moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

PLAT-162 run mandatory CMS runtime tests in prepared UID33 executor #78

Open
moeardent wants to merge 246 commits from fix/OCV-246-cms-runtime-test-harness into dev
pull from: fix/OCV-246-cms-runtime-test-harness
merge into: moebiusol:dev
Conversation 1 Commits 246 Files changed 296 +60662 -455
moeardent commented 2026-11-11 07:18:58 +00:00
Owner
Copy link

The existing CMS runtime job always invokes its mandatory mount regression through unshare, which the isolated executor rejects. This change adds a generic prepared executor capability to the existing caller: the Docker daemon provisions dedicated UID33 nosuid,nodev tmpfs mounts, a fixed identity-only setpriv preamble drops all capabilities and supplementary groups, and the runner verifies actual UID/GID, capability sets, NNP, seccomp, root protection and the live fixture mount before reading branch source. The full runtime suite forwards the observed mount path/ID to the existing mandatory prepared regression. The default namespace route remains the default; no test is skipped and no job is added.

PLAT-162, OCV-268, OCV-246.

The same source also corrects supplier memory observation for the actual daemon-bound Kubernetes cgroupfs-v2 ancestry. It checks every pod-bound ancestor and retains the original11GiB ancestor /22GiB node thresholds and /docker compatibility. Commit and artifact digests record traceability/integrity; no permanent source revision allowlist or cross-repository hash compatibility gate is introduced.

Current candidate896249fd4e90b3e9b4438d6e478f2b5f6592cef4 contains the independently reviewed memory helper correction(c49d8a5d,125 source checks passing), existing caller wiring(53ac9168), and effective-profile static guard correction(896249fd,26 focused checks plus the complete source guard passing). The source guard permits only the fixed three startup identity capabilities in prepared mode; it retains privilege/credential/socket prohibitions and requires the effective identity/capability/mount proof before source input. Mutation checks reject expanded/dynamic capabilities, absent drops, moved proof and fake mount identity. Current native supplier53ac remains unchanged because the new commit touches only the source guard and tests. One original inspect watchdog test exceeded9seconds on its first run; its isolated recheck and all22 full-suite source tests then passed. The source archive allowlist includes the seven required files from the product-owner account-retry changes.

Actual prepared fixture execution passed on retained intermediate PHP8.4.27 recovery bytes: UID/GID33, no supplementary groups, all five capability sets zero, read-only root, NNP, active seccomp filter, dedicated nosuid,nodev tmpfs, four positively controlled remote TCP denials, route activation/rollback/concurrency/hostile paths and owned-container cleanup. This proves the executor precheck only. Final supplier PHP native/runtime/interface qualification, paired-image security/SBOM, immutable publication/readback, normal MEDCMS_RUNTIME_TEST_IMAGE binding and the full prepared runtime suite on the final qualified image remain required.

Prior PR77/a33a6dab remains intact. Four inherited product-owner commits after that snapshot cover protected Qodana credential setup, account-demographic retry fencing, its PostgreSQL proof and the prepared mount interface. Those changes and inherited PR77 history retain their own review/normal CI obligations; platform helper reviews do not approve them. No merge, deployment, production action or release approval is claimed. Evidence: moe-workload/artifacts/verification/PLAT-107-cms-normal-custody-recovery-20261110/cms-pr235-chain-acceptance/plat162-runtime-qualification-v2/.

Candidate targetdev only. Revert through the same review path for recovery; existing deployed images remain governed by their normal controls.

