Make ASI Git delivery support a formal versioned release

Sub-tickets

Activity

• coder03-mba-l-ca created · 11h ago
  parent=#4648
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Current mba-deploy-pod.sh force-pushes a fresh commit only to develop. Implement the ASI-approved formal branch/tag flow without breaking the DEV pod mirror. Preserve reproducible source/, npm lock and required schema/migration artifacts while excluding internal files and secrets. Done when a rehearsed candidate has a traceable commit, immutable tag, audited tree and ASI confirmation. No production promotion in this item.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Provide a reproducible formal Git release path, subject to MOVILBA-826's written ASI ruling. Deliver the approved complete source/dependency/schema/script tree at a traceable master commit and candidate tag, with audited file scope and commit-to-artifact identity. Keep the force-pushed develop DEV-pod mirror distinct from formal ASI handoff; it is not acceptance evidence. Verify the current GitLab migration and branch process with ASI before changing the delivery script.
• coder03-mba-l-ca progress · 9h ago
  DEV mirror packaging candidate 5c75a646: archive committed HEAD, copy root docs from same commit, strip internals, remove script commands that cannot run after strip. Exact local staged tree: npm ci/build rc0 and liveness HTTP 200; no ASI push, master/tag or later-environment claim. Scoped audit requested. Formal release flow remains pending MOVILBA-826.
• audit-mba-l-ca audited · 9h ago
  audit fail: audit-mba-l-ca | 2026-10-16 ART. Commit 5c75a646, DEV mirror only: diff review, bash -n, git show --check, shell negative control. No push/DB/deploy. npm/runtime, lint/typecheck not independently run; stopped on guard defect.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. Commit 5c75a646, DEV mirror only: diff review, bash -n, git show --check, shell negative control. No push/DB/deploy. npm/runtime, lint/typecheck not independently run; stopped on guard defect.","outcome":"fail","evidence":"Required-doc guard chains test -s README && test -s CHANGELOG && test -s UPGRADE. Under set -e, failure of a non-final AND operand does not abort: empty README/CHANGELOG can reach push. Independent bash -e negative control with empty /dev/null printed EMPTY_DOC_CHECK_DID_NOT_ABORT and exited 0. Syntax/diff checks passed. Use separate checks or explicit if/exit; test each document empty/missing and a nonempty positive. No formal-release or 828 completion verdict.","reportRef":null}

• coder03-mba-l-ca progress · 9h ago
  Corrected audit FAIL at 18da596f (parent 5c75a646): individual required-doc nonempty checks exit before push. Exact copied-block controls: nonempty reaches intercepted push; each of three empty and three missing docs exits rc1 without reaching it. bash -n/diff-check pass. Scoped re-review requested; no ASI push.
• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART. 18da596faa106590b98add1e123469ba869e89f5 document-gate delta only: diff, bash -n, git show --check, seven independent shell controls. No ASI push/DB/deploy; no independent npm/build/runtime rerun. Not formal-release or epic completion.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. 18da596faa106590b98add1e123469ba869e89f5 document-gate delta only: diff, bash -n, git show --check, seven independent shell controls. No ASI push/DB/deploy; no independent npm/build/runtime rerun. Not formal-release or epic completion.","outcome":"pass","evidence":"Extracted exact for/if gate from committed script. Nonempty three docs: rc0 and intercepted push marker reached. Each of README, CHANGELOG, UPGRADE separately empty and separately missing: all six rc1, explicit error, marker not reached. Fix resolves 5c75a646 fail-open AND-list defect. Clean working tree; syntax and diff checks pass. No additional concrete packaging blocker found in reviewed delta. Earlier staged npm ci/build/start evidence remains author-reported, not audit-executed; full-script external effects unexercised.","reportRef":null}

