[Task] Implement immutable consolidated package and symbol executor #8649

Program: #8194
Parent: #8220
Related: #8645, #8647, #8643, #8216, #8593

Outcome and readiness

Implement the artifact-only consolidated Feedz executor and complete symbol-content verification for the original 3.10.0 candidate. This provides the reviewed executable needed for the later, separately approved publisher cutover and publication. It must never rebuild the candidate or treat a successful push as content proof.

The accepted #8645 original-input verification and complete package reconciliation are reusable foundations. #8647 supplies the authority inventory and ordered cutover constraints; its preparation does not supply operational approval. Verified existing-release PDB research establishes an anonymous Feedz Portable PDB retrieval path across the three 3.9.0 frameworks, without proving candidate 3.10 symbols or original snupkg archive readback. No matching open issue or PR was found on 2026-10-07. #8593 remains the separate general NuGet.org/OIDC publisher correction.

This bounded implementation is accepted through merged #8650 after #8647 acceptance. Implementation starts from program merge 8876428f472f3cf22957bec35302ee2470644dc9. The Sol 6.1 worker owns executor/symbol-verifier code in an isolated worktree; the lead owns the workflow, integration and final QA. Implementation itself does not depend on the pending Hosted routing or npm ownership decisions; actual release activation does.

Scope and acceptance

• Reuse prepare_recovery_inputs and full plan_recovery reconciliation, preserving their read-only contracts. Bind original producer source ba5b348aa2414fdf7c19d9d8806e87b7c91a4205, run 37456860080 attempt 1, artifact 11412848210, archive SHA-256 ace85260c3389916fe3dcd7ee9cd5b766e4030dd6cee13c7f89285ada79c944f and expiry 2026-11-05T12:13:30Z. Revalidate all 225 package/symbol pairs (450 archives), complete package inventory and 124 exclusion rows / 123 excluded IDs. Accept no arbitrary feed, version, package subset or replacement archives.
• Implement explicit bounded upload of original missing package and symbol bytes to the fixed intended Feedz resources. Before any upload, reconcile every package and all manifest-derived expected symbol keys. Conflicts, unreadable state, missing approval inputs or uncertain authority block mutation. HTTP 409, retries and --skip-duplicate cannot prove content equality. Stop on unknown acceptance; resume only after fresh reconciliation with the same original bytes. Preserve a complete sanitized operation ledger even on partial failure.
• Extend the existing symbol verifier without breaking its current modes. Emit each DLL/PDB association's Portable PDB key, GUID, stamp, declared checksum and unchanged PDB hash. Preserve SourceLink/document and association checks. Fetch actual symbol bytes through the intended-reader contract; validate GUID/stamp/normalized checksum and exact original PDB bytes. Reject inconsistent duplicate keys; deduplicate network reads without dropping package/framework associations. Explicitly account for assembly-free packages. Completion requires 225 matching packages and every required PDB association, not a representative sample.
• Keep original .snupkg archive readback explicitly separate and unproven unless the provider supports and verifies it. Do not equate public PDB retrieval with private-reader rights, authenticated publisher absence, or whole-archive round trip. Bind the execution ledger to the original archives and publish request outcomes as well as retrieved package/PDB contents.
• Add an artifact-only workflow: token-isolated retrieval; complete verification without publisher credentials; a manual, explicitly approved protected execution job using a dedicated environment-scoped credential. Never build/pack candidate projects; compiling the verifier is allowed. Default/PR/push verification must have no publication capability. No credential fallback, arbitrary ref/input source, script interpolation or unreviewed artifact can cross into execution. A workflow input or environment name is not approval: document and enforce the actual admission boundary, including current exact executor/approval/candidate identities and the pending protected environment setup. Do not provision environments/secrets or dispatch publication in this implementation task.
• Add focused normal/optimized contracts for complete and partial recovery, package-present/symbol-missing state, accepted-then-interrupted uploads, delayed visibility, 409 ambiguity, package/PDB conflicts, changed or expired input, wrong GUID/stamp/checksum/bytes, incomplete framework coverage, duplicate keys, bounded requests/deadlines, fail-closed admission and credential-safe diagnostics. Exercise the real upload/reader transport against a bounded local fake service without real tokens or public writes.
• Run hosted artifact-only integration against the actual retained candidate, checking every original DLL/PDB association and all 225 pairs without publication. Preserve existing maintenance/recovery verification. Root reviews implementation and exact-head evidence; merge only after repository CI, independent Elsa 3 APPROVE + HIGH and Greptile 5/5.
• Update operator documentation with exact rehearsal, approval, execution, readback and recovery commands, known limitations and retained receipt locations. The concrete future approval packet must identify reviewer/ref/bypass settings, provider overwrite controls, source maintenance/npm replacement, old/queued credential containment, fresh quiescence and full compatibility. Do not silently waive a pending gate.

