Phase 3 gate review
Decision: pending. This is the evidence handoff for #240, not a Phase 3 completion declaration or runtime release. The implementation receipts below retain their original source and measurement identities. The maintainer confirmed the 27-topic guide review on September 26 and authorized guide updates and release publication without another approval. Fresh release-source qualification, public website deployment and native delivery remain acceptance work. Security-monitoring activation #282, the actual Angular reference workflow #236 and static-site delivery #495/#496/#497 are complete. The Wiki is already disabled and its publishers are retired; final live-site cutover checks remain separate from that retirement observation.
The current completion preparation starts from development
9b97ac8a13a3d83c228f4e5bee43e54d37da2bdf, including all six guest SDKs and
the qualified developer workflow. The selected developer toolkit
retains the independently authenticated package source and complete supported-host results.
The historical runtime execution review below starts from
6c63b68064ae44284d931e80d76d1e9012189b2b. It does not certify a later integration
commit merely because that commit contains the same documentation.
The preceding runtime integration is development
532364d697b1b93f2b3187e0df367f878023e91a, reviewed on September 23, 2026.
Full CI 35818046307
passed at selected source 193d52c37635026de416feffd4a2dfd57d082451; its actual
PR checkout and the development squash have identical Git trees. The
preceding integration receipt set
retains the original security, six-client, browser, provider, publication,
protected Angular, static-site and bounded resource results. Earlier receipts
below keep their original execution identities and measurement scopes.
Repository execution review, September 23
Development 8eea5c73855530ae3fcd53e4e1ea64cf9f62ab21 passed
full CI 35879906121.
The execution review
records the source tree, successful jobs, intentionally skipped steps, original
artifact identities, hashes of 32 unmodified receipt/output files, and four
verified empty process streams.
Every registered active libtest name was found in the successful workspace log.
Both custom compiler harness markers and the complete supervisor case coverage
were independently checked with the maintained discovery validator.
| Implemented boundary | Result at this source | Evidence |
|---|---|---|
| Core contracts, admission, scheduling, routing, durable storage, CLI and node | All 166 registered targets discovered, with 2,718 active cases. The workspace log records 2,742 passing results, including custom/subprocess results; these are not an additional population of unique cases. Separate doctest and signing-compatibility recipes pass. | Execution index |
| Actual component execution and separate-node behavior | The bounded conformance workflow passes its 19 cases, covering isolation, fresh stores, budgets, cancellation, failure recovery, routing and shutdown. | Conformance |
| Capability authority, networking and protected startup | The PR security matrix passes 27 entries in 13 groups. Compiler sandbox and supervisor harnesses also pass. The fresh local build passes all 14 protected-file tests, including the privileged foreign-owner case omitted from ordinary CI. | Security, local execution |
| HTTP, local blobs and durable policies | Separate CLI/node/provider operations pass with revocation and retained deployment selection across restart. A fresh local build passes 28 blob storage/recovery cases and 15 policy CLI calls across two node starts, including exact replay and persisted revocation. | Provider management, local execution |
| External providers and event triggers | All 19 selected S3, Vault, NATS publication and NATS trigger cases pass against their pinned real services; runner cleanup is acknowledged. This preserves each provider's declared subset and immediate-operation uncertainty. | Provider lane |
| Packaging, OCI, publication authority, rollout and recovery | Verified-TLS Zot tests and the operator, publication, offline and security-profile workflows pass. Independent publications, revoked admission and retained offline invocation are exercised. | Operator, publication, offline, profile |
| Angular rendering and browser boundaries | Eight renderer selections pass. The actual Angular component passes protected T1 admission, browser hydration, staged rollout, CAS rollback and restart with retained native cache. A fresh complete reference run also passes public/authenticated browser sessions, provider denial/cancellation, canary promotion, revocation, restart and rollback. | Renderer lane, Angular T1, complete reference |
| Static/CSR hosting | Signed exact-digest OCI transfer, two-version browser navigation, deep-link reloads, missing-file behavior, mounted redirects, cutover, rollback and revoked/foreign authority checks pass. Static snapshots retain zero active reservations and zero granted execution-cell leases. | Static workflow |
| Existing six-language network clients | All six existing client workflows pass their shared real-node matrix. The separate new capsule-authoring tickets remain with their implementation owner. | Client matrix |
| Bounded dormant-resource regression | The small retained resource workflow passes. Large scale and performance campaigns were not rerun. | Resource receipt |
| Printed first-node workflow | Eight Bash blocks from the current guide execute against a freshly built CLI, node and echo component: create/start, publish, deploy, success, declared error, durable restart, delete and stop. Preparation uses provisioned tools and a dependency cache. | Local execution |
The ignored-case execution trace accounts for all 150 registered ignored cases: 124 are traced to current CI logs or successful owned integration lanes, and one additional ownership case passes locally. The remaining 25 entries are classified individually. They include manual 100,000-item/resource/performance collectors, Harbor and full Angular-reference qualification, a supplied-configuration diagnostic, and child entry points whose parent workflows retain the outcome. An absent individual libtest line is not treated as either an executed pass or a feature failure. The subsequent Angular reference execution also passes the separate fixture-export case and the full workflow. The earlier ignored-case trace retains its original checkpoint rather than being rewritten.