• coder03-mba-l-ca assigned · 9h ago
  coder04-mba-l-ca / coder
• coder03-mba-l-ca descriptionChanged · 9h ago
  was: After MOVILBA-826 confirms current ASI process, build a reproducible formal Git release distinct from the force-pushed develop DEV-pod mirror. Pin a clean source SHA, package the complete approved source/dependency/schema/script tree, then map exact sanitized delivery-tree hash to master commit/candidate tag and built image digest. Audit the delivered tree, including dirty/untracked contamination negative controls and whether its declared test commands still have their runners after stripping. No acceptance from internal-checkout tests alone. Resolve current GitLab branch policy before changing scripts; this item owns packaging, while MOVILBA-827 owns candidate-specific test/scan evidence.
• coder03-mba-l-ca progress · 9h ago
  Local docs/reference/tagging-convention.md describes internal Lezama versioning where 'tag' meant package.json/commit version and almost no Git tags; it also treats QA/HML as future, so it is not an ASI QA release mechanism. April ASI training instead explicitly describes a Git release-candidate tag supplied for ASI's image build, consistent with Ricci's new instruction. Existing mba-deploy-pod.sh fresh-git force-push to develop does not carry an internal Git tag. Resolve exact ASI repo commit/ref mapping in offline candidate before giving Ricci a tag; do not infer from internal v5.6.253 alone.
• coder03-mba-l-ca statusChanged · 9h ago
  Implementing offline reproducible QA candidate packaging from pinned source SHA; no tag creation, ASI push or deploy.
• coder03-mba-l-ca progress · 9h ago
  Coder04 identified safe offline candidate path: archive pinned source SHA ae3f279c, reuse DEV mirror sanitization with no dump, create local deterministic Git candidate with provenance and hash manifest; propose tag movilba-qa-v5.6.253-ae3f279c without creating/pushing it. Assigned implementation of pure shared packager/offline mode with no push/EventListener and negative controls. QA mode must not present DEV-only UPGRADE as QA instructions; final QA UPGRADE awaits db04 baseline/runbook. No external state changed.
• coder03-mba-l-ca progress · 9h ago
  Offline QA profile will copy committed docs/asi/UPGRADE-QA.md from the same pinned git archive to delivered root UPGRADE.md, failing if absent/empty. Current QA draft is untracked and deliberately excluded; final QA source SHA must be minted after QA instructions and DB runbook are committed. Candidate commit/tree SHA stays in external handoff manifest to avoid self-reference. DEV mirror retains docs/asi/UPGRADE.md.
• coder03-mba-l-ca progress · 9h ago
  Coder04 froze four-path offline packager candidate on ae3f279c: mba-deploy-pod.sh 36e1059f, tools/package-asi-source.sh 526974a6, tools/prepare-asi-qa.sh 81edfb07, tools/tests/asi-package.test.cjs cdeab393; patch /data-lezama/movilba/evidencia/MOVILBA-823/2026-10-16-offline-prepare.patch SHA256 cd040858. QA requires committed QA UPGRADE and explicit source SHA, omits dump, creates local deterministic candidate and proposed tag only; no remote action. DEV mirror intended unchanged. Single focused audit requested; no commit/push/deploy yet.
• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART. ae3f279c + four pins 36e1059f/526974a6/81edfb07/cdeab393. Offline tooling only:4 focused tests,77 source tests,typecheck,bash syntax,targeted CJS-aware lint,diff check. No ASI push/tag/deploy/DB; actual QA package/docs not approved.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. ae3f279c + four pins 36e1059f/526974a6/81edfb07/cdeab393. Offline tooling only:4 focused tests,77 source tests,typecheck,bash syntax,targeted CJS-aware lint,diff check. No ASI push/tag/deploy/DB; actual QA package/docs not approved.","outcome":"pass","evidence":"All four full hashes rechecked unchanged. Focused controls pass: committed-only content despite dirty/untracked source, deterministic candidate/tree/hash manifests, intercepted push/tag, DEV document selection, missing committed QA doc and source-internal output refusal. Independent mutant copying dirty source after archive fails rc1 with dirty replacement assertion. Source suite77/77; typecheck rc0; bash -n three scripts rc0. Tools ignored by normal ESLint: explicit no-ignore with Node globals and CJS no-require-imports disabled passes. Node24.22.0 vs declared24.14.1. QA draft untouched; source currently cannot prepare real QA until tools and UPGRADE-QA are committed. No actual package npm build or full DEV mirror execution in this round; helper/package review is not QA acceptance.","reportRef":null}

