Phase 2 completion review

Current status, September 13, 2026: Phase 2 was accepted when PR #245 merged as fa47cf9bfc8d7270868570e7abe23b8978cb72ab after all seven applicable CI checks passed. Gate #158 and epic #139 are closed. The report below retains its review-time conditions and measured source identities; subsequent merges do not replace those measurements. Phase 3 remains planned work.

Reviewed gate report

Gate decision: accept Phase 2 on the reviewed, CI-passing merge of this report.

This report maps gate #158 to implemented delivery boundaries and their evidence, reviewed September 13, 2026. All eighteen implementation/documentation children are merged and closed; their exact revisions and successful checks are in the dependency ledger. The finite evidence runs and separate Wiki publication below are verified. The gate PR must pass all seven applicable CI checks before its reviewed merge authorizes closure of epic #139 and the Phase 2 milestone. Gate #158 records that final PR, checked head and merge decision. A proposed branch copy of this report does not itself establish that the merge occurred.

The Phase 1 completion and performance extension retain their original measurements, failures, source identities and qualifications. They supply catalog, routing, execution and ownership foundations; their receipts do not substitute for current Phase 2 evidence.

Current gate evidence

These centrally executed results have compact retained receipts identifying their source, binaries, configuration, collectors and fixtures. They are separate observations; a later merge revision does not replace a measured revision. Earlier failed and superseded attempts remain in the attempt ledger.

Check	Observed result and exact scope	Retained evidence
Real authority through native execution	3/3 PASS, 57.03 seconds in trust_currentness.rs: proof-age expiry, joint-policy expiry and publisher revocation. Each case performs one real isolated compilation and successful invocation before invalidation.	Native currentness receipt, including test/source/compiler/fixture identities and the unprivileged execution profile.
Registry outage versus local eligibility	PASS: 24 CLI commands and 3 Invoke attempts: 2 successes and 1 revoked-release denial. The offline workflow authenticates transfer before registry shutdown; a new pull fails while the admitted local route still succeeds. Local revocation then denies use with the registry still stopped.	Offline receipt, retaining transfer failure, denied Invoke, identities and actual shutdown/reap.
Dormant release/resource profile	Final rerun PASS for phase2-dormant-32-r1: 32 distinct signed releases, 16 deployments, exactly 2 warmed portable runtime images, 32 successful Invokes, 133 control commands and 12 OS samples. The other 30 releases remain unprepared. The final collector/validator checks passed 38/38.	Resource receipt, 86,476 bytes, with all samples, fixed configuration, catalog counts, clean worker joins, process reap and temporary-output removal.
Complete operator workflow	PASS: 114 CLI processes and 18 successful Invokes, including attributed canary evaluation/promotion, managed operation replay/lookup, rollback, restart and revocation.	Operator receipt, with exact identities, decisions, operation receipts and shutdown records. The preceding failed attempt remains separately classified below.
Selected strict lint checks	The four centrally selected packages passed Clippy with all targets/features after the test-only fixes.	Attempt ledger and dependency/check ledger. This result does not stand in for final gate CI.
Actual observed-build provenance	The retained contracts-job artifact identifies the actual tested merge, build inputs, component and SBOM input inventory consumed by registry integration.	Observed-build receipt and captured files, separate from synthetic workflow fixtures.
Published Wiki	30 actual Git blobs verified: 26 pages, 4 assets and 147 links against the managed source inventory.	Wiki publication receipt, with exact source/live revisions and successful publication run.

The new trust tests independently renew the bounded clock lease before checking the exact denial cause. They retain both readiness and an invocation future created before invalidation, then deny materialization, final start and owned and borrowed preparation. Isolated-compile, native-loader and guest-store counts do not increase. Reopening the same native cache cannot revive the catalog's old grant. Expired-policy and revoked-publisher catalog recovery keeps the historical record readable with denied eligibility. A fresh catalog recovery may reverify still-valid evidence after proof-age expiry; that documented refresh creates a new capability and does not upgrade an old in-process token.

The resource profile uses portable preparation. Its two warmed images are not two persistent native-cache hits. Native image mapping ownership and isolated child cleanup have their own focused tests. See the fixed resource profile and offline validation instructions.

