[echoomegaprime]

Scope: independent CertForge ancestry reconciliation — review only

This is a draft, nondeployment source-history merge to reconcile the actual deployed CertForge commit with GitHub main without losing deployment guards. It does not merge PR #49, approve Swarm #16, authorize a production service window, change a signed verdict, or modify the running service.

Exact parents: GitHub main 4f7d99e2dd4422f3d81cf5b709581be963f5818a and deployed CertForge d8ad9fd881365801354b78a758632d2a31ab6828.
Proposed merge head: 12d6fe72724039f149645be3b8cdadc668b1610a (tree 61eae085b9f3e1cbe00f000e22236e35b18b1654).
Required independent review: release owner, CertForge maintainer, production security owner. This commit's ancestry includes 16 deployed-side commits; review the entire merged diff, not only deploy/deploy_forge.sh.

Resolved deployment-script conflict

• Preserve deployed production E2E attestation/trusted-key environment, canonical manifest digest, effective production DB preservation, credential-helper selection, 900-second bounded source acquisition, and dispatcher Wants= resilience.
• Bring forward main's configurable 90-second cold-start/rollback readiness probes instead of the deployed 20-second fixed loops, and preserve staging-failure diagnostics/log custody.
• No release gate is weakened, no trust-store files or production DB files touched.

Bounded independent preflight

• Read-only FORGE verified deployed .certforge-release-sha=d8ad9fd881365801354b78a758632d2a31ab6828 and exact Git blobs for subscriber, production_e2e, deploy script.
• Constructed new script from exact deployed Git blob 7301e49cb3a3456b9409645aeecd4b7f3e70cbc3; isolated bash -n PASS. Merged script SHA-256 a7ee67610da822628e4904b8ceb2272d59083ca46c48c9d382f4267e6e091743.
• Required static invariants for trust roots, production DB, dispatcher resilience, acquisition timeout, three configured readiness loops all present.
• Not tested: full hosted CI/CodeQL, live deployment rollback, signed runner heartbeat, full-40 real providers, HAMMER production attestation. Those remain independent gates.

Release restrictions

Do not merge until protected approvals, exact-head CI and CodeQL, complete deployed history and rollback review, and a separate exact-SHA authorized release window. The seven stranded queue entries remain unchanged (run QUEUED, dispatch FAILED, reservation BOUND); PR #49 stacked recovery remains a separate draft.

[echoomegaprime]

Independent exact-head FORGE regression proof — 2026-11-12 08:35–08:36 UTC.

• Draft PR DRAFT: reconcile deployed CertForge ancestry with main; retain readiness + production safeguards #60 exact merge commit: 12d6fe72724039f149645be3b8cdadc668b1610a. Parents: main 4f7d99e2dd4422f3d81cf5b709581be963f5818a and actual deployed d8ad9fd881365801354b78a758632d2a31ab6828.
• I cloned an isolated checkout with shared read-only objects from the existing FORGE repository, fetched the exact merge SHA from GitHub, checked out the immutable SHA, set PYTHONPATH=src, then ran:
  python3 -m pytest -q tests/test_deploy_dispatch_smoke_contract.py tests/test_release_pins.py tests/test_production_e2e.py tests/test_deploy_gate.py
• Result: 36 passed, 0 failed, in 1.40 seconds. The earlier script-only bash -n also passed. No live-provider journey, cost, CI security waiver or production deployment.
• Temporary checkout was removed and its absence verified. No production source, DB, service, key, queued run or Swarm PR chore(deps): bump the pip group across 2 directories with 2 updates #16 changed.
• Latest hosted CI run 43183932766 was in progress at 08:36 UTC. Exact-head CodeQL and independent protected review remain unverified/pending. This evidence is regression verification, not production certification.
• This merge reconciles 16 deployed-side commits plus the mainline script fix; the whole PR diff requires independent review. Keep this draft and all release gates closed until that review, exact-head hosted CI+CodeQL, and separate release authorization.

[echoomegaprime]

Independent release-gate update (2026-11-12 09:32 UTC; read-only GitHub + FORGE verification)

Exact candidate: 12d6fe72724039f149645be3b8cdadc668b1610a (draft PR #60). Hosted workflow 43183932766 is now completed/success; the test job passed the full deterministic suite, P1, P6 and P7. This resolves the prior pending CI observation only.

Exact-commit check-runs: test=success, ECHO Release Sentinel=neutral ("Required authentic checks not present: CI, CodeQL"), and ECHO Certification Forge=neutral (staging-only). CertForge run cert_2dd1d8d295924317eba94d6e56f8a952062e8d6d has signed verdict COMPLETE / NOT_READY with mandatory_rule_failed:production_e2e and production_e2e_attestation_missing. There is no separate successful CodeQL check on this SHA, and no independent review submission.

