[Nickfost]

The standalone contract cannot prepare portable managed-image upgrades or replace a stale unused pending target safely. Adopt the actual reviewed merged engine 840fb9be8a1c69404a5eebcf17855eff13c6c928, and document the required engine, template, adopter and deployment sequence.

This selectively ports typed portable-image evidence, prior target enforcement for every controller, image-free preparation/bootstrap, image-only introduction and verified promotion. Existing standalone type, network/bridge and disabled-storage checks remain. Image identity semantics are a manual updater migration. Executor/deployer pins, published release records, the validation harness and optional workflow remain unchanged.

The import map preserves private policy, test corpora, required workflows, fleet and active evidence. For an established image-free predecessor, it explicitly permits the reviewed unused-pending cancellation/retarget transition with the necessary specification import. The actual complete predecessor and independently pinned supporting validator remain mandatory; selection, image introduction and unrelated fleet changes cannot accompany it.

Documentation impact: README, AGENTS and managed-image, updating, release and local-validation guides explain scalar identity, evidence preparation, import ownership, maintenance ordering, classic-parent protection, legacy idle blockers, listener diagnostics and actual scheduled reclamation. Tracking: #43 and #44. Engine sources: RandomDevelopment/ci-fleet#157, RandomDevelopment/ci-fleet#111, RandomDevelopment/ci-fleet#81 and RandomDevelopment/ci-fleet#158.

Complete exact-source validation passed on the supplied isolated VM with independently pinned executor 689c7c00deb0eebcb25f2284334a9f7168a25575, engine policy 840fb9be8a1c69404a5eebcf17855eff13c6c928 and reviewed suite/head 3b44aeb8c2658a20256a019f040f2f44002d4c14. Every command retained its 180-second limit.

• Upstream source 3b44aeb8c2658a20256a019f040f2f44002d4c14, tree f8ae338c44de8b6e5f11cffd18b8082d8e15df37, actual base/main 1cb5332166f9c4b7631a5a5ec7f0baeea0e7dc6a: all 11 stages passed. Exported bundle SHA256 9c50aac9836ffad26c48a4d36f45228c9e9f92fef0ac9b1edd3d05aba0153117; report SHA256 448a540f7651c1ffcd2efd7290335e68edd07b7a58850c6c73bc7ad98e4ee438.
• Strict initialized fictional adopter cbc1413c610aea342044529fd342626fe70e240f, tree c7498e159ff61e0f3a0d2b1b1e4a0c030b262525, genuine one-root zero base: all 11 stages passed. Exported bundle SHA256 f1abee95dfb55f0168e5a4c253e93aedaa9e5ee9e070530b7869a2f439de70e6; report SHA256 061807abac2ecc3c87f3271e9293445bc0dadfd0f1acd07ea7d445ca43524655. Its zero base does not apply to the real private predecessor.

Both bundles are exported and independently verified against every recorded stage-log hash, source/tree/base/suite/policy/executor identity and expected inventory. Expected and actual skips are empty. Upstream policy 109, updater 16, release 8 and harness 50/6/18/14 cases passed. Adopter validation additionally retained separate complete public and mapped candidate corpora and upstream-probe counterpart accounting, with no actual skips. The 50-case caller harness passed in 147.660s upstream and 149.729s in strict-adopter mode. Unit/process/cgroup cleanup, role admission, zero running containers and the protected executor manifest/hash were verified after each suite. No image prune, tag removal, fleet installation or hosted compute was used. Optional hosted jobs remain skipped and supply no acceptance evidence.

Current-head independent Codex review completed without findings. Earlier failed full attempts remain failed and retained: ebe configuration failure bundle SHA256 ba9dfbe25902d2875087c2e1ac2498e6717525200885332f12acaaba36429b14; 26dfaa harness-timeout bundle SHA256 a449951e4cff2aece69ba4e769f7c0facfae1a0f7155add9e44b4e113fb9696c. The final source corrects fictional managed-image evidence scope and retains fetched packs to reduce seed-copy work without dropping cases or raising deadlines.

No template release, private configuration import, host deployment, scheduled reclamation or listener operational acceptance is claimed. Those remain separate downstream gates under the documented ownership map.

---

Note

Medium Risk
Large changes to standalone rollout, bootstrap, and managed-image validation directly govern how adopters may change engine pins and evidence; mistakes could block legitimate upgrades or weaken transition guards until caught by tests.

Overview
Adopts merged ci-fleet 840fb9be8a1c69404a5eebcf17855eff13c6c928 as the ordinary-CI baseline and documents engine → template → adopter → deployment ordering, including PR157 maintenance and unused-pending preparation.

