Skip to content

v0.4.25 preparation evidence checkpoint

Recorded 2026-10-15. Not pre-release-ready. This checkpoint preserves bounded preparation evidence; it is not complete pre-release approval or a final immutable ecosystem matrix. Development integration is complete; main promotion, tagging, release and production Pages publication remain open.

Final release integration — 15 October

The user now authorizes development integration and release promotion; tag creation remains with the user. PR #881 is merged into the release branch, then PR #905 integrates that exact product tree into develop. The development commit is 84183b99194ba179101ba65dc663877e797ad97e; its tree is identical to tested Core ba664d398f65b9aa47882556bd27f9412cc0773d. Existing published commits remain on the release branch. Main and the previous development baseline have identical trees despite their divergent squash history; promotion must preserve the tested snapshot and main's existing history.

Docker 38715423224 and Podman 38719385981 pass real backup, archive restoration, original Identity/authored source/secret delivery and actual fixture cleanup. Both Coreless gates and both full reference Journeys pass in 38723551348. Both Coreless manifests contain ten executed native checks. Original ZIP digests and exact source/run/attempt bindings are independently verified. These six proofs were verified reuse origins before the follow-up repairs below; they do not constitute complete release approval for the repaired source.

The twenty earlier origins remain historical, with their outcomes unchanged: 38575480235, 38578200173, 38581635648, 38592039003, 38594100537, 38603519414, 38603766182, 38607415566, 38619239165, 38634676648, 38642797305, 38644896400, 38650783203, 38652359801, 38656694532, 38663203019, 38667644345, 38702898144, 38708284306 and 38712377373. All-attempt job pagination and the unchanged execution-copy filter show 59 historical latest-green gates and six latest-red gates before these repairs. All six reds now pass. The unchanged input verifier finds no unchanged inputs among those 59 older green gates; this is not a claim those tests failed. The earlier one-of-65 display counted only a single supplied new origin and was not overall project progress.

Freeze the final acyclic consumer bindings, qualify their actual joint runtime, and collect the remaining required gates with these compatible origins. The release workflow requires authenticated complete coverage and release-approved.json before tag publication. No approval is inferred from selected or skipped jobs.

Narrow follow-up repairs

The Podman metrics workload fixture now uses the selected runtime for both creation and removal, with a fully qualified image. The Podman-only metrics retry 38735449034 passes actual two-application metric reads over verified mTLS and refuses missing client identity. Its original ZIP SHA256 is 17c45ae7fa58337c4389d12ac49c3f35d8ed4523f9dce9bb6ba84d449b8ac65f.

The diagnostic Podman browser/Connector retry 38734970207 passes the complete native journey and owned cleanup, including fresh-context login, token expiry, production rotation, terminal and logs. Authentication code, timeouts and security assertions are unchanged. This successful retry does not establish the cause of the preceding login timeout. Its authenticated source-bound manifest ZIP SHA256 is 6bcc6abe880f05c64cf95f01af6d6ba56bc3e09c0d9a0d82f7f74f7fd6f0c9d1.

The earlier backend-placement run 38733194372 fails on both engines after successful SQL placement round trips: subsequent last-shared-consumer withdrawal cannot verify the retained application runtime. The regression reproduces locally for PostgreSQL and Valkey. Core c3ca8d9e2500d55f2a680d68b99fc9b3e197a1df preserves the original intent and placement in the existing bounded protected owner history. Current ownership, canonical-file, consent and separate data-deletion checks remain unchanged. CLI package tests, affected race tests, vet and readability pass. Only the affected Docker/Podman placement qualification is repeated in 38737266443. Both engines pass all PostgreSQL/Valkey placement round trips, last-consumer withdrawal and re-add with original authenticated data and credentials retained. Actual fixture cleanup passes. Original ZIP SHA256 values are 8fc3fc04d4601ef7a9d2f807131aedb1da9cd8adf6b6850777c1d9604887f8a3 (Docker) and 41976969527f32e8f79e7425dd12dd3b3c767726ca936603714ff769b308e987 (Podman).