The existing CMS runtime job always invokes its mandatory mount regression through unshare, which the isolated executor rejects. This change adds a generic prepared executor capability to the existing caller: the Docker daemon provisions dedicated UID33 nosuid,nodev tmpfs mounts, a fixed identity-only setpriv preamble drops all capabilities and supplementary groups, and the runner verifies actual UID/GID, capability sets, NNP, seccomp, root protection and the live fixture mount before reading branch source. The full runtime suite forwards the observed mount path/ID to the existing mandatory prepared regression. The default namespace route remains the default; no test is skipped and no job is added. [PLAT-162](https://moebiusol.youtrack.cloud/issue/PLAT-162), [OCV-268](https://moebiusol.youtrack.cloud/issue/OCV-268), [OCV-246](https://moebiusol.youtrack.cloud/issue/OCV-246). The same source also corrects supplier memory observation for the actual daemon-bound Kubernetes cgroupfs-v2 ancestry. It checks every pod-bound ancestor and retains the original11GiB ancestor /22GiB node thresholds and /docker compatibility. Commit and artifact digests record traceability/integrity; no permanent source revision allowlist or cross-repository hash compatibility gate is introduced. Current candidate896249fd4e90b3e9b4438d6e478f2b5f6592cef4 contains the independently reviewed memory helper correction(c49d8a5d,125 source checks passing), existing caller wiring(53ac9168), and effective-profile static guard correction(896249fd,26 focused checks plus the complete source guard passing). The source guard permits only the fixed three startup identity capabilities in prepared mode; it retains privilege/credential/socket prohibitions and requires the effective identity/capability/mount proof before source input. Mutation checks reject expanded/dynamic capabilities, absent drops, moved proof and fake mount identity. Current native supplier53ac remains unchanged because the new commit touches only the source guard and tests. One original inspect watchdog test exceeded9seconds on its first run; its isolated recheck and all22 full-suite source tests then passed. The source archive allowlist includes the seven required files from the product-owner account-retry changes. Actual prepared fixture execution passed on retained intermediate PHP8.4.27 recovery bytes: UID/GID33, no supplementary groups, all five capability sets zero, read-only root, NNP, active seccomp filter, dedicated nosuid,nodev tmpfs, four positively controlled remote TCP denials, route activation/rollback/concurrency/hostile paths and owned-container cleanup. This proves the executor precheck only. Final supplier PHP native/runtime/interface qualification, paired-image security/SBOM, immutable publication/readback, normal MEDCMS_RUNTIME_TEST_IMAGE binding and the full prepared runtime suite on the final qualified image remain required. Prior PR77/a33a6dab remains intact. Four inherited product-owner commits after that snapshot cover protected Qodana credential setup, account-demographic retry fencing, its PostgreSQL proof and the prepared mount interface. Those changes and inherited PR77 history retain their own review/normal CI obligations; platform helper reviews do not approve them. No merge, deployment, production action or release approval is claimed. Evidence: moe-workload/artifacts/verification/PLAT-107-cms-normal-custody-recovery-20261110/cms-pr235-chain-acceptance/plat162-runtime-qualification-v2/. Candidate targetdev only. Revert through the same review path for recovery; existing deployed images remain governed by their normal controls.
[FIX] OCV-246 restore CMS authenticated semantic runtime contract
Some checks are pending
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch is running
Details
7b4845195f 
- Recover the accepted fixed-tenant six-field endpoint and complete semantic capability inventory.
- Bake explicit original product coordinates and activate the image-owned route safely inside the PVC.
- Preserve current CI and require PHP, actual-rule and UID33 mount regression tests; remote evidence remains pending.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Verification-Ref: source re-review complete; shell syntax, 3 Apache static checks and image boundary passed; exact-head remote PHP/mount/Apache evidence pending
Risk-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Release-Ref: DEV/TEST candidate only; no deployment or production authorization
Exception-Ref: None
[SEC] OCV-229 validate contact return URL origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
527d082c2a 
Require exact HTTP(S) scheme, host and effective port for absolute returns; retain safe root-relative paths and form anchor. Reject ambiguous and cross-origin values to the routed fallback. Add production-method and POST regression checks to validation CI.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 admit work refs for source validation only
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
96137e0587 
Repair native source-contract rejection of configured feature/fix/quality validation branches. Keep Build, Security and Promote restricted to protected routes and retain exact producer source/stage parity. Add fail-closed coverage for malformed refs, nondefault identity and producer-chain isolation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 derive DEV destinations for verified source validation
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
bf23196be3 
Keep work-ref provenance intact while mapping only verified Validate route contexts to DEV compatibility destinations. Leave protected artifact/deployment routing unchanged. Exercise real native verification, checkout identity, launcher and dispatcher together with fail-closed integration tests.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 clear Qodana findings in redirect harness
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
34807ad3bf 
Make Joomla test doubles consume their parameters, use local imports and explicit exception reporting, and apply readonly/constant style without changing production redirect behavior. Record build 21814 findings and required exact-head revalidation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 mark immutable contact test double readonly
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
675bd46d4c 
Resolve the sole Qodana finding on exact-head CMS Validate build 21820 without changing production redirect behavior or test cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 avoid redundant readonly modifier
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/sbom-source TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/grype-source TeamCity OculusVitaCMS_Validate failed with exit 2
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
03d4280e74 
Qodana found one redundant property modifier after the test double became a readonly class. Remove only that modifier; all 30 redirect cases and 95 CI unit tests remain green.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-206 scope CMS source SBOM to product checkout
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
ea99fbb099 
Exclude generated scanner and report trees from Syft source inventory, reject contaminated or unattributed package records, and leave image scanning plus the fail-on-low Grype gate unchanged. TeamCity 21827 proved the prior source SBOM contained only Syft/Qodana tool binaries.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 narrow CMS SBOM exclusions to generated CI files
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
f0c35a11e7 
Retain any product package material elsewhere under artifacts, and mark exact-head integration evidence pending until TeamCity verifies the Syft and Grype results. Independent review found this scope risk before merge.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to source validation
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
c17741a381 
Allow feature, fix and quality refs only through Validate source actions while preserving native ref and SHA provenance. Keep image, security and promotion routing protected; cover dispatcher and native boundary regression cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to TeamCity Validate filter
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
86041aa95f 
Widen only non-release source Validate VCS filtering to standard review refs. Preserve protected image, security and promotion filters. Record failed exact-head attempts as non-scanner evidence.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-246 replace CMS route entries safely
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
2829b2c23b 
Use no-follow moves for handler activation and PVC rollback so a symlink-to-directory cannot redirect staged entries.

