This commit is contained in:
2026-05-14 23:30:34 +03:00
parent 26cb65e936
commit 04c46042d9
239 changed files with 34102 additions and 438 deletions
@@ -1250,6 +1250,162 @@ then reports the expected next event window without mailbox reads, drains, acks,
or consumer cursor mutation. The live smoke is
`scripts/fabric/c19z1-remote-workspace-mailbox-preflight-smoke.ps1`.
C19Z2 adds telemetry for mailbox preflight checks. Workload status and heartbeat
reports now expose preflight totals, ack/checkpoint split counters, and the last
preflight cursor/window fields so diagnostics can distinguish handoff checks
from mailbox reads. The live smoke is
`scripts/fabric/c19z2-remote-workspace-mailbox-preflight-telemetry-smoke.ps1`.
C19Z3 adds stale-cursor diagnostics to mailbox preflight. If a consumer cursor
falls behind retained mailbox events after bounded-mailbox drops, preflight
reports retained sequence bounds, `stale_cursor`, `diagnostic_state`, and
`missing_dropped_count`; the latest stale state is also visible in telemetry and
readiness diagnostics. The live smoke is
`scripts/fabric/c19z3-remote-workspace-mailbox-stale-preflight-smoke.ps1`.
C19Z4 adds action hints to mailbox preflight diagnostics. Stale cursor gaps now
return `recommended_action=reset_consumer_and_resync` plus hints to reset the
consumer cursor, request full adapter resync, and resume from checkpoint after
resync. The live smoke is
`scripts/fabric/c19z4-remote-workspace-mailbox-preflight-action-hints-smoke.ps1`.
C19Z5 adds provenance for the selected preflight action. Responses, telemetry,
and readiness diagnostics include `action_reason` and structured
`action_context` with cursor, retained sequence bounds, dropped/missing counts,
and expected window values. The live smoke is
`scripts/fabric/c19z5-remote-workspace-mailbox-preflight-provenance-smoke.ps1`.
C19Z6 adds the operator-facing summary for mailbox preflight. Responses,
telemetry, and readiness diagnostics include `operator_summary` plus compact
`operator_summary_fields` for the diagnostic state, selected action, reason,
cursor, retained bounds, and expected window counters. The live smoke is
`scripts/fabric/c19z6-remote-workspace-mailbox-preflight-summary-smoke.ps1`.
C19Z7 adds machine-sortable operator severity for mailbox preflight. Responses,
telemetry, readiness diagnostics, and summary fields expose `operator_status`
and `operator_severity`, classifying ready windows, caught-up cursors, and
stale cursor gaps without parsing summary text. The live smoke is
`scripts/fabric/c19z7-remote-workspace-mailbox-preflight-severity-smoke.ps1`.
C19Z8 adds the grouped readiness rollup for mailbox preflight. The readiness
diagnostic keeps the flat fields and adds `last_preflight` with observed time,
cursor, counts, diagnostic state, action hints/provenance, operator summary,
status, severity, and summary fields. The live smoke is
`scripts/fabric/c19z8-remote-workspace-mailbox-preflight-rollup-smoke.ps1`.
C19Z9 adds retained-window detail to that preflight rollup. The grouped
`last_preflight` readiness object includes first/last retained sequence and
mailbox dropped total so stale cursor explanations are visible without opening
the raw preflight response. The live smoke is
`scripts/fabric/c19z9-remote-workspace-mailbox-preflight-retained-window-smoke.ps1`.
C19Z10 adds a structured remediation checklist to that rollup. The grouped
`last_preflight.remediation_checklist` entries expose required/satisfied
operator steps derived from action hints, including cursor reset, full adapter
resync, and resume after resync for stale cursor gaps. The live smoke is
`scripts/fabric/c19z10-remote-workspace-mailbox-preflight-checklist-smoke.ps1`.
C19Z11 adds checklist status and counts to that rollup. The grouped
`last_preflight` readiness object exposes `remediation_checklist_status` and
total/required/satisfied/pending counts for admin UI summaries. The live smoke
is
`scripts/fabric/c19z11-remote-workspace-mailbox-preflight-checklist-status-smoke.ps1`.
C19Z12 adds session-level preflight operator status/severity counters.
Readiness exposes status and severity count maps, mirrored in `last_preflight`,
so repeated resync-required/warn preflights are visible without retaining a
history log. The live smoke is
`scripts/fabric/c19z12-remote-workspace-mailbox-preflight-status-counts-smoke.ps1`.
