release: complete final public showcase gates

[Nobodyworld]

Goal

Track the distinction between public developer-preview visibility, merged product readiness, formal release authorization, and production deployment safety.

Current classification

main: dcb8e283f8445dd76f215a98023197d8ed5acab3
repository visibility: public
classification: PUBLIC DEVELOPER PREVIEW — NOT PRODUCTION READY
public source visibility: complete
exact-SHA evidence workflow: merged through PR #120
public documentation alignment: ready PR #126, unmerged
formal release authorization: blocked
production deployment authorization: not authorized
release-candidate SHA: not selected

Switchboard is intended for localhost or controlled trusted networks. Untrusted multi-tenant and direct internet-facing deployment are unsupported.

Completed public-preview and execution work

• SHA-pinned, read-only GitHub Actions hardening.
• Normal public workflow jobs and logs confirmed.
• Dependabot and repository security controls added.
• Public-facing developer-preview classification established.
• Repository made public.
• Owner confirmed Secret Protection and Push Protection are enabled.
• Execution control plane merged through feat(execution): add Phase 1 work-order, worker, manifest, and run contracts #112 / PR feat(execution): add Phase 1 control-plane contracts #116.
• Pull-based trusted local worker merged through feat(worker): implement the pull-based approved-manifest local worker #113 / PR feat(worker): add pull-based trusted-manifest local worker #119.
• Exact-SHA compact evidence merged through feat(evidence): add exact-SHA validation manifest and structured local evidence #114 / PR feat(evidence): add exact-SHA validation evidence #120 at dcb8e283f8445dd76f215a98023197d8ed5acab3.
• PR feat(evidence): add exact-SHA validation evidence #120 final Commitlint and complete CI matrix passed before merge.
• Phase 2 GitHub adapter fully specified in feat(github): request exact-PR validation and publish compact evidence #122 and opened as draft PR feat(github): validate exact pull-request heads #125.
• Phase 2 exact evidence reuse fully specified in feat(evidence): reuse exact validation evidence with local availability proof #121.

Ready documentation change awaiting owner authorization

PR #126 aligns README.md, SECURITY_NOTES.md, docs/TASKLIST.md, and docs/reports/status.md with the merged execution/evidence baseline and removes stale permanent test/coverage/Mypy claims.

base: dcb8e283f8445dd76f215a98023197d8ed5acab3
head: fa9667dd04d95b5e7c899d4e16ce22d1790c7ae8
state: open, ready, mergeable, unmerged
Commitlint: 29991444435 — success
CI: 29991444455 — success

The complete matrix and connector review passed. Closed PRs #123 and #124 are superseded history and must not be merged.

PR #126 requires separate explicit owner authorization before squash merge.

Formal release technical gate — #104

No release candidate is selected yet. The recommended candidate includes PR #126 if the owner approves it.

After PR #126 is resolved:

1. Record one immutable main SHA as the release candidate.
2. Execute issue release: execute Linux symlink and final local validation #104 against exactly that SHA in a clean Linux-capable environment.
3. Require the Linux symlink-containment regression to run without a skip.
4. Run the complete clean-clone validation and Docker build.
5. Update PUBLIC_RELEASE_AUDIT.md through one narrow draft PR.
6. Verify owner-controlled repository protections and public security alerts.
7. Create a release/tag only after explicit authorization.

The selected candidate must pass:

• Linux symlink-containment regression without a skip.
• Clean Python 3.11 dependency installation and pip check.
• Pinned pre-commit, Ruff, Black, Mypy, and TODO validation.
• Full pytest and strict browser suite.
• Aggregate and module coverage thresholds.
• Bandit and pip-audit.
• Full-history Gitleaks.
• Link validation.
• Docker build or a precise documented blocker.
• git diff --check and final clean worktree.
• PUBLIC_RELEASE_AUDIT.md updated with exact executed evidence.

Active product development outside the release gate

Issue #122 / draft PR #125 implements the GitHub exact-PR request/result adapter from the current merged product baseline. Issue #121 follows with opt-in exact evidence reuse.

Neither #122 nor #121 is a formal-release requirement unless the owner explicitly adds it. Do not silently move the release candidate to include Phase 2 work.

Public security and repository settings

Owner-controlled checks still to verify:

• Require pull requests before merging to main.
• Require conversation resolution.
• Block force pushes.
• Block branch deletion.
• Repository is squash-merge-only.
• Add or verify required checks using actual public check names.
• Enable or verify CodeQL Default Setup when available.
• Review CodeQL, Dependabot, and secret-scanning alerts.
• Confirm Dependabot security updates.
• Confirm repository description, topics, license detection, and social preview.