Add an injected activation-failure regression that checks the prior symlink and PVC route configuration are restored.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: shell syntax, Apache static checks (3/3), image boundary and diff checks passed; PHP-backed route sync test unavailable locally (PHP CLI missing); exact-head TeamCity revalidation pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: DEV/TEST candidate only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 validate CMS runtime contract on review branches
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d558e1910 
Keep delivery provenance closed to dev/test/main while running the exact PHP runtime suite in the existing non-release Qodana branch lane.

The branch lane remains verification-only and does not build, publish, or promote images.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP runtime suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 isolate branch runtime checks from TeamCity secrets
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02544ab56f 
Run PHP route tests in a minimal environment so source-under-review does not inherit unrelated project credentials.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; remote runtime test pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 require PHP CLI for CMS runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
49cfe047b5 
Do not treat Docker presence as satisfying a PHP CLI dependency; install or fail clearly before executing the required runtime suite.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provision PHPUnit for runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
04f9d28872 
Install or require PHPUnit alongside PHP CLI before running the fail-closed runtime contract suite on branch and stable validation lanes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provide PHP 8.4 in CMS validation lane
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
56685f430f 
Install the required PHP 8.4 CLI when the TeamCity agent has no qualifying interpreter; Docker presence is not a PHP CLI substitute.

The PHP 8.4 Ubuntu setup follows PHP installation guidance; only CLI SAPI is used by validation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 fail closed without approved PHP test image
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
4c922d5ae0 
Remove the unapproved third-party PHP package source and package installation from shared TeamCity validation. Require PHP 8.4+ CLI and PHPUnit from an approved, digest-pinned test image; retain the branch-only runtime suite and do not widen native delivery routes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [moebiusol/oculus-vita-cms#59]
Verification-Ref: branch-lane/static checks and shell syntax, Apache route tests, image boundary checks, and diff checks pass; PHP runtime suite not run due missing approved PHP 8.4/PHPUnit image
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 consume complete CMS route guard input
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
d6333a5b1b 
Accept valid runtime routing even when trailing Apache configuration causes an early grep exit to send SIGPIPE to sed under pipefail. Consume the full normalized file while preserving the exact required stable-handler rule and wrong-target rejection.

Three actual-script fixtures cover repository rules, a 520 KB configuration tail and fail-closed wrong-handler rejection. PHP metadata validation is stubbed only in these shell fixtures; approved PHP, Apache, mount and exact-image CI qualification remain required.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: #59
Verification-Ref: 3 shell guard fixtures, 3 Apache static tests, image-boundary, bash syntax and diff checks passed
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no merge or deployment
Checkpoint source-only harness work before CMS security convergence. Existing branch/stable lanes and complete runtime suite retained. Official PHPUnit producer signatures and signed artifact metadata replace release-hash pins; no CI secrets or self-granted mount privileges enter the container. Verification: 17 offline lifecycle/provenance cases, branch contract, three route guards, three Apache static checks, shell syntax and independent technical source review pass. Actual image build, PHAR signature execution, SBOM/scan, qualified image binding and authorized mount executor remain unverified; no official approval, deployment or runtime completion claim. YouTrack: OCV-206, OCV-246
Integrate exact OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] source candidate 03d4280e74 from #61 while preserving the OCV-246 runtime endpoint and local harness checkpoint. Feature integration only; no approval, push or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Integrate exact OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] candidate 86041aa95f from #62. Resolve shared test conflicts by retaining both work-ref scenarios and unioning every input/refusal oracle. Preserve Grype policy and OCV-229 redirect repair; feature integration is not approval or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Preserve OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] exact-origin repair and all30 redirect checks, OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] product source-SBOM scope, and all15 OCV-246 runtime PHPUnit methods. Replace only the newly merged redirect host-PHP/mutable-image fallback with the existing immutable isolated harness; explicit12-file closure and regression/static checks preserve mandatory execution and credential isolation.