C19Z13 adds compact preflight attention status on top of those counters.
Readiness and `last_preflight` expose `preflight_attention_status` so admin UI
can sort clean, attention-needed, and repeated-resync sessions without
interpreting count maps. The live smoke is
`scripts/fabric/c19z13-remote-workspace-mailbox-preflight-attention-smoke.ps1`.
C19Z14 proves the repeated-resync attention branch. Unit and live smoke coverage
perform multiple stale preflights on one active adapter session and verify
`preflight_attention_status=repeated_resync_required` with repeated
resync-required/warn counters. The live smoke is
`scripts/fabric/c19z14-remote-workspace-mailbox-preflight-repeated-attention-smoke.ps1`.
C19Z15 adds the preflight attention reason. Readiness and `last_preflight`
expose `preflight_attention_reason` beside the attention status, explaining
clean, attention-needed, and repeated-resync states without UI-side counter
parsing. The live smoke is
`scripts/fabric/c19z15-remote-workspace-mailbox-preflight-attention-reason-smoke.ps1`.
C19Z16 completes focused proof coverage for those attention reasons. Unit tests
cover clean, single-resync, repeated-resync, and no-preflight mappings; live
smoke proves the single stale-preflight reason. The live smoke is
`scripts/fabric/c19z16-remote-workspace-mailbox-preflight-attention-reason-coverage-smoke.ps1`.
C19Z17 adds the preflight diagnostics contract marker. The readiness
`last_preflight` rollup includes `diagnostics_schema_version` and
`diagnostics_contract` entries for retained-window, remediation-checklist,
attention, and operator-count fields, allowing UI rendering to be gated safely.
The live smoke is
`scripts/fabric/c19z17-remote-workspace-mailbox-preflight-contract-smoke.ps1`.
C19Z18 adds boolean diagnostics feature flags to the same preflight rollup.
`last_preflight.diagnostics_features` now exposes retained-window,
remediation-checklist, attention, and operator-count support directly, so admin
UI and automation can gate each diagnostics group without scanning the contract
list. The live smoke is
`scripts/fabric/c19z18-remote-workspace-mailbox-preflight-feature-flags-smoke.ps1`.
C19Z19 proves compatibility between the two diagnostics contract forms. Unit
coverage and live smoke verify that workload and telemetry reports expose both
the string `diagnostics_contract` entries and matching boolean
`diagnostics_features` flags for every preflight diagnostics group. The live
smoke is
`scripts/fabric/c19z19-remote-workspace-mailbox-preflight-contract-compatibility-smoke.ps1`.
C19Z20 proves the no-preflight readiness shape. Before any mailbox preflight is
observed, active adapter sessions expose `preflight_attention_status=unknown`,
`preflight_attention_reason=no_preflight_observed`, zero session preflight
count, and no grouped `last_preflight` rollup. The live smoke is
`scripts/fabric/c19z20-remote-workspace-mailbox-preflight-absence-smoke.ps1`.
C19Z21 proves the no-active-session readiness shape. After closing the active
adapter session, readiness exposes idle/not-ready state, zero active sessions,
no active `adapter_session_id`, no grouped `last_preflight`, and terminal
`last_session_state=closed` from the terminal-session ledger. The live smoke is
`scripts/fabric/c19z21-remote-workspace-no-active-session-readiness-smoke.ps1`.
C19Z22 proves terminal-state readiness for `expire` and `reset` controls. The
same no-active-session readiness shape now reports
`last_session_state=expired` or `last_session_state=reset` from the
terminal-session ledger. The live smoke is
`scripts/fabric/c19z22-remote-workspace-terminal-state-readiness-smoke.ps1`.
C19Z23 adds grouped terminal-session summary metadata to no-active-session
readiness. `terminal_session_summary` carries adapter session id, terminal
state, reason, and control timestamp so admin UI can render the terminal cause
without stitching flat fields. The live smoke is
`scripts/fabric/c19z23-remote-workspace-terminal-session-summary-smoke.ps1`.
C19Z24 adds the terminal-session summary contract marker. The grouped summary
now carries schema version
`rap.remote_workspace_adapter_terminal_session_summary.v1` and a
summary-contract field list for explicit UI gating. The live smoke is
`scripts/fabric/c19z24-remote-workspace-terminal-summary-contract-smoke.ps1`.