• coder03-mba-l-ca progress · 9h ago
  After scoped tooling PASS, identified labeling gap: external conditional MOVILBA-822 DB annex is not delivered from pinned source, so offline HANDOFF must explicitly say tagReady=false and list QA baseline/approved DB annex/QA-specific SQL as outstanding; historical PROD/DEV SQL must not be copied as QA executable. Coder04 repinning helper/prepare/test narrow delta; previous commit request held. DEV pod script unchanged, no remote action.
• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART. Readiness delta on ae3f279c: helper736dc91e/prepare da9b394b/test86d5b460; DEV script36e1059f unchanged. Focused6/6, readiness mutant, typecheck, targeted CJS lint, shell syntax/diff. No push/tag/deploy/DB; NOT TAG READY.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. Readiness delta on ae3f279c: helper736dc91e/prepare da9b394b/test86d5b460; DEV script36e1059f unchanged. Focused6/6, readiness mutant, typecheck, targeted CJS lint, shell syntax/diff. No push/tag/deploy/DB; NOT TAG READY.","outcome":"pass","evidence":"Exact full hashes checked. Missing annex stays draft; committed conditional annex is delivered and hashed but tagReady remains false; pending_qa_db_baseline/blockers emitted. Lezama path in UPGRADE rejected. Independent mutant tagReady=true makes assertions fail rc1. All6 current focused tests pass; typecheck and explicit Node/CJS-aware ESLint rc0; shell syntax/diff clean. Limit: path denylist checks UPGRADE/DB-HANDOFF only, not README/CHANGELOG or arbitrary broken links; not a complete accessibility/secret audit. No actual QA baseline/approved migration/package build validation. Prior source77/77 not rerun for this delta. Node24.22.0 versus declared24.14.1.","reportRef":null}

• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART. ae3f279c delta: helper7f8881fd/prepare4fa53a55/testaedbc7cf; DEV36e1059f unchanged. Focused7/7 plus committed-whitespace controls, typecheck, CJS-aware lint, syntax/diff. No push/tag/DB/deploy; tooling only, NOT TAG READY.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. ae3f279c delta: helper7f8881fd/prepare4fa53a55/testaedbc7cf; DEV36e1059f unchanged. Focused7/7 plus committed-whitespace controls, typecheck, CJS-aware lint, syntax/diff. No push/tag/DB/deploy; tooling only, NOT TAG READY.","outcome":"pass","evidence":"Full file hashes verified. Each missing committed QA document returns1 before output exists. Independent copied-fixture tests replaced both missing files with committed whitespace-only content: same rc1/no-output assertions pass. Seven focused controls green incl deterministic committed-only source, DEV profile, annex delivery, pending readiness and Lezama path rejection. Typecheck/targeted Node-CJS lint/bash syntax/diff pass. No repeat full source suite; no actual QA package build, baseline or DB plan approval. Path guard limited to UPGRADE/DB-HANDOFF. Node24.22.0 vs declared24.14.1.","reportRef":null}

• coder03-mba-l-ca progress · 9h ago
  Final precondition repin on ae3f279c: DEV script 36e1059f unchanged; QA helper 7f8881fd, prepare 4fa53a55, tests aedbc7cf; patch SHA256 27572bd4. Requires both committed nonblank QA UPGRADE and DB-HANDOFF before any output; copies DB annex from same archive and rejects Lezama-only refs. Handoff remains tagReady=false pending measured QA baseline. Earlier readiness PASS on superseded helper/prepare/test bytes is not a verdict for this final pin; narrow delta audit requested. No commit/push/tag/deploy.
• coder03-mba-l-ca commit · 9h ago
  Source commit 0512bc88 (parent ae3f279c) contains only the four audited offline packaging paths at SHA prefixes 36e1059f, 7f8881fd, 4fa53a55, aedbc7cf. Release clone has only two untracked QA docs; no remote push/tag/deploy. QA prepare still requires committed docs and reports tagReady=false pending baseline.
• coder03-mba-l-ca progress · 9h ago
  Offline ASI QA draft prepared from source a20ca849dab2ded5e58f4521d66f4b64f4dee595: local candidate commit 8d0e4fdad21cbed344d5974f5d7eea014e17b8a1, tree a7cd04c12ab2615c711cdecc78ddf7ec99187352; proposed tag not created/pushed. HANDOFF.json explicitly tagReady=false pending QA DB baseline/operator and approved SQL/no-migration decision. Local npm ci and build passed, liveness HTTP 200; Node engine mismatch and npm-reported 14 vulnerabilities need assessment. Evidence: /data-lezama/movilba/evidencia/MOVILBA-823/2026-10-16-qa-draft-a20ca849-local-build.md. Final artifact audit requested; no ASI deployment.
• audit-mba-l-ca audited · 9h ago
  audit fail: audit-mba-l-ca |2026-10-16 ART. Offline artifact8d0e4fda/treea7cd04c1/sourcea20ca849; HANDOFFa5e4d28b/manifest2da806cc/build-note2fa6236a. Tree/docs/provenance/path inspection only; no npm rerun,AS I image,QA DB,tag,push/deploy. NOT TAG READY.
  payload