Source verification:128 Python CI tests PASS; focused41 included, harness17 included; Apache route static3 PASS; branch-lane, CI governance, quality-gate, image boundary, Bash syntax and diff checks PASS. Actual PHP/image/mount/security server qualification and independent exact-head review pending. No push, protected merge, deployment or approval.

YouTrack: OCV-229, OCV-206, OCV-246
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] bind runtime metadata validation to bounded opened handle
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
c9ff4073ae 
Repair the independently confirmed local pathname-check/open race: require matching regular-file device/inode on one opened handle, validate its size, bound the actual read and close in finally. Preserve fixed production path, bearer authorization, no-store and six-field semantic contract. Add deterministic actual endpoint regressions backed by real file replacement/growth plus byte boundaries; all15 prior PHPUnit methods retained.

OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] security convergence under OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]. Source checks: Apache static3 PASS, image boundary PASS, diff check PASS. PHP absent locally:17 source methods pending actual server execution and independent exact-head review. Local path ownership/exploitability unverified; no unauthenticated remote exploit or atomic concurrent same-inode rewrite guarantee claimed. No push/deployment/approval.

YouTrack: OCV-246, OCV-229, OCV-206
Retain the original 36 checks and add the actual renamed mixed-case object path. Independently reviewed driver passed 37 server browser checks on the updated diagnostic image; no deployed-edge, image-security or release approval is implied.

YouTrack: OCV-206, OCV-268
docs(OCV-268): preserve debugger and account boundaries
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce3552fc17
fix(OCV-268): repair Imagick artifact memory ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
045a28f9bf
fix(OCV-268): qualify native PHP resource accounting
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
f8116cdbed
fix(OCV-268): measure shared socket storage in daemon view
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
170586f46e
fix(OCV-268): admit native memory using Linux available capacity
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce982c51b6
fix(OCV-268): bound cold storage retries and preserve Docker ceiling
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c3f0701ebf
fix(OCV-268): size Docker scan within original freshness window
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
2286de4d0a
fix(OCV-268): restore bounded vanished-file counter recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
77098a4581
fix(OCV-269): align Serbian sign-in action with supplied workbook
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1f41f9a865
fix(OCV-206): align CMS Serbian action labels
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
314ed6af7c
fix(OCV-206): validate CMS export token timestamps
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a9c912183a
OCV-206 Apply Joomla text policies to workbench saves
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1365fba138
OCV-206 Reject ambiguous resource link authorities
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
be9a10cd65
OCV-206 Preserve literal CMS login return paths
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13021bdb32
OCV-206 Enforce CMS account resource ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
25ceec04c4
OCV-246 Reject invalid SSO token dates
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3fc9e979da
OCV-246 Enforce vetting for explicit HCP groups
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
98e5f89450
OCV-246 Require boolean SSO privilege claims
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
784347c58e
OCV-246 Save published article revisions atomically
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
86ffb915d2
OCV-246 make editorial transitions atomic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
67646bf6de
fix(OCV-246): validate explicit SSO authorized party
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a558193aa5
fix(OCV-246): restrict ID token audience to configured client
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
598f6e86b0
fix(OCV-269): apply supplied Serbian configurable footer text
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13857a31e3
fix(OCV-246): confine CMS status publishing to Forgejo
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
5ab736b266
fix(OCV-269): restore account navigation Serbian diacritic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
d147361a62
fix(OCV-246): render unlinked resource information safely
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
dc04651f58
fix(OCV-246): revalidate substituted article authority
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6a7136c8ae
fix(OCV-246): keep article discovery within publication bounds
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9761a0e90b
fix(OCV-246): derive article media from selected localized item
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
21075478a7
fix(OCV-246): retain intro hero when full article image is empty
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e3ee56d77d
fix(OCV-246): bind export JWT key fetches to configured origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80a492cc41
fix(OCV-246): preserve UTC SQL instants in content export
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c6b3d88e2f
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Fix CMS immutable account binding
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80395ee95c
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Synchronize category publication through CMS export journal
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a8e73a4fba 
Require published categories and ancestors, journal descendant article changes, and restore eligible unchanged content through incremental exports. Resolve stale publication and context events without broad deactivation.

Verified local PHP 8.5 fixture: 1734 checks; independent source review PASS. PHP 8.4 and integrated runtime qualification remain separate.

Affected: OCV-206
Validate actual upload size and raster type, and enforce self-contained sanitized SVG references with the locked real supplier. Retain safe fragments, CSS, and verified inline raster images, including a narrow supplier WebP extension.

