030aaac21e74324a1cc5e9cea6c519ba9799d65fce81e471995 remain valid audit evidence but are forbidden rollout inputs because they predate the final forward head and #68 carry. Its immutable tag must still never be moved or recreated.

No CodeQL workflow, suppression, or analyzer-only source change is part of this bridge. No live GitOps, Kubernetes, database, or service state was changed by preparing or publishing the final bridge.