docs(project): record stg rollout and PR #21 re-derivation receipt

docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md

@@ -191,6 +191,59 @@ image publication; any GitOps/deployment promotion.
 - 2026-09-18: terminal condition met. No further work is authorized in this
   package; every remaining action is a separately gated decision listed above.
 
+## Follow-up receipt: STG rollout and PR #21 re-derivation (2026-09-18)
+
+Part (a) rollout:
+
+- GitOps pins merged: helm-charts !100 (ee880de, seven image tags in
+  codeapi/stg/values.yaml) and df-cloud-klickeruzh !598 (CODE_INTERPRETER_
+  TARGET_REVISION = 929ec4d8220f969a3f049e3a134259befeed15d7).
+- ArgoCD app-codeapi: Synced/Healthy; spec.sources[0].targetRevision is
+  929ec4d8220f969a3f049e3a134259befeed15d7, second source ee880de.
+- All six stg deployments (api, file-server, tool-call-server, egress-gateway,
+  service-worker, sandbox-runner) carry the pinned revision. PRD untouched.
+- Live stg health re-checked at this revision: api /v1/health 200;
+  file-server /health 200; tool-call-server healthy with redis true;
+  egress-gateway /health 200.
+
+Part (a) e2e in stg: blocked, no credential-free path.
+
+- Every authenticated route returns 401 without a bearer token; an unknown
+  path also returns 401, so auth precedes routing.
+- The deployed revision verifies EdDSA JWTs from issuer librechat with
+  audience codeapi, single-tenant legacy. Its JWKS advertises one key,
+  kid codeapi-stg-2026-06-29.
+- No synthetic token is configured in stg (CODEAPI_SYNTHETIC_ACCESS_TOKEN is
+  absent from both api deployments), and no trust-entry override is present
+  (CODEAPI_JWT_TRUST_ENTRIES_JSON is unset).
+- The private signing key is not reachable: the cluster secret carries only
+  the public JWKS, Infisical has no readable codeapi profile, and Key Vault
+  secret listing is forbidden for the available identities.
+- Stg also has no sandbox capacity to complete an execute: the sandbox-runner
+  and pool-waker deployments are scaled to zero, the sandboxspot pool is
+  empty, and there is no KVM node.
+- Consequence: an authenticated POST /v1/exec cannot be performed in stg
+  without an stg signing key or an enabled synthetic token. The
+  credential-free proof (health surface plus the auth-gate matrix) is what
+  this environment can demonstrate.
+- Note: the deployed revision on main does support CODEAPI_JWT_TRUST_ENTRIES
+  _JSON, so enabling a synthetic token or a trust entry is a configuration
+  change rather than a rebuild.
+
+Part (b) dependabot dispositions and PR #21:
+
+- dependabot #4, #14, #16 closed with supersession comments (main already
+  carries newer versions).
+- PR #21 was CONFLICTING against main (it predates the hosted-apps routes and
+  the public timeout field). It is re-derived on 929ec4d as draft PR #28,
+  branch rs/codeapi-public-contract-v2, head 43ed62c, eight files, +1045/-205.
+- CI run 35372691427 on #28 completed success: all ten checks green.
+- PR #28 merged into main as merge commit bb8359355273c71199d59dbacb1afe3299541cde
+  (never squashed; history preserved).
+- PR #21 closed as superseded by #28, with the re-derivation rationale recorded
+  on the pull request.
+
+
 ## Post-merge receipt (2026-09-18)
 
 PR #26 merged into `main` as merge commit `7d77c61` (never squashed;