C19Z25 adds boolean `summary_features` to the same grouped terminal-session
summary, covering adapter session id, state, reason, and control timestamp. The
live smoke is
`scripts/fabric/c19z25-remote-workspace-terminal-summary-features-smoke.ps1`.
C19Z26 proves compatibility between `summary_contract` and `summary_features`
for the grouped terminal-session summary in workload and telemetry reports. The
live smoke is
`scripts/fabric/c19z26-remote-workspace-terminal-summary-compatibility-smoke.ps1`.
C19Z27 proves the absence shape for terminal-session summary. Before any adapter
session or terminal history exists, readiness reports `waiting_for_session` and
does not include `terminal_session_summary`. The live smoke is
`scripts/fabric/c19z27-remote-workspace-terminal-summary-absence-smoke.ps1`.
Includes:
- container/native workload contract
@@ -1671,9 +1827,234 @@ with synthetic traffic only. C18 defines the VPN/IP tunnel service target model
authorize VPN/IP tunnel runtime. C18A adds the VPN/IP tunnel control-plane
data model and platform-admin skeleton only. C18B hardens single-active
lease/fencing semantics. C18C adds node-agent desired-state/status reporting
for scoped VPN assignments only. C19 is now reserved for the Version
Storage/Update Repository and node-agent update/rollback foundation; it is not
implemented by this document. No RDP, data-plane, VPN runtime, production
relay, production mesh service traffic, node-agent VPN execution, host
networking, service workload runtime, or production updater behavior is implied
by this document.
for scoped VPN assignments only. C19 Remote Workspace adapter probe layers are
still node-local and probe-only; through C19Z30, fresh no-session runtime
readiness exposes a grouped `no_session_summary` contract plus
`summary_features`, with compatibility proof across workload and telemetry,
while terminal-history readiness exposes `terminal_session_summary` and omits
`no_session_summary`; summary exclusivity is proven across fresh, active, and
terminal readiness states, and a compact readiness state matrix artifact exists
for admin/runtime handoff. C19Z34 records the explicit probe-to-runtime gates
and confirms Remote Workspace still has no production payload traffic. C19Z35
adds the disabled-by-default real-adapter supervision status scaffold without
enabling real adapter execution. C19Z36 proves that scaffold's env/status/
guardrail compatibility. C19Z37 adds sanitized config projection for the future
real adapter while still refusing activation and payload traffic. C19Z38 proves
that projection for both default/empty and requested config shapes. C19Z39 adds
an explicit blocked activation decision contract with required/missing gates.
C19Z40 adds a compact handoff report proving scaffold/projection/decision
alignment for requested and default node config.
C19Z41 adds explicit feature flags for those real-adapter supervision fields.
C19Z42 folds those feature flags into the compact handoff report for
admin/runtime handoff.
C19Z43 proves contract-probe precedence when real-adapter supervision is also
requested in desired workload config.
C19Z44 proves the real-adapter-only desired workload path remains degraded and
blocked.
C19Z45 adds a compact desired-workload mode matrix for probe-only,
real-adapter-only, and combined requested modes.
C19Z46 adds compatibility proof for the mode matrix row contract.
C19Z47 adds a disabled process-supervisor preconditions contract for future
external RDP worker supervision.
C19Z48 proves that contract across requested/default config shapes.
C19Z49 folds process-supervisor preconditions into the compact handoff report.
C19Z50 folds process-supervisor preconditions into the desired-workload mode
matrix.
C19Z51 proves the mode matrix v2 row contract.
C19Z52 adds a disabled process-health-probe contract for future external RDP
worker supervision.
C19Z53 proves that process-health-probe contract across requested/default
status forms.
C19Z54 folds process-health-probe visibility into the compact real-adapter
handoff report.
C19Z55 folds process-health-probe visibility into the desired-workload mode
matrix.
C19Z56 proves the mode matrix v3 row contract.
C19Z57 adds a compact disabled real-adapter readiness/handoff checklist.
C19Z58 proves the readiness/handoff summary and checklist contract.
C19Z59 adds a disabled real-adapter operator action map.
C19Z60 proves the disabled real-adapter operator action map contract.
C19Z61 adds a compact disabled real-adapter admin handoff bundle.