Managed-image identity is now runtime-source-driven: managed_images scalars are portable config digests when the source advertises portable_managed_image_ids, otherwise legacy opaque Docker IDs. template-compatibility.json adds managed_image_identity; fleet.schema.json, examples, and init.py use scalar wording and post-init evidence guidance. The template updater treats managed_images / managed_image_identity contract drift as a manual migration, not an automatic merge.

scripts/validate.py gains typed portable_managed_image_ids in rollout evidence, stricter manager bootstrap and image-policy introduction checks, evidence-only preparation (fleet unchanged), promotion from integrated pending sidecars for ordinary upgrades (including controllers without optional blocks), current bridge evidence in all CLI modes, and rejection of empty pending sidecars. scripts/local_validate.py fetches with --keep to reduce seed-copy work.

Docs (README, AGENTS, MANAGED-IMAGES, UPDATING, LOCAL-VALIDATION, RELEASE) and extensive test_policy.py / compatibility pins align with the new procedures and hash expectations.

^{Reviewed by Cursor Bugbot for commit 3b44aeb. Configure here.}

[Nickfost]

@codex review

Please review exact head ebe41394e42a78c5cfd7e89df0ba823cf26a9458 against actual main 1cb5332166f9c4b7631a5a5ec7f0baeea0e7dc6a. It adopts merged engine 840fb9be8a1c69404a5eebcf17855eff13c6c928 for template issues #43/#44.

Check portable scalar/capability typing, complete predecessor evidence for all controllers, image-free staging/activation/promotion, unused-pending cancellation/retarget guards and preserved standalone type/network/bridge/storage checks. Assess the updater manual-migration boundary and the documented import exception: unchanged complete fleet and explicit active evidence, only the reviewed pending preparation plus necessary specification files, independently pinned supporting trusted policy, no selection/image introduction/runtime promotion or unrelated policy change. Private corpora/harness/workflows and historical release/executor/deployer identities must survive import.

Development tests passed as recorded in the description. Full committed upstream and initialized-adopter VM suites remain pending the recovery owner's explicit slot release. The PR is draft and must not merge on optional skipped hosted jobs or the engine's separate full result.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T09:29:29.005802Z	3b44aeb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: ebe41394e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Nickfost]

@codex review

Please review exact successor 26dfaa29c35e25778d75168b76f415f7a5f09c4c. The full upstream suite on ebe failed configuration because managed-image host target-promotion rules were applied to the public fictional pin update from the actual 1cb predecessor. That failed bundle is retained; no base, test inventory or 180-second command budget was changed.

The correction uses the existing enforce_managed_images boundary for the two managed-image target-evidence branches in standalone validate_transition. Strict adopters retain exact prior-target promotion. Reporting/network predecessor checks remain active in both modes. The new CLI regression failed on ebe and passes now, covering non-strict public updates, strict refusal without evidence, strict acceptance with matching prior evidence, and optional-feature refusals in non-strict mode. All 109 policy tests, exact compatibility with five self-tests, actual 1cb fictional transition, strict configuration, docs/secret/convention checks passed locally.

Assess that this restores the documented fictional-fixture contract without weakening strict or optional-feature evidence. Core engine 840, executor 689 and deployer 689 pins are unchanged. Metadata/core hash and LOCAL-VALIDATION guidance are updated in the same commit. This head and its regenerated initialized-adopter input require their own complete isolated suites; the PR stays draft pending fresh review and full acceptance.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 26dfaa29c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Nickfost]

@codex review

Please review exact successor 3b44aeb8c2658a20256a019f040f2f44002d4c14. Since reviewed 26dfaa it adds only --keep to the shared initial Git fetch and documents retained packs. It changes no required test identities, histories, selected SHAs, capability validation, stage/seed manifests, isolation, executor pin or 180-second command deadline.

The 26dfaa full upstream run passed ten stages, then its 50-case local-validation harness exceeded 180 seconds. The verified failed bundle remains retained with SHA256 a449951e4cff2aece69ba4e769f7c0facfae1a0f7155add9e44b4e113fb9696c. Bounded timing measured all 50 case bodies at 179.141 seconds, leaving no process/setup margin. Two representative unchanged caller cases passed with packed fetches in 31.935 seconds versus 42.326 seconds with loose-object fetches. This is a performance correction in the owning clone helper, not a deadline increase or test reduction.

Verify that --no-tags, explicit complete histories, protected Git environment, no-hardlink restoration and full before/after manifest checks remain. Both full exact-source upstream and regenerated initialized-adopter suites are required on this head before merge. Strict adopter and non-strict optional-feature evidence guards from 26dfaa remain unchanged. PR45 stays draft.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 3b44aeb8c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 1d8f9803-01d1-40d0-80b9-be161ce55aef)