[IMP] Public runtime 1.7.0 startup and governed-memory hardening #7

Closed

moeardent wants to merge 0 commits from quality/public-runtime-1.7.0-hardening-20260727 into integration

moeardent commented

2026-10-09 01:25:24 +00:00

Owner

Summary

Change class: release hardening / public runtime uplift
Promotion target: integration, then exact-commit main promotion and 1.7.0 tag
Trace ref: PLAT-62
Verification refs: specs/public-runtime-parity-20260724/validation-result.md; Qodana Python bQy0lK

Scope

Included

boot-aware asynchronous memory readiness and configurable public branding
bounded foreground probes and capability-gated --no-alt-screen behavior
governed PostgreSQL recall by default; explicit degraded native-memory recovery
clean-room installer integrity/capability checks and regression coverage
Qodana cleanup for the merged parity base

Out of scope

private workstation identities, tenant configuration, credentials, and private runtime state

Verification Evidence

make test: passed
make ci-validate: passed on f140703
make ci-build-mcps: passed; production audits zero vulnerabilities
clean-room installer and PTY behavior: passed
changed-module line coverage: 92%
Qodana Ultimate: Python and all 15 JS scopes, zero findings
16 checksummed CycloneDX SBOMs generated
public safety scan and git diff check: passed
independent Claude Opus 5 implementation review: ACCEPT, no blockers after remediation

Documentation and QMS Impact

README, install, memory, CI, changelog, and controlled public-parity spec updated
no visual product surface; existing no-impact disposition applies
no schema migration or private controlled-document body is included

Reviewer Focus

wrapper argument forwarding and bounded process behavior
memory source-policy enforcement and degraded provenance
installer capability cache and executable integrity

Promotion and Recovery

after approval: merge to integration, verify CI, promote exact commit to main, tag 1.7.0
rollback: revert the single hardening commit or reinstall 1.6.3

Identity and Traceability

Human sponsor: Cristian Lorand cristian@moebiusol.eu
Executing agent: Moe Ardent moe.lorand.bot@moebiusol.eu
Installation: cca69378-c202-4b08-9cfd-c99cef29779a (moe-worklap1)

Closure Checklist

scope is described and bounded
verification evidence is attached or linked
docs and QMS impact is stated
reviewer focus areas are called out
promotion target is explicit
rollback or recovery path is stated

## Summary - Change class: release hardening / public runtime uplift - Promotion target: integration, then exact-commit main promotion and 1.7.0 tag - Trace ref: PLAT-62 - Verification refs: specs/public-runtime-parity-20260724/validation-result.md; Qodana Python bQy0lK ## Scope ### Included - boot-aware asynchronous memory readiness and configurable public branding - bounded foreground probes and capability-gated --no-alt-screen behavior - governed PostgreSQL recall by default; explicit degraded native-memory recovery - clean-room installer integrity/capability checks and regression coverage - Qodana cleanup for the merged parity base ### Out of scope - private workstation identities, tenant configuration, credentials, and private runtime state ## Verification Evidence - make test: passed - make ci-validate: passed on f140703 - make ci-build-mcps: passed; production audits zero vulnerabilities - clean-room installer and PTY behavior: passed - changed-module line coverage: 92% - Qodana Ultimate: Python and all 15 JS scopes, zero findings - 16 checksummed CycloneDX SBOMs generated - public safety scan and git diff check: passed - independent Claude Opus 5 implementation review: ACCEPT, no blockers after remediation ## Documentation and QMS Impact - README, install, memory, CI, changelog, and controlled public-parity spec updated - no visual product surface; existing no-impact disposition applies - no schema migration or private controlled-document body is included ## Reviewer Focus - wrapper argument forwarding and bounded process behavior - memory source-policy enforcement and degraded provenance - installer capability cache and executable integrity ## Promotion and Recovery - after approval: merge to integration, verify CI, promote exact commit to main, tag 1.7.0 - rollback: revert the single hardening commit or reinstall 1.6.3 ## Identity and Traceability - Human sponsor: Cristian Lorand <cristian@moebiusol.eu> - Executing agent: Moe Ardent <moe.lorand.bot@moebiusol.eu> - Installation: cca69378-c202-4b08-9cfd-c99cef29779a (moe-worklap1) ## Closure Checklist - [x] scope is described and bounded - [x] verification evidence is attached or linked - [x] docs and QMS impact is stated - [x] reviewer focus areas are called out - [x] promotion target is explicit - [x] rollback or recovery path is stated