These repairs change execution inputs. The unchanged release input verifier finds 65 changed fingerprints against the prior Core 4d9d847f; earlier green results remain historical rather than current release approval. Final consumer pins and authenticated complete release coverage still require reconciliation.

Current repair qualification — 14 October

One leading session now owns both previous work packages. The earlier closure boundary below is historical; targeted repairs and qualification have resumed. No complete pre-release approval, merge, tag or publication is authorized.

The projection repair is published as Core e68c6f43bea698f2446c5f62b9380ec6c8c8e456. It preserves independently managed Identity CA, credential and discovery material and the directory mounted by running workloads. Redirected, foreign-owned or externally writable projection directories fail before backend cleanup. Original issuer, TLS, secret and consequence-consent checks remain in effect. The preservation regression fails on be982079 and passes with the repair; local package tests, affected race tests, vet and source readability pass.

Targeted run 38642797305 passes Source and Runtime Image. Its downloaded, SHA256-verified scheduling artifact 11931512996 selects exactly Docker/Podman Identity and Security. All four native gates and cleanup pass. Original ZIP hashes, exact manifests and completed consumer logs are verified; this remains four scoped proofs. The unchanged verifier proves all 65 fingerprints differ from the preceding source; old greens remain historical until current compatible evidence is verified.

Both earlier Journeys on be982079 / Demo d58ccab0 fail Identity, Security and the recovery gate; their other 14 groups and cleanup pass. The original missing receiver file is /run/baseharbor/service-bindings/identity/ca.crt. Recovery fails during the first recovery up, before archive creation or restore: Docker reports gateway route timeouts; Podman reports HTTP 502. backup.pass is the password file, not a successful backup receipt. Gateway cause and actual backup/restore acceptance remain open. Original failure artifacts are retained. Journey retry 38644896400 selects only the two failed Journeys on the unchanged repaired product matrix. Both Journeys now pass 16 of 17 groups, including Identity and Security; cleanup succeeds. The first recovery start still reports HTTP 502 before backup or restore. Original ZIP 11933507233, SHA256 05419eb839a3878cef393e20a6ff51c910e49134fbe96e2d09a7c3bfe18cb1a8, has the exact repaired source bindings and a failure outcome. Failure-time diagnostics are being retained before a later full-destroy can remove them. The Podman original ZIP is 11933597851, SHA256 037add8396e358e5b6f3b5f5c938057aba72699b953a06a323a5c89202fa0b9c; its sole failed group and first-up HTTP 502 match Docker. Both failed manifests are correctly rejected by the unchanged reuse verifier.

Targeted recovery run 38652359801 passes Source and Runtime Image on Core d07e94f3 / Demo 495fc8ba. Both recovery gates reproduce HTTP 502 before backup; cleanup succeeds. The completed Docker and Podman gateway logs identify stale shared pgAdmin and cache UI routes whose upstream services are absent after the acknowledged all-management-UI to recovery transition. Docker diagnostic ZIP 11935928931, SHA256 d99190cb178437849c4c2c86435e18e2a5fcb5487b05120cccd27bf5d7cbf39a, is downloaded and verified. The narrow correction retires those route owners only when the protected canonical shared backend inventory no longer contains the corresponding UI service. Active sibling consumers retain their routes; missing, modified or symlinked provider owners and mismatched route authority remain errors. TLS and consent are unchanged. Native verification of this correction and actual archive/restore acceptance remain pending.

The pending source repair selects Go 1.26.9 through the existing setup-go toolchain contract. The language floor remains Go 1.25. Source vulnerability analysis with govulncheck v1.8.0 reports zero symbol-reachable advisories on the patched toolchain; module-only x/crypto findings remain classified, not erased. A new opt-in native OTLP handoff fixture requires actual Protobuf acceptance from the workload by an independently owned mTLS receiver, current-plan negative consent cases, unchanged protected material and managed return. Its local DNS plumbing and producer checks pass; native Docker/Podman acceptance is pending. The first retry 38650783203 stops in evidence selection before any native job: new origin IDs were incorrectly appended after the JSON array. The correction retains all origins in that array; the strict collector remains unchanged. The OTLP authored fixture also now uses canonical block components and signals. A failing-before/passing-after regression exercises the exact source-only initialization, generated identity and unchanged authored intent. No native handoff result is claimed for the preceding fixture.

