[adrianwebb]

Outcome

Protected publication ran Deployment's complete native suite without installing its required disposable host or Reviewer. Actual rc322 publication39402012395 failed18 tests (1327 passed) on missing original installed runtime/broker, native privilege and Reviewer prerequisites. No signed release was published. Verify already owns the complete working sequence; both workflows now invoke that one sequence.

Work authority

• Work item / Issue: Current deployment backlog: retained requirements after issue consolidation #834; current plan/evidence Complete accounting transition observations for strict Agent acceptance api#553; Capacity provider and Agent acceptance: checked repair delivery and SDK golden completion (continuation of #633) platform#634
• Proposal / decision: recovery supporting accepted API Decision2839f4c7-16bb-4aa4-b6c2-20280108537c
• Assignment / checkpoint: failed publication39402012395 of exact immutable rc322 tag540cf263f5e23eeaf7c10d433da13a765603242e, after Platform649 merged its reviewed prospective composition
• Actor: Codex integrator as adrianwebb
• Human authority: explicit continuing implementation/approval/merge/adoption authorization
• Agent / capacity provider: integrator repair of release infrastructure; no agent code product fabricated
• Exact base ref: staging68b6600f3a4885be8d2c4b5e80ae9f6b9e41aa14 (merged checked package-proxy887)
• Exact head ref: codex/native-publication-prerequisites553 a7c7b4d

Contributor mode:

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reproduce the missing shared prerequisite contract first; extract the already verified17-step sequence without changing commands/conditions/pins; make Verify and Publish use it; retain complete owner/Reviewer prerequisites before the original coded scenes; run fresh full Actions. Roll forward the still-unpublished rc323 candidate and a new reviewed Platform generation after checks. Preserve the failed rc322 tag/run/composition; never overwrite tags or publish CI fixture packages as real composition.

Changes and commits

• 68848a1 RED: missing shared native prerequisite invocation fails its exact assertion on base.
• fcbf831: the direct workflow caller retains the owning exact SDK installer; one local composite action owns prune, pinned Reviewer/native toolchain/archive custody, original fixture installer/privileged host setup, pinned development-image read-back, narrow native preflight, complete privileged owner suites, original coded scenes, required retained artifacts and owned-cache hand-back. All17 effective steps (one direct SDK call plus16 shared steps) are deep-equal to the previous sequence after adding only the composite's required explicit shell:bash default.
• Publish uses the same ubuntu26.04/Node24.12.0/cache and grants Actions read for original exact dependency artifacts. APT-only resume still skips fresh verification exactly as before and retains immutable existing-release custody checks.
• Existing contract tests inspect GitHub's effective local-composite steps; original assertions/pins/denials remain. Credential and workflow-ref guards must exist and precede complete verification. New behavior is bound to the existing component scene; existing real installed-host native integration cases exercise the shared sequence in Actions. No new runner, storage, model, fallback or relaxed allowance.

Verification

Seven focused contracts/3 files pass;31 other cases excluded by the focused name filter are not full-suite evidence. Strict build and source-shape524-file check pass. Exact before/after structural comparison proves commands, conditions, environments and supply pins unchanged across17 moved steps. A focused packaging contract initially expected inline YAML command text; it now asserts the same effective command and strictly verifies both guards exist before it. Full owner suites/native integration/scenes are pending and required on this candidate before merge/adoption. The first real failed publication remains failed.

Nested SDK context correction: first shared-action run39404251562 stopped before native setup/full suites: the owning SDK action's implicit source-ref input is empty when nested. 3fc8213 first adds the direct-caller/nested-explicit-commit regression; a7c7b4d keeps that original caller-bound installer direct in both workflows while the remaining16 steps stay shared. Nested Reviewer SDK commit remains explicit. Seven focused contracts and strict build pass;17-step effective sequence equivalence passes. No full-suite/scene pass is claimed for that failed run; missing scene artifact is a secondary failure. Fresh full candidate Actions are required.

Risk and rollback

This changes CI composition and publication prerequisites. Local composite resolution uses the checked-out exact tag, so publication must use a new tag containing the action; rc322 is retained as failed history. Revert through protected PR/checks if necessary. No runtime service, development selection, credential, existing retained work, test assertion, scene requirement or deadline is changed.

Completion summary

Native publication has a reproduced structural defect and a bounded shared-path repair. Full exact-candidate Actions and actual signed rc323 publication/read-back remain unproven. APIrc113 released-catalog adoption and the real readiness-counter acting chain remain pending.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.