The local source copy verified 4,361 Git blobs against the selected commit and excluded the benchmark tree for these selected builds. CLI and node builds used the locked dependency graph offline with fresh target outputs. No SDK authoring source or ticket was changed by this review.
The complete Angular reference used the same source and rebuilt the optimized
compiler. Fixture compilation first failed because the audit copy omitted the
tracked benchmarks/phase1/cases.json compile-time input. That
setup failure
is retained. Restoring that one file from the selected commit allowed the
unchanged fixture exporter and full workflow to pass. Cargo rebuilt the node
during fixture preparation; this run records that resulting binary identity.
All 4,361 original source blobs and the added manifest were verified unchanged
after execution. The unaltered workflow receipt
records 124 CLI processes, three clean node shutdowns, reclaimed backend work,
public/authenticated Chromium sessions and zero final activation reservations.
Earlier Harbor/network qualification, resource campaigns and installed-bundle VM qualification keep their original identities. Those campaigns were not rerun or relabelled here; the earlier Angular attempts also remain unchanged beside the newly executed reference workflow. Angular compilation still reports unchecked reproducibility and incomplete declared dependency coverage. This review covers the declared Linux x86_64 T0/T1 profiles; T2 guest-process containment and production certification remain outside it. At that historical checkpoint, guide review, site deployment and authoring were still pending. All six authoring tickets #544–#549 and developer workflow #559 are now closed, and the maintainer has accepted the guide review. Fresh native publication, complete-site deployment and the final decision remain to be recorded.
Dependency and evidence closure
| Required boundary | Verified handoff | Remaining gate condition |
|---|---|---|
| Phase 2 entry gate #158 | Phase 2 completion retains its original decision, source, failures and bounded resource profiles. | Preserve the earlier evidence population. |
| Guest contracts, providers and management #202–#221, #226/#227 | Core/provider execution handoff, provider workflow, and integrated security selection. | Current final integration checks must remain green. |
| Six executable clients #228/#230/#260–#263 | Six-client guide receipts: 18 assertions per language, 54 activation identities, six operation receipts and 24 physically closed held requests. | Human guide review is separate from native transport and lifecycle qualification. |
| Publication correction #264–#267 | The security matrix binds unchanged-component corrections, independent publications/tenants, revocation, legacy ambiguity and restart authority to exact maintained cases. All four implementation tickets are closed. | Preserve exact publication selection across every API/client and the final integration. |
| Registry policy #268–#270 and decisions #271–#274 | OCI resource qualification, the integrated security selection, and the accepted versioned registry, effects, wait-ownership, isolation and freshness decisions. These tickets are closed. | #274 remains a design handoff; it does not deliver cluster routing. |
| Runtime security #277–#281 and #238 | Source-clean manual receipt, with checksum: 186 libtest entries, two compiler mains and four separate-node workflows. #374 merged at 2967a9a1f069aaa476e2a294137bf7843a632a88 after all 17 checks passed; #238 is closed. | #282 is closed: activation and monitoring evidence retains the approved default-branch workflow, scheduled run 35586505063, manual run 35752339515, both maintained refs and the required security aggregate. |
| Resource equation #239 | Provider recovery, renderer memory/storage, event and child ownership, and OCI qualification. #376 merged after exact-head CI passed; #239 is closed. | Keep profile-specific measurements, failed attempts and unexported counters explicit. |