Both Coreless jobs in that run retain seven passing native checks, then fail the new OTLP fixture before application initialization. Original Docker ZIP 11936411749 (SHA256 3813ca8bc23163419a4fbeb4fccf04cbb184c08cdccea22650fd9dbe5313ef95) and Podman ZIP 11936264356 (SHA256 742e65f50aab94427372d88168d71417d7c27ad4810d6a67fe9999c8765b840c) are downloaded and verified. The exact local Python/mTLS readiness regression reveals that the fixture's bare credential path violates the existing resource URI contract. Using file:// passes that same test; registration now validates before native fixture startup and readiness retains its last diagnostic. The production credential/trust validator is unchanged. Overall Coreless and actual managed/registered/managed native consumer acceptance remain open.

Repair retry — 15 October

Run 38656694532 on Core 1efb0baf / Demo 48c746e1 passes Source with actual Go 1.26.9 and Runtime Image. Both Backup gates now pass canonical routes on initial and repeated recovery starts, qualifying the preceding scoped gateway correction. They subsequently fail with ownership_ambiguous during consumer inventory, before archive creation or restore. Both cleanup results pass. Original diagnostic ZIPs 11937184505 (Docker, SHA256 d1b1676ea11dcb536c09d4183c38cef70facbe7f022d56eaf73629da27a6ef95) and 11938705346 (Podman, SHA256 e911e42adf8b5954988dbb4b806dd85b4172ba07fff328bef759fa7088490137) are downloaded, hashed and exact-source checked. The upload previously omitted protected failure-time diagnostics; it now preserves them alongside bounded, redacted read-only plan/status output. A public allowlisted inventory-stage code exposes no private cause or secret/native output. The Backup cause remains open.

Both Coreless jobs reach receiver mTLS readiness and actual workload export, then fail the new managed-to-registered OTLP transition. Original Docker ZIP 11938452628, SHA256 fe0a3f93741408d26be901a6b8a4601231e9357d9fa82de469f590be24afef13, and Podman ZIP 11938472075, SHA256 485f296504005438b914dcf4b986e573532186c49694cd7561f6664c0eff4168, are downloaded and verified. Missing success manifests remain failures. An authoritative external reference with a known local dependency boundary incorrectly made the common consumer union incomplete. The narrow correction keeps external physical state and quantities unknown and always preserves the foreign provider, while allowing verified own unused modules to retire. Unknown own ownership, missing external facts/dependencies and incomplete consumer inventory still prohibit retirement. The valid regression fails on published 1efb0baf and passes with the correction; full Go tests/vet and affected application/CLI races pass. A separate opt-in two-engine native gate checks this handoff without repeating preceding Coreless checks. Full Coreless acceptance and actual Backup/Restore remain pending; only Backup's two red gates are selected for the next recovery diagnostic. All earlier origins and failed attempts remain preserved. No final matrix, complete pre-release approval or promotion is claimed.

Focused native OTLP run 38662903797 on Core 38cd9fa6 confirms the repaired common union is complete on both engines, but still fails apply: managed Tempo preflight runs despite the selected external OTLP transport. The corrected orchestration follows that transport for managed storage, issuer requirements, retained trace-backend preparation and topology observations. Authored trace signals, external TLS/material checks and managed return remain mandatory. The exact valid registered-source regression reproduces the native Tempo error before the correction and passes afterward. No foreign trace storage or query adapter is invented. The small native workflow initially used Go 1.25 with automatic toolchain selection disabled; it now explicitly uses and asserts Go 1.26.9. Original failed Docker ZIP 11939373778, SHA256 516489e8c51d815462eb500ef995f11020da2aa4089e494fca8d259481b928f0, and Podman ZIP 11939897227, SHA256 be5fb139b1fdfd49361e9ba98dcb96a4b2ceec53be060bfcfcd3cdc3ea5be7b4, are downloaded, hashed and exact source/tree/outcome checked. The complete native handoff, Backup/Restore and final ecosystem qualification remain pending.