All eighteen implementation and documentation dependencies

The dependency ledger records the eighteen child issues, reviewed heads, merge revisions and required checks. All #140–157 children are delivered; #156 merged through PR #242 at bda3017345b0bf7d656d151cec10a5b3fd8cb165. Documentation #157 merged through PR #243 at 939cdc836bf2a512b6001dd1031c4ae636847ca3. The map below connects each dependency to its implementation and verification surface; source coverage alone is not a passing execution result.

Child	Concrete implementation	Focused tests	Operator or contract documentation
#140 immutable package identity	Package codec/model	Golden bytes, adversarial format	Package format
#141 deterministic packaging	Packaging and directory inventory	Roundtrip, component/WIT validation	Packaging
#142 authenticated OCI transfer	OCI HTTP adapter	Real registry, transport bounds	Registry profile
#143 signatures and publisher trust	Signing and current publisher verification	Publisher trust, bounded trust inputs	Publisher trust
#144 build provenance	Builder verification	Provenance, actual observed-build registry roundtrip	Build provenance
#145 digest-bound SBOMs	SBOM generation, association and policy	Association/policy, observed-build SBOM roundtrip	SBOM contract
#146 verified catalog admission	Supply-chain authority, catalog admission	Real signed catalog, historical validation	Package admission
#147 release compatibility	Runtime requirements, exact package comparison	Package compatibility, deployment runtime checks	Release compatibility
#148 durable lifecycle	Lifecycle store and capabilities	Real evidence renewal/revocation, runtime currentness	Lifecycle and recovery
#149 bounded raw cache	Raw cache	Capacity, ownership and recovery, OCI cache	Raw cache
#150 isolated trusted compiler	AOT supervisor, sandbox and authenticated output	Sandbox, supervisor ownership, exact inputs	Trusted AOT boundary
#151 persistent native reuse	Authenticated cache composition, audited loader	Reopen/hit, tamper, retained images	Native node settings
#152 audit and bounded observations	Durable journal, wire queries/leases	Journal tests, node audit startup	Phase 2 audit
#153 durable rollout coordination	Shared coordinator, combined catalog	Atomic rollout publication, coordinator ownership	Rollout protocol
#154 canary promotion	Sealed observation/evaluation, promotion	Promotion assessment, actual node Invoke	Controlled promotion
#155 atomic rollback	Rollback coordinator, combined catalog transaction	Restoration and pins, target trust	Rollback and recovery
#156 management and CLI	CLI control workflows, managed deployment RPC	CLI validation/projection, mixed managed writers, real process workflow	Operator workflows, CLI reference
#157 operator documentation	Delivery notes, delivery diagram	Link/schema/diagram checks and verified Wiki publication	Capsule creation, quickstart, topology, validation

The #157 links name their final repository destinations, reviewed from the separate documentation worktree. Wiki synchronization is independently verified from source d9778eae9d83d5738e3f70b6ba15080a24c0d63a to live Wiki revision 7cd26bb98c751df82b530d635f978f9934131414 by run 34724297039. That publication describes delivered Phase 2 features, keeps gate #158 open and labels Phase 3 as planned; it does not claim a later documentation merge.

Acceptance-criterion reconciliation

The following ten rows follow the gate issue's acceptance criteria in order. The retained receipts and dependency/check ledger carry execution results; the linked source suites show the precise boundary each result exercises.

