Make parked staging rehearsal reach no-deploy handoff

[Chris0Jeky]

Status: IN REVIEW — RECONCILED HEAD GATES ACTIVE

The exact signed head is 3ee4e596bfda30cdbc05d32d384718c1fe26e156. It contains a signed merge of reconciled parent #1502 at 20fbcf99, preserves #1228 as the historical release-trigger milestone, and records #1506 as the current no-environment/no-deployment truth. No PR has been merged.

Summary

• generate per-job 48-byte JWT and 32-byte connector encryption inputs with the runner cryptographic RNG
• inspect Docker Compose's effective JSON variable inventory and fail closed unless exactly those two inputs are required
• mask both values before writing the job environment, immediately before each job's first Compose use
• replace the unprotected production job with a summary-only parked handoff that binds no environment and creates no deployment
• preserve a manual-only, non-deploying rehearsal; no production credential, external target, release trigger, branch-protection, or environment-setting change

Stack and chronology

#1502 now contains the historical #1228 release-trigger removal and has a fresh signed merge of origin/main. This child merges that parent and explicitly supersedes its former production-binding handoff: current implementation and current-truth docs say Environment binding: none and Deployment created: no. Historical delivery entries retain the prior parent state. Do not merge either PR from this task; #1504, release/environment activation, and final integration remain maintainer-controlled.

Verified

• node --test scripts/check-github-ops-governance.test.mjs — 26/26 passed
• node --test scripts/ci/prepare-staging-compose-inputs.test.mjs — 12/12 passed, including real Compose effective-inventory and escaped/commented-literal probes
• GitHub operations, docs-governance, Golden Principles, failure-ledger projection (11/11), exact diff checks, and pinned Actionlint 1.7.12 — passed
• prior manual run 30244212896 at workflow/helper head 3efb7bd4 passed build, real S1-S9 Compose smoke/cleanup, and the parked handoff; both inputs were masked and an exact-SHA deployments query returned []

NOT verified

• Required CI / CI Extended, CodeQL, and a fresh independent review are pending on 3ee4e596
• no new manual dispatch was made after the merge, because the code path is unchanged from the verified workflow/helper head and the path remains parked
• parent Disable automatic staging gate release trigger #1502's final E2E jobs and its remaining [CI] Make the parked staging-gate rehearsal reach its handoff #1506 thread disposition are still pending

Merge gate

Workflow/security-gate scope requires designated maintainer/CODEOWNER review. This PR is not ready to merge until exact-head hosted checks/review complete, parent/child PR disposition is finalized, and maintainer authorization is provided. After those gates and decisions, merge execution follows the repository authority and canonical global pipeline; an authorized agent may perform it.

Closes #1506

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb6c149488

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Exact-head adversarial review found two LOW issues; no CRITICAL, HIGH, or MEDIUM findings.

• LOW: the manual-dispatch descriptions still described deployment/emergency semantics even though this workflow is now a non-deploying rehearsal.
• LOW: the secret-masking test asserted final outputs but did not prove masks were emitted before GITHUB_ENV was written.

Both findings are fixed in 81cfbcea:

• the dispatch descriptions now say build/verify and diagnostic-only smoke skipping;
• the helper exposes the environment append seam and the test asserts the ordered side effects mask, mask, append-environment;
• the canonical workflow digest and its mutation fixture were updated for the reviewed bytes.

Verification on the fix head:

• node --test scripts/check-github-ops-governance.test.mjs: 19/19 passed.
• GitHub operations, docs governance, and Golden Principles gates: passed.
• failure-ledger contract: 11/11 passed.
• PyYAML workflow syntax parse: passed.
• positive Compose config: passed.
• missing connector-key negative canary: failed closed as expected.
• git diff --check: passed.

Still pending: hosted exact-head CI, Actionlint through hosted Workflow Lint, the manual workflow_dispatch rehearsal, and two independent exact-head final review lenses. The PR remains stacked on parked PR #1502 and is not independently mergeable.