Native Docker handoff passes on Core 71514123, run 38663951349, original ZIP 11939583855, SHA256 cd4226058b1ced090810ef49a801eecd05eaebd5537178f542e7a756eedf8e57. Podman initially fails actual registered-workload export. A bounded secret-free consumer diagnostic identifies DNS gaierror, original ZIP 11939574692, SHA256 129fd98ffd0d383aed754063c87468d99ab9772b4d2590fbb27ba194dfa2e2c4. A valid source regression reproduces loss of the authored receiver network when Podman merges short-list and long-map Compose attachments. The narrow service- attachment merge preserves both connections and explicit !override; unrelated network declarations retain their validation. Full Go/vet, Podman races and CLI races pass. Native Podman retry on Core 23e6db07, run 38666054526, passes the complete actual managed/registered/managed handoff and owned cleanup. Original ZIP 11942165307, SHA256 b46950665e50addfe3fd9bd84ad68738963409a0a3e84b5db434b901ffe8531a, is downloaded and exact-source/tree/Go 1.26.9/no-failure/no-skip checked, including actual workload Protobuf, original protected PKI, current-confirmation negatives and foreign receiver preservation. These are bounded proofs on distinct sources, not the final common-matrix Coreless receipt.

Backup diagnostic 38663203019 on Core 38cd9fa6 passes Source and Image, then fails both native gates with inventory_stage=native-backend-retirement; cleanup passes. Protected failure- time plan/status is now actually retained. Docker ZIP 11940850994, SHA256 9f64e9dad7a553b518cabe9592eae39f31c01a1841b7d1f250f8683f01ba41b2, and Podman ZIP 11940547828, SHA256 42cd4178c1f4d46a34376a02cacd76fcde8ae9d4d83b6e03d4b2c284a4c9adda, are downloaded and verified: active consumer footprint is complete, but the common union preserves unverifiable Prometheus. A valid local regression first verifies the original canonical Prometheus definition, then reproduces its rejection after an independent provider withdraws its discovery source. Protected original renderer inputs are now retained within the existing provider owner; read-only inventory neither rediscovers nor rewrites them. Legacy owners still require an exact match with live canonical inputs. Changed definitions, redirected or readable private input files, foreign project/scope and ambiguous sources remain errors. Original runtime/authentication files remain unchanged. This is source qualification; actual Backup/Restore and all final-matrix gates remain pending. No archive or restore success is inferred from route or cleanup success.

Recovery retirement retry — 15 October

Run 38667644345 on Core 44b2f189 / Demo 731f15b9 passes Source and Runtime Image. Both native engines write the encrypted backup archive; neither proves restore. Docker then fails selected MongoDB retirement verification; its fixture cleanup also reports incomplete removal, despite the outer runtime reset succeeding. Podman reaches the archive after approximately 17 minutes and hits the 20-minute gate limit during retirement. Its interrupted cleanup is not a verified consumer result. Original failure ZIPs 11943530288 and 11943761164 have SHA256 ea39bce9b5951ab32aba7bdd32e7fc5ccad900693324f7c417a2c4ac2a1afa55 and 06b07bb112aba8d22be0275065804051a34a1e5933b7f102c6e6a10766674eb4. Both downloaded failure manifests bind the exact matrix and remain failure. The scheduling artifact selects exactly the two recovery gates, defers 63 and sets release_approved=false.

A local regression reproduces the owner loss: retire the original native backends, reactivate a smaller workload, then retire again. Replacing the latest retired intent discards the original backend resources while their retained provider offers still need physical inspection. The existing protected deployment record now preserves replaced retired intents and their original backend placements. These are recovery owners, not active consumers or another registry. Read-only native and broker inventory includes them; invalid, foreign and unbounded histories remain errors. Native absence still needs measured runtime inspection. TLS, material ownership and current two-stage/data-deletion consent are unchanged. Only the backup/restore gate receives a 40-minute runtime budget; other gate limits remain unchanged. Actual restore and final-matrix acceptance remain open until the targeted retry completes.