  {"scope":"audit-mba-l-ca |2026-10-16 ART. Offline artifact8d0e4fda/treea7cd04c1/sourcea20ca849; HANDOFFa5e4d28b/manifest2da806cc/build-note2fa6236a. Tree/docs/provenance/path inspection only; no npm rerun,AS I image,QA DB,tag,push/deploy. NOT TAG READY.","outcome":"fail","evidence":"Concrete sanitization omission: tracked source/deploy-movilba-api-to-hostinger.sh invokes absent source/api-movilba-external/deploy-movilba-api-to-hostinger.sh. Also ships local-host systemd scripts/movilba-sync.service and .timer with /srv/movilba-web, local env path/user and scheduled external sync, outside described ASI S2I handoff. Strip unsupported wrapper/local operational units or explicitly justify intended delivery; do not execute them. Positive:445/445 manifest paths equal tracked files, checksum check succeeds, source bytes match source commit except intentional package.json transformation, root docs match reviewed hashes, clean tree/no tags/remotes/dump. Selected secret-pattern scan found only example DB URL placeholder; not exhaustive secret certification. Author reports14 npm vulnerabilities/Node mismatch; not independently assessed, remain readiness evidence gaps.","reportRef":null}

• audit-mba-l-ca audited · 9h ago
  audit fail: Sanitizer delta on a20ca849: helper 3f671162/test eb2770bd. Focused tests, HEAD-preimage control, shell syntax, diff, typecheck and strict lint. No candidate rebuild, push/tag/deploy or DB.
  payload

  {"scope":"Sanitizer delta on a20ca849: helper 3f671162/test eb2770bd. Focused tests, HEAD-preimage control, shell syntax, diff, typecheck and strict lint. No candidate rebuild, push/tag/deploy or DB.","outcome":"fail","evidence":"audit-mba-l-ca | 2026-10-16 12:13 ART. Functional delta PASS: current 7/7; unchanged HEAD sanitizer injected only into temporary fixtures gives 5 pass/2 fail, QA and DEV both retaining deploy-movilba-api-to-hostinger.sh. Current fixtures assert all three obsolete paths absent. bash -n and diff-check clean; pnpm typecheck rc0. Gate FAIL: pnpm lint:strict rc1, 8096 errors including unchanged public/vendor/scalar/api-reference-1.58.0.js and scripts/check-lockfile-consistency.mjs; not attributed to this two-file delta. Targeted default ESLint ignores CJS; forcing no-ignore yields incompatible CommonJS/global rules, not lint coverage. Node24.22.0 differs pinned24.14.1. Old offline artifact unchanged and still failed; requires rebuild after accepted source. No release-wide green claimed.","reportRef":null}

• coder03-mba-l-ca progress · 9h ago
  Artifact sanitizer delta helper3f671162/testeb2770bd passed focused 7/7 and preimage mutant failed 5/7 as intended. Audit overall gate remains FAIL because lint:strict has 8096 errors in unchanged vendored Scalar JS/scripts. PM permits only local two-file sanitizer commit; QA package/tag remain NOT READY. Lint baseline is tracked separately under MOVILBA-827, no waiver of release quality.
• audit-mba-l-ca audited · 9h ago
  audit pass: Corrected offline artifact only: candidate 39fe1e89/tree de400b38 from bb03646e. Compare prior artifact, three removals, manifest/checksums/docs/provenance. No source/DB/lint rerun, build, tag or deploy; NOT TAG READY.
  payload

  {"scope":"Corrected offline artifact only: candidate 39fe1e89/tree de400b38 from bb03646e. Compare prior artifact, three removals, manifest/checksums/docs/provenance. No source/DB/lint rerun, build, tag or deploy; NOT TAG READY.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-16 ART. Verified exact HEAD/tree and clean status. HANDOFF SHA0451f6e8 and manifest87c594cf match request. All442 manifest hashes match delivered files and tracked census exactly (prior445). Only deletions: source/deploy-movilba-api-to-hostinger.sh, source/scripts/movilba-sync.service, source/scripts/movilba-sync.timer. Only retained-file change: SOURCE-PROVENANCE.json updates source SHA and audited packager SHA. All other source/docs/package-lock bytes unchanged. No tags; tagReady=false. Corrects prior artifact unsupported-path FAIL only; overall strict-lint FAIL, dependency risks and QA baseline/readiness blockers remain. Local build of new candidate not exercised by audit.","reportRef":null}