[Chris0Jeky]

@codex review exact head 81cfbce. Please inspect the complete stacked diff and all existing comments.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 81cfbcea88

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Hosted no-deploy rehearsal proof for exact head 81cfbcea88d13c22d20549412e8d5685677af4e6:

• Run: https://github.com/Chris0Jeky/Taskdeck/actions/runs/30242044922 (workflow_dispatch, success)
• Phase 1 — Build Verification: success; backend/frontend/container builds and Compose configuration completed.
• Phase 2 — Staging Smoke Tests: success; the real local Compose stack reached and passed smoke, then was stopped.
• Phase 3 — Parked Handoff Summary: success; summary recorded Environment binding: none and Deployment created: no.
• The generated JWT and connector encryption inputs appear only as *** in the run logs.
• Test tag review-81cfbcea named runner-local images only; no registry push or deployment occurred.

This closes the previously unverified hosted-rehearsal evidence only. The PR remains stacked on parked PR #1502 and maintainer-held behind #1504/topology disposition; this is not a merge request.

[Chris0Jeky]

Independent final review — CHANGES REQUESTED on 81cfbcea

Two independent exact-head lenses converged. No CRITICAL or HIGH findings.

MEDIUM

1. The required-variable helper scans raw text, so commented requirements and $${VAR:?…} escapes still appear active even though Docker Compose treats them as inert. Both reviewers reproduced a false-green helper result while docker compose config succeeded without the disabled requirement. The fix must use effective Compose interpolation semantics and add inert-comment/escape regressions. This aligns with thread Make parked staging rehearsal reach no-deploy handoff #1514 (comment).

2. Current operator docs still promise a production environment/release-approval gate that this workflow intentionally removed. docs/ops/DEPLOYMENT_WORKFLOW.md, docs/ops/README.md, docs/strategy/02_PACKAGING_DISTRIBUTION_STRATEGY.md, and the dated audit/current STATUS/MASTERPLAN/TESTING references need an explicit no-environment/no-deployment boundary and the now-completed hosted evidence. This aligns with threads Make parked staging rehearsal reach no-deploy handoff #1514 (comment) and Make parked staging rehearsal reach no-deploy handoff #1514 (comment).

LOW

3. Both jobs export the ephemeral values before restore/build/install hooks. Masking protects logs but not inherited process environments. Generate and export them immediately before each job's first Compose invocation to narrow exposure and the validation-to-use window.

Evidence that remains valid for this head

• Both reviewers confirmed the current implementation is genuinely non-deploying.
• Manual run 30242044922 passed build, real smoke, cleanup, and parked handoff; inputs were masked; the summary recorded no environment and no deployment.
• CI Extended and exact-head Codex are green; Required E2E was still running at final refresh.

One combined fix batch owns every finding. Fix mapping and exact verification will follow after the new head is pushed; all three Codex threads intentionally remain unresolved until then.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

Final-fix evidence at exact signed head 3efb7bd4499c30d0f0b3c3683e43221e46f103f7:

• Effective Compose inventory (MEDIUM): replaced raw-text matching with injected docker compose config --variables --format json; command, JSON, metadata, key/name, and boolean drift fail before RNG or environment writes. Real Compose proves comments and $${...} escaped literals are inert.
• Stale operational truth (MEDIUM): corrected STATUS, MASTERPLAN, TESTING, deployment workflow/readme, packaging strategy, and historical AUDIT. Every surface records run 30242044922 as proof for prior head 81cfbcea, states environment none / deployment no, and explicitly re-owes hosted proof for this new head plus CodeQL after retarget.
• Secret exposure window (LOW): both preparation steps now run immediately after image builds and directly before each job first Compose use; masks are still emitted before GITHUB_ENV writes. The workflow-order regression pins both positions and cleanup guards.

Verification: bounded final-fix review VERIFY; canonical Node/governance 26/26; coordinator combined Node run 38/38 (the prepare suite is imported and also named explicitly); GitHub-operations, docs-governance, Golden Principles, PyYAML, real Compose inventory/inert probes, failure-ledger projection 11/11, workflow SHA-256, DCO, and git diff --check all pass.