Shared-provider convergence retry — 15 October

Run 38702898144 on Core a22120ad / Demo cdf66283 passes Source and Runtime Image with Go 1.26.9. Both engines write the encrypted archive and pass the previous MongoDB retirement point. Both then fail runtime_retirement_unverified for opentelemetry-collector/shared; neither reaches restore. Both fixture cleanups report three unresolved results and preserve state. Successful outer reset does not establish fixture cleanup. The exact scheduling receipt selects two gates, defers 63 and retains release_approved=false.

Original Docker atomic-failure ZIP 11958605691 has SHA256 887d91fbce53dc2d58973f0f7dd2f21e78faaa4e301b6a53944ef7f5d57143ba; Podman ZIP 11958069980 has SHA256 5e76138a04b6cbb4f65f6ae5ec07e069b358dfd79af6634b579a32f19443833d. Both are downloaded and verified, together with both failure manifests and early runtime diagnostics. These remain failed evidence, not reusable greens.

The early native inventory shows the retained Collector and Prometheus running although the current complete plan selects their retirement without a new binding release. A broker-only dependency start loses its control-plane-only selection and resumes retained shared modules. Retirement then skips those modules because their bindings were released earlier. Two local regressions reproduce both defects before correction and pass afterward. Dependency startup now preserves its selection through fresh and existing Core paths; explicit platform resume retains its behavior. Existing standalone adapters also converge older unbound modules in the acknowledged complete plan. Actual unreleased bindings, required dependencies, foreign ownership, wrong Target/protocol and incomplete inventory reject retirement; canonical ownership and native absence verification remain mandatory. Protected material and volumes are retained. Current consequence confirmation and independent data-deletion consent remain unchanged. Native restore and cleanup qualification are still pending.

The existing auxiliary runtime workflow also stops pre-setting GOTOOLCHAIN=local before setup-go reads go.mod: the pinned setup action would otherwise choose the language floor instead of the preferred patched toolchain. It still sets local execution after installation. No release gate is removed.

Retired metrics route retry — 15 October

Run 38708284306 on Core 3232a766 / Demo 3cb6f5a0 passes Source and Runtime Image with Go 1.26.9. Both recovery workloads become ready, but canonical gateway verification fails before backup or restore. Both actual fixture cleanups now complete. Early Caddy logs on both engines identify prometheus-access DNS failure: the unused provider is stopped while its retained shared/prometheus route still points at that absent upstream. The final timeout lists other hosts too; those timeout strings alone do not establish their independent cause.

Original Docker diagnostic ZIP 11960028878, SHA256 cb39c81738847be45fe0049c7fcd4f78bd644786b28ef087ce3ff0b377e0f7ef, and Podman ZIP 11960726793, SHA256 38f0a31ae321195d0ef12edd7e16000a3e2a1cea8013b33024b7620070936ffc, are downloaded and verified with both original atomic-failure archives and exact-source failure manifests. No archive or restore success is claimed.

The route correction withdraws only the shared Prometheus route selected by a complete current Target plan for unused owned-provider retirement. It checks actual bindings, required dependencies and retained canonical provider files; host, upstream, network, path and TLS trust authority must match exactly. Active sibling/management dependencies preserve their route. Restart uses the existing read-only retirement planner when no apply plan is present. The route joins the existing grouped reconciliation before normal gateway verification; verification, redirect authority, TLS and consequence consent are unchanged. The valid canonical-fixture regression first reproduces the missing withdrawal, then passes with negative consumer/authority cases. Native acceptance remains pending. The separate new-binding negative fixture initially registered while metrics collection was disabled; its corrected setup explicitly verifies a real new binding before requiring rejection. That failed fixture is not acceptance.

Required metrics startup guard — 15 October

Run 38712377373 on Core 61c1d00a / Demo f0818b6c passes Source and Runtime Image, then both engines fail the initial guided startup before recovery: the new route helper requires complete inventory even when Prometheus is still required and no route removal is selected. This is a repair regression, not evidence against the original gateway diagnosis. Both actual fixture cleanups complete. Neither backup nor restore is reached.