Local PHP 8.5 actual multipart verification: 95 cases and 329 assertions passed; independent replay passed. Normal PHP 8.4/Apache CI qualification remains pending.

Affected: OCV-246

Affected: OCV-206
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] complete runtime test source consumption
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e7f54a8ae1 
Preserve the normal isolated runtime runner and require all current media and export suites with actual assertions.

YouTrack: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268], OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Export complete CMS collections from one PostgreSQL snapshot
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
7da1d14837
OCV-246 Bound CMS export memory within the existing product runtime
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0727135f78
OCV-268 Preserve bounded native failure diagnostics without raw environment reproducers
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ed42b3a225
fix(OCV-268): separate retained SDK and runtime phase provenance
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
2029aa2d97
fix(OCV-268): verify retained SDK inputs for phase recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
90ccffd369
fix(OCV-268): prepare retained SDK environment recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d8768868d
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Use authenticated recovery build dependencies
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02c21275dc 
Preserve both hash-bound PHP and Imagick source declarations, refresh signed indexes through the existing qualified build APT context, and avoid the inherited global PHP deny pin. Focused source contracts: 32 PASS; actual read-only policy control confirms the causal pin. Constructor, native runtime and product acceptance remain pending.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Restore declared recovery SDK dependency closure
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
42de54b10e 
Reuse the existing authenticated compiler backport declaration before the unchanged offline SDK install. Preserve signed-index refresh, full PHP and Imagick dependency declarations, all 19 original SDK payloads and the source lock. All 35 affected source checks pass; complete read-only APT simulation resolves the SDK plus all eight declared backports. Constructor and native runtime qualification remain pending.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Retain bounded supplier timeout diagnostics
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0dfbb15855 
Preserve partial captured stdout and stderr in the same existing log when a supplier command reaches its unchanged deadline, then re-raise the same timeout. Never serialize command arguments or the environment. Normal output and failure contracts are unchanged. All 40 affected source checks pass. The PHP/Imagick dependency timeout cause and SDK/native qualification remain unresolved.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
Measure same-agent mounts over one existing exec; preserve original timestamps, per-member timeout retry and strict failure admission. Bound private DU streams and retain category/digest receipts. 39 focused observer/recovery tests passed; actual observer qualification and SDK image construction remain pending.

YouTrack: https://moebiusol.youtrack.cloud/issue/OCV-246

Refs: https://moebiusol.youtrack.cloud/issue/OCV-206 https://moebiusol.youtrack.cloud/issue/OCV-268
OCV-268: record bounded recovery observer qualification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
4956be7dd5 
Record 39 focused passes and eight actual observation/publication cycles at source0380f578. Preserve unknown historical transport cause and pending image/native qualification; no runtime or clinical approval.

YouTrack: https://moebiusol.youtrack.cloud/issue/OCV-268

Refs: https://moebiusol.youtrack.cloud/issue/OCV-206 https://moebiusol.youtrack.cloud/issue/OCV-246
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] retain fresh supplier observations through bounded metadata recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9cd96c437d 
Use exact private Docker configuration and proven terminal read-only helpers. Permit only one headroom-qualified whole observation retry, revalidate original and replacement rows before atomic handoff, preserve all identity/freshness/capacity bounds. Independent path review clear; 56 offline tests pass; no native or live qualification claim.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound Docker-root observation retries to one remote helper
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
62dd8b3743 
Keep two maximum 8s scans inside the existing 20s aggregate ceiling, require proven child-group quiescence and complete strict measurements, and make uncertain transport fatal without a fresh exec. Preserve original timestamps, 30s freshness and all storage/identity controls. Independent source review clear; 66 offline focused and actual-consumer tests passed in 46.498s. Live qualification pending; no image or native qualification claim.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound recovery APT acquisition retry inside existing deadline
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
da1ce68ca5 
Use one standard APT failed-file retry only in recovery dependency invocations after the authenticated libltdl-dev HTTPS broken-pipe failure. Keep each original 900s subprocess budget, signed indexes, expiry, full PHP/Imagick declarations, eight locked backports and fail-closed SDK boundary. No global APT or normal bootstrap change. Independent technical source review clear; 17 focused recovery tests passed. Image and native qualification remain pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound complete recovery dependencies by natural source phases
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6e4bfb46e1 
Install the complete authenticated Imagick then PHP build-dependency declarations, preserving signed context, no-remove, eight declared backports and each 900s operation. Verify both installed declarations and all dependency/conflict variants with dpkg-checkbuilddeps before unchanged SDK installation. The external whole-build 3600s budget remains unchanged; no unsafe I/O, source-lock, SDK-byte or capability change. Independent technical source review clear and 22 focused checks passed, including the real Debian checker against isolated installed state. Image/native qualification remains pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] join independent supplier closing reads concurrently
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0ce3784026 
After all physical and optional memory measurements, concurrently fetch the independent kubelet summary, Pod-after and daemon-after metadata. Join every bounded outcome before composition or propagation, preserve exact source timestamps/identities and all storage/freshness controls, and never hide a fatal sibling behind a retryable timeout. No persistent transport, shared platform or deadline change. Independent technical review clear; 52 observer unit tests passed, including causal barrier/failed/cancelled sibling tests and unchanged actual process-lifetime bounds. Live transport and image/native qualification remain pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 record reviewed recovery composition verification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9cd262cb84
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] verify email before domain-derived publisher grant
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
195c7fea71 
Restrict only the email-domain authorization shortcut; preserve bound-user login and explicit trusted role/group grants. Add seven signed callback regressions. Independent technical source review clear; execution and official source approval remain pending.