• coder03-mba-l-ca progress · 9h ago
  Corrected offline QA draft from source bb03646e715784654b5fb203e5ae094688ad30b0: candidate commit 39fe1e896b95d499dd3cf34a1cead654d0894cd0/tree de400b384f8647a8065f77f330b3b7f4f650d932. Three unsupported host-only files absent. Exact candidate npm ci and build pass; Node mismatch and npm 14 affected entries persist. Artifact correction audit requested; lint:strict baseline still fails. HANDOFF tagReady=false; no tag/push/deploy. Evidence /data-lezama/movilba/evidencia/MOVILBA-823/2026-10-16-qa-draft-bb03646e-local-build.md.
• coder03-mba-l-ca verified · 9h ago
  Corrected offline artifact from bb03646e passed narrow audit: candidate commit 39fe1e896b95d499dd3cf34a1cead654d0894cd0, tree de400b384f8647a8065f77f330b3b7f4f650d932; all 442 manifest files verified, exactly three host-only paths removed, retained source/doc/lock unchanged except provenance identity. Exact candidate npm ci/build rc0. Lint:strict, dependency risk and QA DB baseline remain open; HANDOFF tagReady=false; no tag/push/deploy. Audit tag audit-mba-l-ca-mvb416gpv7et.
• audit-mba-l-ca audited · 7h ago
  audit pass: Exact local QA draft 035888c6/tree 94560f49 from source 6fb682df: 436 hashes, Git clean, package/docs pins, route HTTP. npm ci/build PM-run only; OIDC, QA DB/operator, ASI tag/deploy not exercised. NOT TAG READY.
  payload

  {"scope":"Exact local QA draft 035888c6/tree 94560f49 from source 6fb682df: 436 hashes, Git clean, package/docs pins, route HTTP. npm ci/build PM-run only; OIDC, QA DB/operator, ASI tag/deploy not exercised. NOT TAG READY.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-16 14:18 ART | HANDOFF a0703511 and SHA256SUMS 77a30ec0 match; sha256sum -c --status rc0, candidate tree/commit match. Local next start on built artifact: /api/v1, /api/v1/openapi.json, /api/docs, /api/postman, static collection and Scalar all 404; nested POST-only vehicle search GET 405; liveness/login 200. No forbidden docs/tools/dump paths in tracked tree. HANDOFF tagReady=false, QA DB baseline/operator and migration ruling pending. Local loopback auth emitted UntrustedHost, so OIDC not verified.","reportRef":null}

• audit-mba-l-ca audited · 6h ago
  audit pass: Staged ASI master tree 8feb4887 on local parent bd858083: source 9b9fd446 equals audited QA candidate; templates/database unchanged; 3 root doc mapping and DB-HANDOFF/provenance checked. Remote tip/tag, commit/push/deploy not exercised.
  payload

  {"scope":"Staged ASI master tree 8feb4887 on local parent bd858083: source 9b9fd446 equals audited QA candidate; templates/database unchanged; 3 root doc mapping and DB-HANDOFF/provenance checked. Remote tip/tag, commit/push/deploy not exercised.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-16 14:50 ART | Root README 6afa946d, CHANGELOG 3e1bb721, UPGRADE d386541a differ from audited candidate only by formal ASI 1.0.0 vs internal 5.6.254 mapping; staged docs diff-check rc0. DB-HANDOFF 0072b142 and provenance sourceCommit 6fb682df/packager95e5406f match audited candidate. Staged source tree 9b9fd446 exact, templates 2883bb15/database d564d0bc equal parent; only .gitkeep in database. Local HEAD and tracking asi/master bd858083. No remote configured in this worktree, so live master tip/tag 1.0.0 availability unverified; pre-push live readback required. Previous QA tag points to candidate 035888c6; designate 1.0.0 canonical to Ricci if published, do not move either tag. Full diff-check has inherited source whitespace, not reported green.","reportRef":null}