Docker diagnostic ZIP 11962220587 has SHA256 85313679ffce93adfbda877a93a11ee291152912f45e092218698db8ee94e5e5; Podman ZIP 11961614597 has SHA256 ac824dc09ca95b7b2840fd722f8d4c49f76acf01f5bd788f39e6e0320560ee16. Original atomic-failure archives and exact-source failure manifests are retained alongside the early diagnostics. Their outcomes remain failure.

The correction checks the strict complete/Target/protocol guard only after an unused owned Prometheus route is actually selected for retirement. Active, required or newly starting providers retain their routes without that unrelated removal admission. Actual removal still requires the same complete plan, binding, canonical-owner and exact route-authority checks. A regression fails on the published source for incomplete-but-required inventory, then passes with the narrow guard move; incomplete selected retirement still rejects.

Further repair retries use the existing trusted Targeted Atomic Gate workflow for the individual runtime and backup/restore gate, without repeating the full Source/Contracts/Docs preamble. Local affected checks remain required. No execution workflow or evidence verifier is changed to enable this narrower path.

Closure boundary on 14 October

The currently checked Session 2 source is Core 971742dc80ce1593368142d50246bd7d12e0c0bc; all nine local checks pass. Remote consent precedes technical execution admission; restore binds current registered OTLP material even without prior delivery. Session 1 delivered the final material/Tempo correction as Core 0f06f3ad84181ac1f3d828d8e0c24386274e0cf4; all nine local source checks pass, with existing commits preserved. At the user's explicit boundary, no new native runs, complete 65-gate sweep or quality/toolchain expansion follow here. The final common consumer matrix and affected metrics/mTLS evidence remain pending. Earlier bounded green receipts are not overall acceptance. The internal audit records current source boundaries, failed attempts and open diagnostic findings.

Last authenticated diagnostic matrix

Repository Exact commit
Core af5fc9bcc48f4efa962149fac61cfcf77aa4e48d
Demo 6977221a074c84436a55ea3078e2b2e002e3bda9
Console cef4df809eb3f6de0acc5acf3cf658e299f69de0
Node Connector c9f0b441383353647f84ee56b477e11dee2525bf

Docker-only joint retry 38549430253 is fully verified SUCCESS: job 115803535185, attempt 1. All 16 authenticated qualifications and 23 browser steps pass, including original-data remote reactivation, Node revocation and cleanup. Its Console fixture independently checks native container, volume and network absence for the selected local Target and local data absence before emitting cleanup proof. Manifest artifact 11887081782, SHA256 463dee7542267a7be593642748dcb8486c9f9e66cdc914587cd88b6f5a6de5c2, and browser artifact 11886264478, SHA256 8e5eb47374f9b2942106c9a08b2057d1cd4b569842f33814cfb7dfc6d9b8d008, are downloaded and exact-source verified.

The production change only classifies an existing unknown-target discovery warning. It never guesses the runtime or grants resource ownership. Current-plan consent still requires Achtung, two confirmations and separate data-deletion consent. Only identical prior/current discovery rows can cross a bounded installation child-progress confirmation; arbitrary skipped, failed and deferred mutations remain failures.

Local source qualification

Core source tree b3b8f1e3c9006ef54b3cd94cc668144db00666a0 matches the published Core commit exactly. All nine independent snapshot checks passed:

Check Result
cli-build PASS (19.723 seconds)
docs-audit PASS (0.406 seconds)
docs-de PASS (2.208 seconds)
docs-en PASS (2.008 seconds)
go-race PASS (53.875 seconds)
go-tests PASS (65.509 seconds)
go-vet PASS (18.915 seconds)
readability PASS (3.211 seconds)
script-tests PASS (3.112 seconds)

The local snapshot receipt is baseharbor-local-qualification-193wh8rd/result.json. The snapshot's local commit label is not the API publication commit; the exact Git tree equality is the attribution. The affected CLI race package is ./cmd/baha. A failing-before/passing-after regression verifies typed unknown Target discovery, current-plan invalidation, no inferred engine or deployment owner, and retained state preservation. Console's 64 contracts, architecture, typecheck, lint, fixture consent negatives and candidate pin tests pass. Demo's four consent negative cases pass. These source checks do not qualify native consumer execution.