Still owed: Required CI, CI Extended/Workflow Lint, fresh manual dispatch on this exact head, parent-first retarget, base-sensitive reproof, and CodeQL after retarget. #1504, topology, and merge remain maintainer-owned.

[Chris0Jeky]

Fresh exact-head hosted rehearsal: PASS

• Run: https://github.com/Chris0Jeky/Taskdeck/actions/runs/30244212896
• Head: 3efb7bd4499c30d0f0b3c3683e43221e46f103f7
• Phase 1 build verification: backend restore/build, frontend install/build, both container images, and effective Compose configuration passed.
• Both generated job inputs are rendered as *** in the Compose consumers; no value is exposed in the logs.
• Phase 2 real stack: S1-S9 produced 11 passed / 0 failed; services started, smoke completed, and docker compose down -v removed containers, network, and volume.
• Phase 3: Environment binding: none; Deployment created: no.
• GitHub deployments queried by exact SHA: [].

This closes the fresh-dispatch gate for the current bytes. Required CI/CI Extended still need their terminal exact-head result. CodeQL remains re-owed after dependency-safe retarget because the current non-default stacked base does not generate it. Parent-first topology, #1504, and merge remain maintainer-owned.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Chris0Jeky]

Follow-up 59c5d4b7 is documentation-only: it replaces the superseded rehearsal references with run 30244212896 and explicitly binds that proof to unchanged workflow/helper head 3efb7bd4. Docs, Golden Principles, GitHub-operations governance, DCO, and diff checks pass. No workflow/helper/test byte changed, so the successful runtime rehearsal remains valid; Required CI and CI Extended are re-running on the final docs head.

[Chris0Jeky]

Final docs-head hosted gate checkpoint

Exact PR head 59c5d4b70950e50831e9b660134a4385ecef6050 now has 31 completed successful/expected checks, 0 pending, 0 failed, and 0 unresolved review threads. The docs-only follow-up changes no workflow/helper/test bytes; manual rehearsal 30244212896 remains exact proof for unchanged workflow/helper head 3efb7bd4499c30d0f0b3c3683e43221e46f103f7 (three phases green, 11/0 smoke, cleanup, masked inputs, no environment, no deployment).

The requested final Codex pass reported its usage limit; the bounded independent final-fix verifier was clean and the request is recorded. This remains non-mergeable: parent PR #1502 must land first, then the child must be retargeted/absorbed and base-sensitive CI/review plus CodeQL re-proved. #1504, topology, and merge are maintainer-owned.

[Chris0Jeky]

Parent reconciliation and fix evidence — exact head 3ee4e596bfda30cdbc05d32d384718c1fe26e156

This signed merge reconciles parent #1502 at 20fbcf99 without rebase or force-push. The canonical chronology is explicit: #1228's manual-only trigger removal with its then-existing unprotected binding is retained as a historical milestone; #1506 is the current truth, removing that binding and ending at a no-environment/no-deployment handoff. The two ledger entries from main are appended after the 05:56 #1506 blocker in timestamp order, then FAILURE_LEDGER.md was regenerated from JSONL.

Exact-tree verification:

• node --test scripts/check-github-ops-governance.test.mjs — 26/26 passed
• node --test scripts/ci/prepare-staging-compose-inputs.test.mjs — 12/12 passed, including real Compose effective-parser behavior
• GitHub operations, docs-governance, Golden Principles, failure-ledger projection (11/11), diff checks, and pinned Actionlint 1.7.12 — passed
• all three existing review threads were re-read; each remains resolved with its mapped fix

The PR body now reflects this head and current gate state. The GitHub closing-reference API currently returns no links because this PR is still based on the non-default parent branch, even though the body retains Closes #1506; do not treat issue closure as proven until the final retarget/topology decision.

Hosted checks, a fresh exact-head review, and maintainer-only integration remain pending.

@codex review exact head 3ee4e596bfda30cdbc05d32d384718c1fe26e156.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 3ee4e596bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".