C19Z62 proves the disabled real-adapter admin handoff bundle contract.
C19Z63 adds compact disabled real-adapter admin handoff digest rows.
C19Z64 proves the disabled real-adapter admin handoff digest row contract.
C19Z65 adds a disabled real-adapter admin handoff digest rollup.
C19Z66 proves the disabled real-adapter admin handoff digest rollup contract.
C19Z67 adds a disabled real-adapter admin handoff full-chain summary.
C19Z68 proves the disabled real-adapter admin handoff full-chain summary
contract.
C19Z69 adds a disabled real-adapter admin handoff release marker.
C19Z70 proves the disabled real-adapter admin handoff release marker contract.
C19Z71 adds a final contract-only package index for the disabled real-adapter
admin handoff chain.
C19Z72 proves the final package index contract for the disabled real-adapter
admin handoff chain.
C19Z73 adds a contract-only runtime gate phase boundary for the next disabled
real-adapter preflight phase.
C19Z74 proves the runtime gate phase boundary contract.
C19Z75 adds a disabled real-adapter runtime gate preflight checklist with all
items still blocking runtime.
C19Z76 proves the disabled real-adapter runtime gate preflight checklist
contract.
C19Z77 adds a disabled real-adapter runtime gate preflight status summary.
C19Z78 proves the disabled real-adapter runtime gate preflight status summary
contract.
C19Z79 adds disabled real-adapter runtime gate preflight action hints.
C19Z80 proves the disabled real-adapter runtime gate preflight action hints
contract.
C19Z81 adds a disabled real-adapter runtime gate preflight operator handoff
bundle.
C19Z82 proves the disabled real-adapter runtime gate preflight operator handoff
bundle contract.
C19Z83 adds a disabled real-adapter runtime gate preflight release marker.
C19Z84 proves the disabled real-adapter runtime gate preflight release marker
contract.
C19Z85 adds a disabled real-adapter runtime gate preflight package index.
C19Z86 proves the disabled real-adapter runtime gate preflight package index
contract.
C19Z87 adds a disabled real-adapter runtime gate preflight closeout summary.
C19Z88 proves the disabled real-adapter runtime gate preflight closeout summary
contract.
C19Z89 starts the explicit real-adapter runtime gate enablement phase with a
contract-only request that remains blocked pending validation.
C19Z90 proves the explicit real-adapter runtime gate enablement request
contract.
C19Z91 adds contract-only operator confirmation validation while keeping the
runtime gate blocked pending remaining validations.
C19Z92 proves the operator confirmation validation contract.
C19Z93 adds contract-only binary validation while keeping the runtime gate
blocked pending remaining validations.
C19Z94 proves the binary validation contract.
C19Z95 adds contract-only permission validation while keeping the runtime gate
blocked pending remaining validations.
C19Z96 proves the permission validation contract.
C19Z97 adds contract-only supervisor validation while keeping the runtime gate
blocked pending remaining validations.
C19Z98 proves the supervisor validation contract.
C19Z99 adds contract-only health probe validation while keeping the runtime gate
blocked pending payload gate validation.
C19Z100 proves the health probe validation contract.
C19Z101 adds contract-only payload gate validation with no remaining required
validations while keeping runtime not enabled.
C19Z102 proves the payload gate validation contract.
C19Z103 adds the runtime gate validation closeout while keeping explicit
operator enablement required.
C19Z104 proves the runtime gate validation closeout contract.
C19Z105 adds an operator enablement readiness package while keeping runtime
disabled by default.
C19Z106 proves the operator enablement readiness package contract.
C19Z107 adds an operator enablement readiness release marker while keeping
runtime disabled by default.
C19Z108 proves the operator enablement readiness release marker contract.
C19Z109 adds an operator enablement readiness package index while keeping
runtime disabled by default.
C19Z110 proves the operator enablement readiness package index contract.
C19Z111 adds an operator readiness closeout summary while keeping runtime
disabled by default.
C19Z112 proves the operator readiness closeout summary contract.
C19Z113 adds an operator review decision request while keeping runtime disabled
by default.
C19Z114 proves the operator review decision request contract.
C19Z115 adds an operator decision status summary while keeping runtime disabled
by default.
C19Z116 proves the operator decision status summary contract.
C19Z117 adds an operator approval/rejection outcome contract with the outcome
not approved and runtime disabled by default.