Independently verified native results

Scope Exact sources and verified result
Retained Demo recovery Core 45fd3e2cf39161d48e185af23b5f0683ae74c367, Demo 01e98f389b08a58579b8af80c663ddc2045ce7a3; 38545162417, attempt 1: Docker 115789291286 and Podman 115789291681 SUCCESS. Both ZIP SHA256/source bindings and all 15 consumer assertion booleans verified. Exact SQL snapshot and original file replace newer writes; original App/deployment identity, secret, authored source, S3, logs, shared isolation and cleanup verified.
Installation destruction Same Core45fd; 38545001466, attempt 1: Docker 115788755727, Podman 115788756200 SUCCESS. Both ZIP SHA256 and source.txt verified. Actual in-use-volume failure preserves foreign holder and protected retry owner; fresh confirmed retry completes after fixture-owned holder release. This native fixture has one child.
Fresh owner recovery Core 93a376023b58f015f9d56fc69146eb34a2e204f8, Demo 47a34baa71afc3cff006645ab25f5756ba045ab6; 38541975235: both engines SUCCESS, source-bound ZIPs and all 15 assertions verified. Original App identity/secret/source and a new deployment owner are verified after actual full reset and exact fixture-owner loss.
Authenticated Podman joint journey Core 93a376023b58f015f9d56fc69146eb34a2e204f8, Demo a0da5d858339275eb94382d567052a815da17a20, Console 04c3553441f109925f882c141a6da3d3b288a6ba, Connector 3c672d8249772cb44f4e4d75edcdf12ec764e691; 38540793754, job 115774807778, attempt 1: SUCCESS. Authenticated manifest/browser ZIP hashes and exact sources verified; all 16 qualifications and 22 browser steps, remote reactivation, Node revocation and owned cleanup verified.

These differing source matrices are separate bounded proofs. They cannot be combined into final ecosystem acceptance. Original failures, including the own backup/reset wiring mistake, remain in the internal receipts.

Latest completed Docker joint attempt 38545785816 failed on Core45fd/Demo01e98/Console22ed/Connector2727 after successful remote HTTP lifecycle. Its actual fixed diagnostic is SKIPPED/runtime-provider, not an unregistered-deployment-state diagnostic. The old fixture correctly refused it. Browser artifact 11885081810, SHA256 0c51c47f2fecc0f9d58db09dea9811bd7122819683d02f9a3003fc066be094f3, was downloaded and verified. Its process-cleanup success does not qualify the failed Core cleanup or whole journey.

Final acceptance still required

The affected retained Demo recovery rerun with the completed-initializer observer is now independently verified on both engines: Core 5ec1b38df90b290dc40fb6f26f18534cf19f0337, Demo d691f68307cbcb8333cdd33aa1af1a92ab41a69e, 38557521398, attempt 1. Both downloaded ZIP hashes/source bindings, all 15 consumer assertions, three native topology snapshots and cleanup pass. The broker/executor dependencies are actually present; this run establishes no Caddy defect. This source pair is separate from the provisional authenticated joint matrix above.

Managed Identity observer retry38556997835 passes retained S3 objects and original collector/Tempo trace data on both engines but fails return-to-shared user setup and installation cleanup. Session 1 corrects the fixture to reuse the original user/session. Cleanup correction a09185ca48f37a4c0bb5a1bb0dea5474e74aa50a passes all nine local checks on exact tree 0230112566dff5f3b2bc1395ea79ba1b2fa7d869: the aggregate now hashes canonical child authority without rehashing displayed certificate countdowns. The regression fails before and passes after; actual owner/material or resource changes still require renewed consent. The integrated native retry on 40bfa96268a57ca74853f22ba6f949ffd7ff057d, 38559693713, now passes both engines with actual Shared → Application → Shared transitions, original user/session refresh and zero-container cleanup; both ZIPs are hash/source verified. The affected installation requalification on 4e0c66344af29f67990c77d6d623dddef1582497, 38560008601, also passes both engines with source-bound downloaded receipts: real in-use-volume failure preserves the foreign holder and retry owner, then a freshly confirmed retry verifies owned native data/configuration/owner absence. This installation fixture has one child. Earlier failed receipts remain in the internal evidence; the final common multi-child authenticated matrix remains required.