YouTrack: OCV-246, OCV-206
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] record causal publisher regression verification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0af723c27f 
Retain 4 baseline failures and 3 passing controls, then 113 passing signed callback tests on the explicit Joomla 6.1.0 isolated carrier. Preserve raw-output and dependency-hash limitations; no candidate, official CI, approval or deployed acceptance claim.

YouTrack: OCV-246, OCV-206
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Fix private recovery admission evidence ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
bbc794255c
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Project retained SDK inputs read-only for compiler
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6491bc417e
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Preserve bounded Docker observation exception diagnostics
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1b30ba9a29
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Retain private vanished-region diagnostics and valid interrupted receipts
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c81c42aa2e
OCV-268 repair readline prerequisites and owned supplier cancellation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
55fc611f8f
feat(OCV-197): revalidate CMS SSO sessions across applications
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ca7dada18a 
YouTrack: OCV-197 [https://moebiusol.youtrack.cloud/issue/OCV-197], OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] record current signed-PHP contact guard smoke
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9e119a6927 
YouTrack: OCV-206, OCV-229, OCV-246
fix(OCV-206): allow validated CMS logout during outages
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
b805dd3991
FIX preserve CMS workflow transition concurrency
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 2
Details
9569b02318
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] preserve CMS login return with fragments
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
bedd5b5ea3
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] preserve CMS logout return with fragments
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
bbcd54c0e2
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] validate CMS account input before identity updates
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
495dfbf694
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] report CMS account partial saves accurately
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
26493ea84e
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] require session rotation before SSO login
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
38bdb51dfe
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] align CMS demographics concurrency contract
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
27054552ae
OCV-206 route CMS HCP links to matching environment
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
b92deb0d4e
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] sanitize public export URL credentials
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a33a6dab46 
Block known credential URL patterns in export links and references while preserving public citation compatibility.

YouTrack: OCV-206, OCV-246
[FIX] Admit complete observed nested Docker memory ancestry
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c49d8a5d26 
- Bind supplier leaf to the actual daemon cgroup and pod.
- Preserve complete ancestor checks and 11 GiB / 22 GiB admission.
- Keep existing Docker topology compatibility without revision allowlists.

Trace-Ref: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
Trace-Ref: PLAT-162 [https://moebiusol.youtrack.cloud/issue/PLAT-162]
[FIX] Wire prepared CMS executor through mandatory runtime suite
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
53ac91687f 
- Select prepared capability without changing the default namespace route.
- Verify dropped UID33/groups/caps and actual tmpfs identity before source input.
- Forward observed mount arguments to the existing mandatory test.
- Include inherited account retry test dependencies in the source allowlist.

Trace-Ref: PLAT-162 [https://moebiusol.youtrack.cloud/issue/PLAT-162]
Trace-Ref: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
moeardent changed title from PLAT-162 qualify CMS prepared fixture and actual supplier memory ancestry to PLAT-162 run mandatory CMS runtime tests in prepared UID33 executor 2026-11-11 07:35:45 +00:00
[FIX] Guard the prepared CMS identity drop before source input
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
896249fd4e 
- Permit only the fixed three startup identity capabilities in prepared mode.
- Retain privilege, credential and socket prohibitions and effective isolation checks.
- Reject expanded capabilities, absent drops, moved proof and fake mount identity.