Criterion	Implementation and test evidence	Evidence disposition
1. Reconcile every requirement and child	The eighteen-row map above covers package identity through runbooks. The existing overlap rendezvous remains the owner of the #132 reliability correction.	Dependency ledger and attempt dispositions; #132 retains its own closed disposition below.
2. Real registry through rollback/revoke/status	Operator scenario and canary schedule use actual CLI/node processes, separate storage, TLS registry transfer, verified publication, managed deployment, attributed invocation, promotion, rollback, restart and revocation.	Passing 114-process/18-Invoke receipt binds exact package/component/policy/runtime and process/build identities. The earlier failure remains separate.
3. Reject invalid content before routing or preparation	Authority, catalog, runtime compatibility, deployment supply chain, runtime admission, native tamper/currentness tests cover independent negative boundaries.	The real native currentness receipt adds expiry/revocation composition to the dependency suites. Negative checks do not derive authorization from positive cache state.
4. Evidence, scope, bounds and offline behavior	Signature currentness, provenance/SBOM tests, referrer bounds, HTTP cache ownership, management integration and the distinct outage/currentness schedules above.	Actual observed-build artifact, offline transfer/denial evidence and dependency authentication/redaction suites. Registry availability does not determine local trust.
5. Concurrency, interrupted durability and monotonic rollback	Lifecycle cutpoints, publication visibility, rollout recovery, managed-operation persistence, rollback/revocation tests and mixed-writer CAS tests.	Dependency suites exercise revoke after preparation, failed post-rename synchronization, stale writers and preserved pins. The operator receipt separately retains real rollback/restart outcomes. A selected but unconfirmed publication remains uncertain.
6. AOT, caches, pins and actual cleanup	Sandbox/supervisor/source tests above; native reopen/tamper/image ownership; raw-cache staging, eviction, malformed recovery and pin tests. Native-loader source guard checks the audited unsafe boundary.	Native receipt binds compiler/runtime/host identities and no-additional-work assertions. Focused owner suites retain separate compiler/output/read/image accounting; process receipts record actual joins/reap.
7. Fixed dormant/resource experiment	Frozen profile, runner, OS observer and receipt validator tests.	Final 12-sample receipt, fixed config, exact catalog counts, two-image preparation, shutdown joins and process reap; 38 collector/validator checks passed. The superseded observation is in the attempt ledger.
8. Current workflows, docs, diagrams and wiki	#156 executable workflows, management reference, node configuration, API surface, architecture, #157 runbooks and delivery SVG.	Wiki receipt verifies all 30 published blobs and 147 links against its exact source. Documentation merge/CI is covered by the gate decision above.
9. CI and compact reproducible evidence	Required CI workflow, validation contract, focused security/restart/ownership suites and retention policy.	Dependency/check ledger, compact receipts and failed/unavailable attempt records preserve actual reviewed/measured identities. No final gate CI result is inferred from local success.
10. Report and closure decision	This report, dependency ledger and retained evidence support the decision.	The explicit decision at the top governs closure. Later closure/merge identities do not rewrite the identities of measured executions.

Issue #132, “Make mixed memory containment overlap deterministic,” is closed as completed (September 12, 2026). That disposition belongs to #132. Phase 2 neither reopens, duplicates nor reassigns it, and does not erase the original reliability failure when citing the corrected overlap test.

Provenance and measurement boundaries

The operator, offline and resource exporters create fresh publisher/builder signatures over exact package identities and regenerate their SBOM associations. Their build observation is explicitly synthetic test evidence. They establish signature production, transfer and policy/runtime composition for that fixture; they do not prove that a production build produced the component.

The separate real_observed_build_provenance_roundtrip consumes captured build inputs through the provenance integration. The CI contracts job publishes phase-2-observed-echo-<source revision> and the registry job consumes it. The retained artifact receipt binds PR #242 head a35a58950bff187b2702164fd2f13b0fb54b237b, actual tested merge c0c3d5c39acfcdc3326987805da49c17e69bfdcf, workflow run 34723362373 and artifact 10306997403. It records byte lengths and SHA-256 digests for the ten captured files, including the component, observation, contracts, WIT inventory and SBOM inputs. These are historical CI execution identities, not the later merge or gate head. The maintained observed build is nonhermetic, as documented in build provenance.

The dormant experiment measures one fixed single-node population. Thirty of its 32 releases remain unprepared; 16 deployments reference only the two warmed components. It reports OS observations separately from logical retained metadata, prepared images and invocation ownership. Reclamation means that the declared transient owners retire and shutdown actually completes. It does not require RSS to return to baseline or delete authoritative release/audit history. No result here establishes 100k Phase 2 scale, an arbitrary-duration leak bound, a latency/throughput SLO or production cluster capacity.

Retained failure and availability qualification

The preceding operator attempt is FAILED, with an unclassified internal cause. CLI call 58 returned public Unavailable during the positive-canary schedule; no gRPC error code or distinguishing internal reason was retained. It did not establish a passing canary or a passing workflow. The attempt ledger retains that outcome and records completed owned cleanup. Compact retention does not make the missing internal diagnostic recoverable.