Formal release authorization

• Include feat(evidence): add exact-SHA validation manifest and structured local evidence #114 / PR feat(evidence): add exact-SHA validation evidence #120 in the intended release scope.
• Decide and merge release-scoped PR docs: align public preview status and README #126 through explicit authorization.
• Select one immutable release-candidate SHA.
• Complete release: execute Linux symlink and final local validation #104 against that exact SHA.
• Confirm no release-blocking pull requests remain.
• Verify owner-controlled settings and initial public security alerts.
• Update the audit with explicit supported deployment boundaries.
• Create a tag or release only after explicit owner authorization.

Explicit non-authorization

Until every formal gate is completed and the owner records authorization:

• do not claim production readiness;
• do not deploy Switchboard as an untrusted internet-facing or multi-tenant service;
• do not create a formal release merely because the repository is public or CI is green;
• do not silently move the selected release candidate during validation;
• do not treat feat(evidence): reuse exact validation evidence with local availability proof #121 or feat(github): request exact-PR validation and publish compact evidence #122 as release requirements without an explicit owner decision.

[Nobodyworld]

Repository settings and merge-gate update

Owner confirmed the main protection rule is configured with required pull requests, conversation resolution, force-push/deletion blocking, and the public CI job checks selected.

The rule was exercised immediately: PR #116 could merge only after its complete required matrix passed. The protected merge produced canonical main SHA:

765b7167457e523b9edc0b230039ed407060274b

PR #116 completed issue #112. The next implementation unit is #113 on feat/pull-based-local-worker.

Formal release issue #104 remains open; public developer-preview status is unchanged.

[Nobodyworld]

Connector progress checkpoint — 2026-07-22

• PR feat(evidence): add exact-SHA validation evidence #120 remains ready, mergeable, and unmerged at e938d3fdc3937babb4f13d3a7980a6c704b8cebd; it still requires explicit owner authorization to squash-merge.
• Phase 2 is now split into bounded issues: feat(evidence): reuse exact validation evidence with local availability proof #121 for exact evidence reuse with worker-local availability proof, and feat(github): request exact-PR validation and publish compact evidence #122 for exact GitHub PR resolution/result publication.
• The stale public status page was isolated into docs-only PR docs: align public preview status and README #123 from current main. It removes obsolete test-count/Mypy claims and points to release: complete final public showcase gates #95, release: execute Linux symlink and final local validation #104, epic: evolve Switchboard into a cost-aware local execution broker #111, feat(evidence): add exact-SHA validation manifest and structured local evidence #114/feat(evidence): add exact-SHA validation evidence #120, feat(evidence): reuse exact validation evidence with local availability proof #121, and feat(github): request exact-PR validation and publish compact evidence #122 as the authoritative records.
• PR docs: align public preview status and README #123 does not overlap PR feat(evidence): add exact-SHA validation evidence #120. Its hosted Commitlint and CI runs are currently in progress.

No release candidate has been selected, no release/tag was created, and production authorization remains blocked.

[Nobodyworld]

Current merge dependency checkpoint — 2026-07-22

The safe order is now explicit:

1. PR feat(evidence): add exact-SHA validation evidence #120 — product/runtime fix and exact-SHA compact evidence
   • head e938d3fdc3937babb4f13d3a7980a6c704b8cebd;
   • open, ready, mergeable, unmerged;
   • final Commitlint 29901539272 and CI 29901539178 successful;
   • requires explicit owner-authorized squash merge.
2. PR docs: align public preview status and README #123 — public status, active task list, and README alignment
   • current head f2da0712a1470c2dfe807ddfd5c5aa183eb7680f;
   • open, draft, mergeable, unmerged;
   • documentation-only and non-overlapping with feat(evidence): add exact-SHA validation evidence #120;
   • blocked until feat(evidence): add exact-SHA validation evidence #120 merges and the branch is recreated or updated from the resulting main SHA.

PR #123 independently reproduced the ownership-loss stale-completion race on worker-only main in CI 29952225701. That race is already corrected and regression-tested in PR #120. Do not duplicate the runtime fix into #123 and do not rely on a nondeterministic rerun.

After #120 merges:

• record its squash-merge SHA in release: execute Linux symlink and final local validation #104 if it is selected for the formal release;
• rebuild/rebase the documentation changes from that merged main;
• add the identified historical/current-status clarification to SECURITY_NOTES.md;
• require a complete green final-head matrix before docs: align public preview status and README #123 returns to ready.

No release candidate, tag, release, or production authorization is implied by this checkpoint.

[Nobodyworld]

Owner-authorized product merge completed.

PR #120 squash-merge SHA: dcb8e283f8445dd76f215a98023197d8ed5acab3

The first formal release scope now includes exact-SHA compact evidence. PR #123 remains the only open documentation follow-up and must be synchronized with this new main before it can become ready. The release-candidate SHA is still not selected; recommended sequence is to finish and merge #123, then select the resulting main SHA for #104 Linux/Docker validation.