| Angular application/reference #44/#236 | Actual Angular reference workflow: real signed two-build publication, public/authenticated browser delivery, DOM-reusing hydration, provider denial/cancellation, canary/revocation/restart/rollback and cleanup. #372 merged as ffa90dc3f76f4bc589be63d313103fdb67fb5f1b; both tickets are closed. | Preserve the restricted profile, unchecked reproducibility and declared incomplete dependency coverage. Guide review #361 is accepted and its ticket is closed. |
| Static web extension #495/#496/#497 | Contract PR #498, delivery PR #501 and CSR/static-generator workflow PR #502 are merged; all three tickets are closed. #502 merged as e4c9120b7d4c14220a4315bfd8e717505e37a5b4 after CI run 35784029574 passed, including the actual OCI/browser qualification. | Preserve the final integrated static and SSR checks; human guide review remains separate. |
| Native distribution #308 | Authenticated alpha.4 rehearsal passed both real VM profiles with complete acceptance, including genuine rc.2 upgrade, unsupported downgrade rejection, reboot, retained invocation and recovery/removal; local rootless evaluation also passed. The historical source and harness are 193d52c37635026de416feffd4a2dfd57d082451. | The earlier premature tag was removed and run 35822633436 cancelled. Publication is now authorized after completion and promotion: qualify and publish the exact final release commit, preserving the historical rehearsal separately. |
| Runbooks and guides #237/#357/#358/#359/#361 | Executed first-node, delivery, provider and six-client receipts are retained. Guide execution PR #467 merged after all 17 checks passed. | The maintainer review is accepted. Updated packaged setup steps, final native bundle/upgrade evidence and the published site remain to be verified. |
| Six guest SDKs #544–#549 and developer workflow #559 | All tickets are closed. The selected toolkit passed its complete five-entry packaged qualification at source cb00bf43e3f598e0f9d4bcaea2a4853d17dea8f4; separate six-language native tutorial comparisons retain 18 applications and 72 cases per platform. | Preserve the actual platform/language scope and original toolkit identities when attaching public assets. Native server qualification is separate. |
| Finite documentation gate #345 | Foundation, theme, diagrams, examples, version binding, discovery and initial protected Pages publication are delivered. The coverage contract retains 27 required outcomes. | The 27-topic maintainer review is accepted with subsequent edits delegated. Publish the updated complete site, verify live routes and finish #356's content cutover. The Wiki and its publishers are already disabled. |
The continuous Documentation & Learning workstream stays open. Its later tasks do not enlarge the finite #345 gate. The 27-outcome checklist gives the maintainer a finite review path and records the September 26 acceptance and delegated updates.
Fixed, active and bounded shared resources
The resource model remains fixed node runtime plus active activations plus bounded shared caches and provider pools. Metadata and retained audit/storage bytes can grow within configured limits; dormant applications do not acquire dedicated processes, threads or listeners.
These observations come from two different successful bounded campaigns on the shared Docker Desktop host. Each row links the exact raw receipt; the values are not a universal minimum, a comparison between the two profiles, or a new measurement of the current development head.
| Profile and phase | Dormant additions | Processes / threads / listeners | Descriptors | Observed RSS |
|---|---|---|---|---|
| Provider campaign: fixed | 0 | 1 / 8 / 1 | 34 | 58,589,184 bytes |
| Same provider campaign: dormant | 4 / 16 / 32 | 1 / 8 / 1 at every population | 34 | 63,045,632 / 63,176,704 / 63,700,992 bytes |
| Two-cell Angular campaign: fixed | 0 | 1 / 9 / 2 | 23 | 57,540,608 bytes |
| Same Angular campaign: dormant | 2 / 4 / 8 | 1 / 9 / 2 at every population | 23 | 125,718,528 / 125,718,528 / 125,849,600 bytes |
The provider campaign retains all 96 arrivals per provider: 56 successful blob operations and 43 successful HTTP operations; other outcomes are retained as failed or unfinished, not counted as throughput. Post-churn recovery succeeded. The combined setup matrix's later compiler-path failure remains a failure; the separately executed web matrix supplies its own successful observations.