Trace-Ref: PLAT-162 [https://moebiusol.youtrack.cloud/issue/PLAT-162]
Trace-Ref: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
[FIX] OCV-268 Quiesce owned compiler writers for complete storage observations
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a278ba1222
[FIX] OCV-268 Resume exact completed PHP candidate after native report review
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
58637f4840
[FIX] OCV-268 Isolate the inherited Joomla compiler volume
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
295547449c 
Allow only CHOWN or CAP_CHOWN as the transport singleton; compiler caps remain empty. Keep safe typed pre-scan failures through the observer consumer.
Keep the original complete DU and restoration deadlines. Retain allowlisted Docker operation timing on preparation failure.
fix(OCV-268): reserve bounded owned pause and restoration time
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
5e6adbdce7 
Allow realistic Docker pause latency under one finite owner budget; preserve full DU, original non-compiler lifetime and sample freshness.
Keep the same compiler and11Gi cgroup with6Gi private work, immutable SDK/root, native peak checks, and validated live export. Observe complete disk usage without pausing PHP.
fix(OCV-268): allow execution on private compiler scratch mounts
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6340c29dc3 
Require actual executable work and test scratch before invoking the compiler. Keep the bounded inherited web root noexec and preserve all resource controls.
YouTrack: OCV-206, OCV-246
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] align supplier observation fixture with owned timeout
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
25bb07605f
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] Record selected CMS runtime metadata
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e5cbe3b8ec
OCV-206 bind retained CMS supplier to finite observer delivery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
89e562737b
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] checkpoint CMS DEV/TEST delivery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
bb25231273 
Review pending; local source checkpoint only. Not acceptance, independent-review approval, merge, publication, deployment or runtime qualification. No push or native activation.

OCV-269 [https://moebiusol.youtrack.cloud/issue/OCV-269] includes the separately verified Serbian account copy. Exact scope:17 CMS supplier/delivery paths,2 owner-frozen localization paths and1 owner-frozen timeout-fixture path. Preserve unrelated review documents and scratch.

Verification:161 affected runtime/delivery tests PASS13.554s; localization23 PASS; fixture30 PASS and original static consumer30 PASS in separate owner receipts. No whole-branch or actual-image acceptance inferred.

Evidence:oculus_vita-docu/.ci-output/ocv206-cms-native-supplier-bootstrap-20261114/delivery-entry-verification.json; runtime-test-readiness-verification-20261114.json; ocv269-current-ui-gap-corrections-20261114.json.

YouTrack: OCV-206, OCV-269
moeardent commented 2026-11-14 15:16:25 +00:00
Author
Owner
Copy link

Review-pending source checkpoint: bb252312737d6d5c6797596df3c8010c686441f7 (OCV-206, OCV-269). Normal non-force update of this existing review branch; no merge, approval or native activation.

Exact20 frozen paths:17 supplier/delivery source paths,2 Serbian localization paths and1 timeout-fixture path. Focused runtime/delivery161 tests passed13.554s; localization23 and fixture30 passed in separate retained receipts. These are source/mocked-transport checks, not whole-branch CI or actual CMS image/deployment acceptance. Existing automatic Qodana validation is observed through the shared CI reader; no manual duplicate build was triggered.

Different-provider technical source review (and linguistic review where applicable) remains pending. The new protected Validation/DEV/TEST entry and original-DEV artifact reuse are not activated. Existing signing/security/runtime/deployment gates and platform-owner custody/permission prerequisites remain required. This comment is review trace only, never acceptance. Existing Docu evidence: ocv206-cms-native-supplier-bootstrap-20261114/delivery-entry-{verification,native-contract,review-packet}.json, local-checkpoint-bb252312-20261114.json, plus the separately frozen localization/fixture receipts.

Review-pending source checkpoint: `bb252312737d6d5c6797596df3c8010c686441f7` ([OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206), [OCV-269](https://moebiusol.youtrack.cloud/issue/OCV-269)). Normal non-force update of this existing review branch; no merge, approval or native activation. Exact20 frozen paths:17 supplier/delivery source paths,2 Serbian localization paths and1 timeout-fixture path. Focused runtime/delivery161 tests passed13.554s; localization23 and fixture30 passed in separate retained receipts. These are source/mocked-transport checks, not whole-branch CI or actual CMS image/deployment acceptance. Existing automatic Qodana validation is observed through the shared CI reader; no manual duplicate build was triggered. Different-provider technical source review (and linguistic review where applicable) remains pending. The new protected Validation/DEV/TEST entry and original-DEV artifact reuse are not activated. Existing signing/security/runtime/deployment gates and platform-owner custody/permission prerequisites remain required. This comment is review trace only, never acceptance. Existing Docu evidence: `ocv206-cms-native-supplier-bootstrap-20261114/delivery-entry-{verification,native-contract,review-packet}.json`, `local-checkpoint-bb252312-20261114.json`, plus the separately frozen localization/fixture receipts.
Local checkpoint for independent review; not acceptance, merge, deployment or runtime qualification. No push or new CI request.