Source inspection found no additional RPC or retained Rust owner introduced by the Python result collector. It also identified multiple fail-closed paths that can surface public Unavailable; the public result cannot establish which path ran. In particular, it does not establish that periodic clock lease maintenance caused this failure. The separate passing run used the same production binaries, maintained collector code, fixed bounds and logical workload with fresh signed fixtures. No failed Invoke was retried, removed from a denominator or converted into success; no resource limit was raised and no production fix explains the later pass.

Current policy/clock readiness and finite resource availability remain conditions of use. A retained grant or cache hit cannot bypass them, and nonblocking admission can deny a start when currentness cannot be established. The observed pass therefore provides finite workflow evidence, not a zero-error availability or SLO guarantee. The failed attempt is not dismissed as expected maintenance or classified as a resolved defect.

Follow-up #244 tracks the independently confirmed diagnostic ambiguity between TryLockError::WouldBlock and TryLockError::Poisoned. Both remain fail-closed; distinguishing their diagnostics neither attributes nor fixes the historical operator failure. The follow-up has no Phase 2 milestone and is not an additional required Phase 2 feature.

Migration, security and finite limits

• Package digest, component digest, publisher/builder proof, runtime profile and lifecycle permission remain distinct. Copying bytes, a diagnostic verify report or a cache hit cannot authorize execution. Currentness is checked on retained work as well as new preparation.
• Catalog formats 1–4 preserve their documented decode and absent-field rules. Managed operations add global state-version CAS alongside object generation. Finite receipt lookup returns unknown for absent or evicted history; unknown does not prove an operation never ran. Retained replay never reapplies a mutation or renews a grant. See operator recovery.
• Canary promotion requires the exact bound cohort, policy and completed, quiescent observation window. No data, incomplete capture and unavailable evidence cannot be promoted as healthy. Rollback restores the captured eligible target through a new monotonic generation; legacy plans without a captured target cannot synthesize one. See promotion and rollback.
• Verified but ineligible desired rows recover as denying history so operators can inspect/remove/update them. Corruption still prevents authoritative recovery. Explicit fresh compilation, including startup recovery, may acquire current grants; retained in-process tokens never upgrade automatically.
• Raw/native caches are replaceable and bounded independently of authoritative catalogs. Native reuse is opt-in on the documented Linux x86_64 sandbox profile, with an approved compiler and protected local authentication key. Native blob/receipt replacement cannot forge that key's authorization; trusted host administration and key protection remain part of the boundary. Page-rounded image charges are not total Wasmtime heap, COW storage or RSS.
• Audit is finite, with explicit loss, outcome uncertainty and prior-session coverage limits. Catalog durability and audit acknowledgement are separate. Cancellation of a caller does not cancel already-owned disk work or prove a child has exited. Shutdown records actual joins/reap and reports late or incomplete cleanup as failure.
• The standalone management listener remains authenticated loopback gRPC. Registry TLS does not provide remote node transport security. Browser/SSR packages are artifact contracts only. General HTTP/blob/secrets/events/service providers and application ingress/Angular execution belong to Phase 3; state, effects, cluster operation and durable workflows remain later phases.

Retained evidence inventory

The compact evidence directory is benchmarks/phase2/2026-09-13/:

Artifact	Scope
operator-receipt.json	Exact build/package/policy/configuration identities, 114 CLI processes, 18 successful Invokes, control/canary/rollback/revocation records and both node shutdowns.
offline-receipt.json	Authenticated transfer, owned registry stop, failed new transfer, successful local use, local revocation denial and process cleanup.
resource-receipt.json	Fixed profile/configuration, all 12 OS/inventory samples, exact catalog population and invocation identities, compiler/cleanup/audit/coordinator joins and process reap.
native-currentness-receipt.json	Three real-authority native tests, exact test/source/compiler/fixture/host identities and bounded compile/load scope.
dependencies.json	Child dispositions, reviewed heads, merge revisions and required CI/check identities.
wiki-publication.json	Actual source/live Wiki revisions, publication run, source manifest digest and verified published blob/link counts.
attempts.json	Failed, unavailable, superseded and final passing attempts, with explicit diagnostic and retention limits.
observed-echo-receipt.json and observed-echo/	Actual CI artifact identity and ten captured build/component/WIT/SBOM files with per-file lengths and SHA-256 digests.

These receipts preserve execution identities and qualifications independently of the completion decision. The gate owner records final CI/merge review and closure through the decision at the top; no local pass substitutes for that review.