New exact-source review issue to resolve before approving the deployment script: deploy/deploy_forge.sh declares GIT_ACQUISITION_TIMEOUT_SECONDS (line 13), validates a 30–1800-second range (lines 110–117), and forwards it to a service environment (line 620), but the actual source acquisition at line 60 is plain git "${GITC[@]}" fetch --quiet origin "$BRANCH", with no timeout wrapper or equivalent bounded fetch enforcement. The documented finite fetch ceiling is therefore not implemented for this deploy path. Request the smallest guarded fix: enforce a real bounded git-fetch deadline (including subprocess termination), fail closed without moving the current release when exceeded, and add an isolated slow/hung-fetch regression. This is a source-level finding; no production timeout or outage was observed.

Also require independent review of the full 16-commit reconciliation scope, protected-PR approval, CodeQL, and exact-source release acceptance. Verified deployed release marker is still d8ad9fd881365801354b78a758632d2a31ab6828; three installed source Git blobs match that commit. No production deployment/DB mutation/restart is authorized or performed.

[echoomegaprime]

Independent CertForge release-gate follow-up (2026-11-12 10:28 UTC) — SOURCE-ONLY; NO PRODUCTION PROMOTION

I fixed the previously documented unbounded source-fetch path directly on this draft reconciliation branch. Current PR #60 head: 3648116c15d67616f0296a376696fc114b401708 (preceding fix commit b96325ef3a06afed0deb68935e8564f7ef0b6f2b).

• deploy/deploy_forge.sh now validates the configured 30–1800-second acquisition deadline before the first fetch and invokes GNU timeout --signal=TERM --kill-after=5s around git ... fetch; timeout or other fetch failure exits before exact-SHA resolution, build, migration or promotion.
• Added tests/test_deploy_git_fetch_deadline.py with eight isolated no-network cases: success argv, timeout exit 124/137, other fetch error 23, and four invalid timeouts. 8/8 passed on FORGE in 0.03s, using a disposable test tree and mocked timeout. Bash syntax check also passed. Neither test executed the production deploy script.
• Readback of published exact-head blobs: deploy/deploy_forge.sh = 40b31c190159f6d30159375e2ff918affa2f7a93; regression file = 7c5a6f51ebc9704026dc0a1384db01d48de8629c.
• GitHub ancestry check: candidate is 19 commits ahead/0 behind main 4f7d99e2dd4422f3d81cf5b709581be963f5818a and 4 ahead/0 behind deployed d8ad9fd881365801354b78a758632d2a31ab6828. Both histories are ancestors; deployment remains at d8ad9fd.
• New hosted CI: https://github.com/echoomegaprime/echo-certification-forge/actions/runs/43200578311 — in progress at the verified read, NOT claimed passed. Independent approvals: zero. Separate successful exact-head CodeQL not established.

Release disposition HOLD pending full hosted CI, actual CodeQL, independent protected review and exact-SHA production certification. No merge, restart, SQLite mutation, signing-key use, fabricated worker heartbeat or 40-seat paid run.

[echoomegaprime]

Independent exact-head CI closure (2026-11-12 11:25 UTC). Draft PR #60 head 3648116c15d67616f0296a376696fc114b401708 remains unchanged. GitHub Actions run 43200578311 is now COMPLETED / SUCCESS, including full deterministic tests, P1, P6 and P7. This closes the prior pending hosted CI item for the bounded git fetch timeout fix; it does NOT authorize release.

Exact-head checks: test SUCCESS; Release Sentinel NEUTRAL; ECHO Certification Forge NEUTRAL; no CodeQL success, and zero independent approvals. GitHub main 4f7d99e2dd4422f3d81cf5b709581be963f5818a and deployed release d8ad9fd881365801354b78a758632d2a31ab6828 are both ancestors of this candidate (ahead 19 / 4 respectively). Installed release marker is still the old deployed SHA; no promotion occurred. Review all 68 changed files / complete deployed-history reconciliation, exact-head static analysis, rollback and guarded source-fetch behavior before approval.

[echoomegaprime]

Independent FORGE integration acceptance, 2026-11-12: verified PR #60 exact head 3648116c15d67616f0296a376696fc114b401708 and PR #63 exact head a0515d875c2a384965229eb5716331a776ab8190. git merge-tree --write-tree on a disposable local checkout succeeded without conflicts, producing integrated tree 3745b34cb593134dccd99db46f34ff4892879a47 (no GitHub branch or merge). A temporary local two-parent test commit 323452e60eb96cc65760c206e0889b600517477c had both SHA histories plus main 4f7d99e2..., deployed d8ad9fd8..., and PR #49 as ancestors; git diff --check passed. Exact integrated-tree isolated regressions: 35/35 dispatch/migration and 26/26 production-E2E/verdict tests, total 61/61 (all exit 0). PR #63 itself has hosted CI+CodeQL success; the unpublished merged tree has not had hosted CI, CodeQL, independent approvals or production certification. Production release marker remains d8ad9fd881365801354b78a758632d2a31ab6828. Action: prepare a separate reviewed integration candidate from this verified source merge; require exact published-head hosted gates and independent approvals. This finding does not authorize release, automatic merge, canonical restart or queue mutation. Details: PR #49 evidence comment #49 (comment).