Use an explicit process/TLS/local-Docker/private-telemetry allowlist for supplier host wrappers. Publisher, scanner and final prepared-runtime inputs remain in their existing caller. Existing compiler/container isolation remains unchanged; no credential leakage into compiler/container layers is established and original queued build24058 remains unchanged.

Verification:23 focused runtime_supplier tests PASS in0.464s, including real subprocess environment equality, inherited unknown inputs excluded, original SDK arguments and publication/security/runtime bindings preserved. git diff --check PASS. Independent different-provider source review pending.
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] reconcile completed observer publication
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
e973d2cf8e 
Local checkpoint for combined independent review with b7026496; not acceptance or image/runtime qualification. No push, queue, deployment or shared platform change.

Original24058 failed134s after initial telemetry publication completed but its client acknowledgement timed out8s; observer stopped and canonical supplier rejected31s-old telemetry. Read-only exact transaction reconciliation now handles only uncertain publish timeout, preserving30s freshness, phase-specific identity/memory, bounded calls and meaningful next-refresh budget after final state read. Never retry write, renew timestamp or restart producer.

Verification:102 observer/integration tests passed49.863s;23 runtime_supplier tests passed0.465s with canonical discovery. Combined package invocation also had1 module-import loader error for runtime_supplier; corrected only its invocation, not product code. New19-test integration module passed; old observer causal control fails initial and active acknowledgement cases as expected. Independent provider review pending. Original failed native evidence retained.
Checkpoint only; independent review and native activation pending, not acceptance. Preserve selected successful Validate provenance and compatible native artifact bytes, execute current-checkout UID33 runtime checks before Qodana, retain main analysis without deployment authority. Existing per-build auth alias/checkout source proposal was denied and is not included. Live build 24069 and exact trigger-restoration obligation remain unchanged.
OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] frame observer transactions without EOF
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
b85a04dabd 
Local checkpoint only; independent review and runtime validation pending, not acceptance. Actual24069 stale sample and observer timeout retained; controlled open-input failure fixed with bounded length/hash framing, sanitized remote failure details, and precise guard categories. Preserve genuine timestamps, 30s freshness, identity and uncertain-transaction rejection. Denied setup wiring is absent; no live job or credential changes.
Source-only QName guard reproduces the PLAT-130 delivered ON_AGENT and per-build native auth aliases; other roles are unchanged. 34 affected tests pass. Independent and official review pending; this checkpoint is not acceptance or runtime qualification. No setup execution or shared activation.

https://moebiusol.youtrack.cloud/issue/OCV-206

https://moebiusol.youtrack.cloud/issue/PLAT-130
Diagnostic-only CMS observer correction verified by 24 affected integration tests. Exact kubectl terminal trailer no longer masks the original sanitized Python exception; unknown trailers remain unknown. No telemetry freshness, transaction, producer, SDK or live settings changes. CMS24087 remains a retained179-second failed qualification, not fixed by these diagnostics. Independent and official review pending; checkpoint is not acceptance.

https://moebiusol.youtrack.cloud/issue/OCV-206
OCV-206 Keep supplier observation on one bounded foreground stream
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
c60c58e776 
Replace per-sample kubectl exec startup with one private framed and correlated controller-to-agent stream. Existing producer identity, atomic publication/readback and genuine30-second freshness checks remain. No resend after uncertain publication. Original observer expiry bounds the remote helper; all terminal/cancel paths check/reap its exact owned PID identity and join the client, preserving primary failure.

202 affected tests pass in91.779s. One real Kubernetes owned-scratch qualification passed12cycles/36correlated requests in3.4203s; exact remote helper absent and scratch removed. This reduces startup exposure; it does not prove the historical timeout cause or qualify a supplier image. Independent and official review pending; local checkpoint only, not acceptance. No new product run, shared settings, credentials or SDK rebuild.

https://moebiusol.youtrack.cloud/issue/OCV-206
OCV-206 Publish transient supplier samples without durable disk sync
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
a7a5814a24 
https://moebiusol.youtrack.cloud/issue/OCV-206

Keep private atomic replacement, exact readback, producer identity, no-resend and original 30-second freshness. Correct interrupted-operation and pending-phase diagnostics. Durable artifact/custody writers are unchanged.

204 affected checks pass; bounded real-cluster two-file control passes. Historical timeout syscall remains unproven. Independent and official review pending; checkpoint is not runtime qualification or acceptance.
Some checks are pending
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 1
Details
teamcity/medcms/qodana-branch
Required
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/OCV-246-cms-runtime-test-harness:fix/OCV-246-cms-runtime-test-harness
git switch fix/OCV-246-cms-runtime-test-harness
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#78
No description provided.
Delete branch "fix/OCV-246-cms-runtime-test-harness"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?