C19Z118 proves the operator approval/rejection outcome contract.
C19Z119 adds an operator outcome closeout/reopen boundary while keeping runtime
disabled by default.
C19Z120 proves the operator outcome closeout/reopen boundary contract.
C19Z121 adds a not-approved outcome release marker while keeping runtime
disabled by default.
C19Z122 proves the not-approved outcome release marker contract.
C19Z123 adds a not-approved outcome package index while keeping runtime disabled
by default.
C19Z124 proves the not-approved outcome package index contract.
C19Z125 adds a not-approved outcome closeout summary while keeping runtime
disabled by default.
C19Z126 proves the not-approved outcome closeout summary contract.
C19Z127 adds a final not-approved outcome release marker while keeping runtime
disabled by default.
C19Z128 proves the final not-approved outcome release marker contract.
C19Z129 adds a final not-approved outcome package index/archive marker while
keeping runtime disabled by default.
C19Z130 proves the final not-approved outcome package index/archive marker
contract.
C19Z131 adds a not-approved outcome archive closeout manifest while keeping
runtime disabled by default.
C19Z132 proves the not-approved outcome archive closeout manifest contract.
C19Z133 adds a stopped-branch sentinel for the not-approved outcome while
keeping runtime disabled by default.
C19Z134 proves the not-approved outcome stopped-branch sentinel contract.
C19Z135 adds a no-continuation guard for the stopped not-approved outcome while
keeping runtime disabled by default.
C19Z136 proves the not-approved outcome no-continuation guard contract.
C19Z137 adds continuation block enforcement for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z138 proves the not-approved outcome continuation block enforcement
contract.
C19Z139 adds a continuation block audit record for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z140 proves the not-approved outcome continuation block audit record
contract.
C19Z141 adds a continuation block audit rollup for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z142 proves the not-approved outcome continuation block audit rollup
contract.
C19Z143 adds an operator stop summary for the stopped not-approved outcome
while keeping runtime disabled by default.
C19Z144 proves the not-approved outcome operator stop summary contract.
C19Z145 adds an operator stop handoff for the stopped not-approved outcome
while keeping runtime disabled by default.
C19Z146 proves the not-approved outcome operator stop handoff contract.
C19Z147 adds an operator stop handoff digest for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z148 proves the not-approved outcome operator stop handoff digest contract.
C19Z149 adds an operator stop status snapshot for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z150 proves the not-approved outcome operator stop status snapshot contract.
C19Z151 adds an operator stop status snapshot index for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z152 proves the not-approved outcome operator stop status snapshot index
contract.
C19Z153 adds an operator stop status catalog for the stopped not-approved
outcome while keeping runtime disabled by default.
C19Z154 proves the not-approved outcome operator stop status catalog contract.
C19Z155 adds an operator stop status catalog release marker for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z156 proves the not-approved outcome operator stop status catalog release
marker contract.
C19Z157 adds an operator stop status catalog package index for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z158 proves the not-approved outcome operator stop status catalog package
index contract.
C19Z159 adds an operator stop status catalog closeout summary for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z160 proves the not-approved outcome operator stop status catalog closeout
summary contract.
C19Z161 adds an operator stop status final archive marker for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z162 proves the not-approved outcome operator stop status final archive
marker contract.
C19Z163 adds an operator stop status final archive manifest for the stopped
not-approved outcome while keeping runtime disabled by default.
C19Z164 proves the not-approved outcome operator stop status final archive
manifest contract.
C19Z165 adds a terminal-complete marker for the stopped not-approved outcome
factory while keeping runtime disabled by default.
C19Z166 proves the not-approved outcome factory terminal-complete contract.
C20Z1 opens a new explicit real-adapter enablement request while keeping
runtime disabled by default.
C20Z2 proves the new explicit real-adapter enablement request contract.
C20Z3 adds the operator validation intake for the new explicit request while
keeping runtime disabled by default.
C20Z4 completes the operator validation checklist contract while keeping
runtime disabled by default.
C20Z5 closes the operator validation chain contract while keeping runtime
disabled by default.
C20Z6 proves the C20 stage terminal-complete contract.
Version Storage/Update
Repository and node-agent update/rollback foundation are not implemented by
this document. No RDP, data-plane, VPN runtime, production relay, production
mesh service traffic, node-agent VPN execution, host networking, service
workload runtime, or production updater behavior is implied by this document.