[DRAFT] Public runtime parity with governed workstation #8

Closed

moeardent wants to merge 0 commits from quality/public-runtime-parity-20260724 into integration

moeardent commented

2026-10-09 01:25:24 +00:00

Owner

Summary

Change class: governed public-runtime parity uplift
Promotion target: draft review into integration; no merge/tag/release authorized
Trace ref: specs/public-runtime-parity-20260724/
Evidence: artifacts/gates/7a666fdb6716e576/evidence.json, artifacts/gates/a67ef8bd246737c5/evidence.json

Scope

Included: portable atomic memory promotion, evidence/lifecycle validators, capability-aware model routing and handoff, resumable Gemini Deep Research, locked Python MCP installation, production dependency auditing/SBOMs, and hardened governance/gate-review execution.

Out of scope: tenant configuration, credentials, customer/project material, private YouTrack workflows, live Moebiusol infrastructure state, merge, tag, publication, and release.

Verification Evidence

make test: passed
make public-scan: passed
make ci-build-mcps: passed, including installed Gemini protocol smoke, Python SCA, Node production audits/builds
make sbom: 16 CycloneDX 1.5 documents plus checksums
make ci-validate: passed
live PostgreSQL atomicity: passed
independent adversarial source review: APPROVED, no blocking findings
remaining required review check: TeamCity Qodana

Documentation and QMS Impact

Docs, capability descriptions, install/CI guidance, model-routing guidance, controlled spec, verification record, source map, and gate evidence are included. The repository integration/main topology remains drift from the QMS dev/test/main standard and requires disposition before promotion or release.

Reviewer Focus

public/private boundary and absence of tenant leakage
exact-target destructive authorization and wrapper/context bypass resistance
gate-review fallback provenance, strict schema, model separation, and process cleanup
atomic native-memory promotion and rollback semantics
locked MCP dependency and SBOM integrity

Promotion and Recovery

After review and CI, resolve branch-model disposition and obtain separate human authorization before any merge to main or tag. Recovery is branch deletion/revert before release; no live environment was changed.

Identity and Traceability

Human sponsor principal: 45a33291-8c6a-4e07-bdd5-131c8d44c38d (Cristian Cotosman)
Executing agent: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Commit: 640add961506ec4c5102539628e1477762f6bf18

Closure Checklist

scope is described and bounded
verification evidence is linked
docs and QMS impact is stated
reviewer focus areas are called out
promotion target is explicit
rollback/recovery shape is stated

## Summary - Change class: governed public-runtime parity uplift - Promotion target: draft review into `integration`; no merge/tag/release authorized - Trace ref: `specs/public-runtime-parity-20260724/` - Evidence: `artifacts/gates/7a666fdb6716e576/evidence.json`, `artifacts/gates/a67ef8bd246737c5/evidence.json` ## Scope Included: portable atomic memory promotion, evidence/lifecycle validators, capability-aware model routing and handoff, resumable Gemini Deep Research, locked Python MCP installation, production dependency auditing/SBOMs, and hardened governance/gate-review execution. Out of scope: tenant configuration, credentials, customer/project material, private YouTrack workflows, live Moebiusol infrastructure state, merge, tag, publication, and release. ## Verification Evidence - `make test`: passed - `make public-scan`: passed - `make ci-build-mcps`: passed, including installed Gemini protocol smoke, Python SCA, Node production audits/builds - `make sbom`: 16 CycloneDX 1.5 documents plus checksums - `make ci-validate`: passed - live PostgreSQL atomicity: passed - independent adversarial source review: APPROVED, no blocking findings - remaining required review check: TeamCity Qodana ## Documentation and QMS Impact Docs, capability descriptions, install/CI guidance, model-routing guidance, controlled spec, verification record, source map, and gate evidence are included. The repository `integration`/`main` topology remains drift from the QMS `dev`/`test`/`main` standard and requires disposition before promotion or release. ## Reviewer Focus - public/private boundary and absence of tenant leakage - exact-target destructive authorization and wrapper/context bypass resistance - gate-review fallback provenance, strict schema, model separation, and process cleanup - atomic native-memory promotion and rollback semantics - locked MCP dependency and SBOM integrity ## Promotion and Recovery After review and CI, resolve branch-model disposition and obtain separate human authorization before any merge to `main` or tag. Recovery is branch deletion/revert before release; no live environment was changed. ## Identity and Traceability - Human sponsor principal: `45a33291-8c6a-4e07-bdd5-131c8d44c38d` (Cristian Cotosman) - Executing agent: `Moe Ardent <moe.lorand.bot@moebiusol.eu>` - Commit: `640add961506ec4c5102539628e1477762f6bf18` ## Closure Checklist - [x] scope is described and bounded - [x] verification evidence is linked - [x] docs and QMS impact is stated - [x] reviewer focus areas are called out - [x] promotion target is explicit - [x] rollback/recovery shape is stated

moeardent closed this pull request

2026-10-09 01:25:25 +00:00

moeardent commented

2026-10-09 02:28:08 +00:00

Author

Owner

Migrated Codeberg review

Reviewer: cristianlorand
State: APPROVED
Submitted: 2026-07-24T13:43:52+02:00
Commit: 1b4f75d44abf442705130206ffff83b03294fe73

good

### Migrated Codeberg review - Reviewer: `cristianlorand` - State: `APPROVED` - Submitted: `2026-07-24T13:43:52+02:00` - Commit: `1b4f75d44abf442705130206ffff83b03294fe73` good