The one-cell and two-cell renderer profiles measured a 22,413,312-byte per-invocation Wasm memory high-water mark under a 268,435,456-byte configured ceiling. That counter includes the JavaScript engine's linear-memory use and does not isolate live JavaScript allocator bytes. Cancelled status lacks that consumption field; it remains unavailable. Actual cell/queue ownership and process reap establish cleanup.
Four versus eight dormant Angular deployments retained one component, two packages and two independent publications. Named-file logical bytes exceeded unique-inode logical bytes by 49,070,980 bytes in each population. The linked storage report records the bounded, non-atomic scan and allocated bytes; it does not claim a filesystem-wide deduplication ratio.
The OCI profiles exercised one and two concurrent operations with held peer rendezvous, cancellation, recovery and physical retirement. Their 160-byte DNS configuration/cache reservation is an accounting charge, not OS RSS. Retained token/DNS bytes plateaued across the recorded cold and warm pulls.
No 100,000-deployment campaign, soak, dedicated-host latency comparison or Docker/Kubernetes performance claim is introduced by this review. Original receipts keep their historical pending-ticket fields; later acceptance does not rewrite measured bytes or convert an earlier failed attempt into a pass.
Final integration and publication checks
- The obsolete audit, capability and policy API removals and current runtime fixes are merged. Preserve the successful exact-source integration above and its retained six-client, browser, security and cleanup receipts. Any further runtime change needs its own required checks and review.
- Preserve #282's activated monitoring and scheduled-ref evidence and #308's successful historical native rehearsal. The maintainer has authorized publication after the required corrections. Complete the requirements and merge development into release before recreating the final tag. Qualify the resulting release source and verify its actual published assets through the protected publisher; the earlier rehearsal does not qualify later runtime changes.
- Preserve the maintainer's accepted 27-topic review and delegated updates in the coverage inventory. Validate the changed packaged setup paths and report their execution source separately. Do not attribute later automated checks to the human reviewer or relabel historical execution receipts.
- Publish that reviewed complete site through the protected exact-artifact flow. Record source SHA, successful push CI run/attempt, immutable artifact, publisher run and live deployment identity. Verify home, nested/versioned pages, source-backed code switching, assets, search and accessibility.
- Complete the Wiki content migration: verify maintained replacement routes and switch entry links to the deployed site. Legacy Wiki URLs, anchors and archive notices are not required.
- Complete the required six-language capsule-authoring extension below and resolve the remaining guide/runbook, documentation, static-site and native criteria, including removal of obsolete Phase 1/2 compatibility, then publish the final #240 decision with immutable evidence and accepted residual limits. That decision closes #201 and changes the roadmap's phase-completion status.
- After Phase 3 completion and verified site deployment, recheck the already disabled Wiki and retired writers, retain the final cutover receipt and close #356. Preserve the original dates of the earlier source removal and settings observation. Content migration and live readiness remain gate prerequisites.
Required six-language capsule authoring
The maintainer's September 23 decision requires all six existing client languages to support creating capsules before this gate closes:
Each ticket requires actual language sources, typed WIT imports and exports, guest capability APIs, a usable create/build/package/deploy/invoke workflow, equivalent runnable examples, and real-node error, authority, cancellation, resource and cleanup checks. The existing external client matrix and #221's original Rust/C scope remain valid for their recorded work; they do not complete this new guest-authoring requirement. Java and C# compiler feasibility is part of their required delivery, not permission to omit those languages.
The implementation must preserve fresh activation state and bounded shared resources. A dormant deployment must not own a language process, thread, listener, persistent guest heap, execution cell or provider pool. New guest profiles need their own validation and useful language-selectable tutorials. Each ticket records its language's current implementation and acceptance state. The gate requires all six authoring workflows to be complete. Delivery evidence is retained in those tickets and their language-specific developer qualification reports. This extension alone does not complete the remaining gate criteria, human newcomer review or development-to-release integration.
Later-phase exclusions
Phase 3 capability effects are immediate external operations, not a transactional outbox or universal exactly-once execution. Durable guest state, transactional workflows, distributed placement and cluster routing remain later phases. Optional isolated native compilation does not provide guest process containment or certify hostile multitenancy. The supported Angular recipe does not host arbitrary Node/Express servers or unrestricted Angular CLI projects. Each security/profile document retains those boundaries.