The sole required gate inventory remains scripts/release-requirements.json:

Family Required gates Final matrix status
atomic 41 Pending final source qualification
adoption 4 Pending final source qualification
ha 8 Pending final source qualification
journey 2 Pending final source qualification
integration 10 Pending final source qualification

Session 1's OIDC source e53349729c58a8c9d3cf33cc67b9f3b503c5a3c4 is integrated. Its native run 38549744124 fails on both engines at final consumer withdrawal: fixture admission reports identity requirements need services.identity enabled (Docker 115804515884, Podman 115804516219). Earlier source/destination JWT/JWKS assertions complete, but the final foreign issuer-after-withdrawal assertion is not reached. Both jobs verify producer cleanup. The fixture-only correction 553d1dfafadfd0c8dbd2aeec81673f19842cbfe4 is integrated; native retry 38550489196 passes on both engines. Both ZIP hashes, exact commit/tree and complete token/JWKS/cleanup assertions are independently verified. This is bounded service- account proof, not browser-session or whole-provider acceptance. Session 1 owns that fixture correction and the still-open full provider package. Restore integrates the original-manifest OIDC hook and private selected-material revision, including fresh material without an applied binding. Its eight source cases fail before the real caller is wired and pass afterward; changed issuer/reference, client, credential or valid CA bundle invalidates old consent without delivery/registry mutation or confidential output. The initial CA test accidentally used identical httptest default certificates; the corrected fixture changes the actual bundle. These local tests are not native OIDC recovery/token/session acceptance.

Integrate Session 1's complete all-provider/material/authentication handoff and actual token/JWKS consumer proof before final freeze. Then reconcile exact consumer pins and verify affected required gates through the existing evidence verifier. No historical success is automatically reused, no unknown result is converted to success, and the complete pre-release orchestrator stays unstarted.

Both strict EN/DE candidate builds, documentation architecture audit, Pages workflow actionlint and rendered home → release index → v0.4.25 navigation have passed for the scoped documentation update. Actual production Pages deployment and final complete pre-release approval are later, separately authorized steps.

Independent review on Core802 found three reproducible failures: changing or removing the selected credential file, or changing the valid CA bundle after Bind still let Verify succeed. Session 1 corrected these on 500c58f2f35befe2c1672c196c1e99ad64ad7842; the review cases now pass. Its native OIDC run 38553470305 passes on both engines with downloaded ZIP hashes and exact source/tree verified. The same run's Core-less jobs fail despite successful RabbitMQ and MongoDB lifecycle subsets. Managed Identity retry 38554306181 on 9865590e21d4f95d16323ad4a224bdde9d18c2e5 also fails on both engines after its first shared-placement OAuth/PKCE/JWT/refresh assertions pass. Session 1's completed-init observer correction is published as 5ec1b38df90b290dc40fb6f26f18534cf19f0337; its native follow-up 38556997835 has completed with the bounded standalone successes and managed Identity failures described above. No Caddy defect is established.

Further route review produced b547956296d51f5d571986baa170cd876b6a21f3, exact tree 20dd25a5e1a3d86105a66325a3b09751b0c8ac13. All nine isolated local checks pass, including races in CLI, application, Identity and protected material reads. Ten route-drift cases, two issuer-environment cases and three discovery-snapshot cases pass; a fresh read-only driver and distinct endpoint hosts remain valid. The native affected OIDC follow-up is 38556636146; both native jobs pass. Downloaded ZIP hashes, exact source/tree, actual consumer assertions and owned producer cleanup are independently verified. The source receipt is docs/internal/v0.4.25-oidc-route-verification-evidence.json. Current CLI/stdio compatibility with Demo697 passes all five static suites. None of these local checks replaces native browser/session/remote handoff or the final common matrix.