Admission contract for implementation

Use the conservative fail-closed default established in lead readiness review. Only GitHub's native approval of the same workflow run against the fixed, pre-existing protected Core environment can authorize its publication job. A CLI flag, workflow input, JSON approved/ready value, prior receipt or artifact-produced output is not authority. Explicit dispatch may select the operation but cannot bypass the native approval/protection gates.

Before admitting a protected publishing job, perform a fresh bounded read that proves the expected existing environment identity, required reviewer identities, prevention of self-review/admin bypass, and exact allowed execution refs against reviewed policy. Do not allow a missing environment to auto-create an unprotected publishing path. Missing, unreadable, incomplete or mismatched configuration blocks admission; preparation and verification can still run without publisher credentials. Recheck the applicable policy at execution before using a credential. Use a dedicated environment-only secret with no repository/org fallback. No publisher credential is exposed to the retrieval, build or verification jobs.

The actual environment ID, reviewer IDs, allowed refs and operational approval are not invented here. Their absence is a tested blocked-admission state. A later explicitly approved, reviewed configuration change can bind those exact values; no arbitrary dispatch value or boolean override may fill that gap. Bind the executor revision, original candidate/run/attempt/archive, full manifest/feed and same-run verified bytes in the approval summary and execution ledger. This implementation may be accepted with publication correctly blocked while operational configuration remains pending; it must not claim a live protected environment or completed cutover.

Version one permits publication only from Core refs/heads/main, manual dispatch attempt 1. Recovery uses a fresh native-approved dispatch. Public scheduling checks establish eligibility only and explicitly defer credential provenance. After native approval, a separate environment-only ELSA_CONSOLIDATED_METADATA_READ_TOKEN performs bounded GETs to the exact environment/repository/repository-visible organization secret-name endpoints; complete stable snapshots must show both dedicated credentials only at environment scope before publisher-key use. This token must have only repository Secrets:read and Environments:read, with no Actions/artifact-reading, Contents or organization-administration grants. Actual grants require administrative inspection during future approved setup; names do not prove permissions. Inspector child processes receive neither credential. Existing rejection of inherited GH_TOKEN, GITHUB_TOKEN and ACTIONS_READ_TOKEN remains intact. Immediate fresh checks narrow but cannot eliminate configuration races, so execution also requires stable reviewed environment administration. Implementation provisions no token, environment or live policy.

Boundaries and remaining program outcomes

Acceptance closes the reviewed implementation and nonpublishing proof, not the release. Actual provider/environment/credential changes, source-publisher cutover, NuGet/npm publication, deprecation or archival still require their concrete approval where absent. Full compatibility remains #8643; its 36 browser records and 60 optional profiles are preserved. npm ownership remains #8216. The parent #8220 stays open until actual approved publication, full readback and operational recovery outcomes are verified. Earlier research and simulations are not live release evidence.

Suggested minimal files: a new consolidated executor/test pair, existing VerifyPackageSymbolPair/Program.cs, one artifact-only workflow, and the recovery runbook. Extract shared helpers only where semantics match; do not fork the accepted input/reconciliation validation. Work exclusively in isolated worktrees. Use Sol 6.1 for implementation and Luna 6 Extra High for bounded review; final integration and QA stay with the lead. No heavy local .NET/Node/browser workloads while the host is overloaded; use hosted verification.

Sources: accepted lockstep ADR, original-byte recovery acceptance, public symbol research, NuGet symbol publishing protocol, GitHub secret-read timing.

Acceptance — 2026-10-07

Merged #8650 into the program branch as 702376b501439e5244a0db8728d12b9da86eb5d9. The lead verified both merge parents and exact tree equality with reviewed head db6157125ab70361030c0d24e3be99737d7237e8. Full acceptance and retained artifact evidence records passing exact-head gates, independent APPROVE + HIGH, Greptile 5/5, all 225 original pairs / 668 associations, complete attempt-2 readback and simulated recovery, and the retained failed attempt-1 timeout evidence. CI ran on the reviewed head; the identical-tree program merge uses [skip ci] and is not claimed as a separately tested merge head.

Only implementation/nonpublishing proof is closed. Actual publication, full compatibility, credentials/environment/source-publisher cutover and final main integration remain open in #8220/#8194.