Persist the Outpost config baseline, and let a run be told not to publish

[leggetter]

The two harness failures that actually bit us this week, rather than hypothetical ones.

#41 — a crashed run made its config damage permanent

Deployment config was captured in memory only, so a run that died before release left its damage in place and the next acquire adopted the broken value as pristine.

On 21 August an agent configuring operator events sent 21 PATCH /config requests and left TOPICS empty. Every seed afterwards failed with 422 invalid topics — nineteen of twenty-four cells — and the original value was unrecoverable, already overwritten before anyone read it. The project had to be repaired by hand with a guessed superset.

Deployment config is worse than a leaked tenant twice over: it is global, so it breaks scenarios that never touch config, and it has no natural baseline, so "pristine" silently becomes whatever the last crash left.

Now recorded on first acquire in .outpost-pristine-config.json, the same way .hookdeck-pristine.json already works for the project itself. Redacted values are not recorded, so a mask can never be restored as though it were the setting.

Verified against the exact failure:

before      : orders,retries,order.created,order.shipped,...
after wipe  : ""            ← agent wipes TOPICS, run dies without releasing
after next  : orders,retries,order.created,order.shipped,...   ← restored from disk

#51 — no way to say "run, but don't publish"

Publishing was gated on the matrix succeeding and nothing else, so a run against a main we already knew was wrong would publish anyway.

On 24 August the cron fired at 06:14 with the addendum defect still on main — the one that made twelve baseline cells fail for a reason that was ours — and was cancelled by hand at roughly 47 of 72 cells, minutes ahead of the publish job. The fixes existed, reviewed, on an open PR. The cron could neither know that nor be told, and cancelling required somebody to be watching at the right moment. Nobody was; it came up in conversation by luck.

gh variable set EVALS_PUBLISH --body false    # hold publishing
gh variable delete EVALS_PUBLISH              # resume

The matrix still runs and still uploads artifacts. A held run is still worth running — the transcripts are where every product finding has come from, and the scoreboard has produced none.

A variable rather than a secret: it is configuration, it should be visible in the run log, and someone reading a skipped publish should be able to see why without repository admin.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Nt2Zgjw7STjrnFXYKRRVAA