Repair RF3 bootstrap admission and retain native test identity

Author: KSemenenko

.github/workflows/build-and-tests.yml

@@ -116,6 +116,16 @@ jobs:
       - name: Build KeyLoad
         id: build
         run: dotnet build KeyLoad.slnx --no-restore --configuration Release
+      - name: Prepare native source and test-image identity receipts
+        id: native-source-identity
+        if: ${{ !cancelled() && steps.build.outcome == 'success' }}
+        shell: pwsh
+        run: |
+          $root = $env:GITHUB_WORKSPACE
+          $evidence = Join-Path $root 'TestResults/native-source-identity'
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.production-source-manifest.ps1 `
+            -Mode prepare -Root $root -EvidenceRoot $evidence
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Verify the pinned native full-text package
         run: |
           node --input-type=module <<'JS'
@@ -175,6 +185,15 @@ jobs:
       - name: Test recovery after process crashes
         if: ${{ !cancelled() && steps.build.outcome == 'success' }}
         run: node scripts/Features/TestInfrastructure/run-tests.mjs --KeyLoadTests:Suite=recovery --KeyLoadTests:ReportTrx=true
+      - name: Verify native source and test-image identity receipts
+        if: ${{ !cancelled() && steps.build.outcome == 'success' && steps.native-source-identity.outcome == 'success' }}
+        shell: pwsh
+        run: |
+          $root = $env:GITHUB_WORKSPACE
+          $evidence = Join-Path $root 'TestResults/native-source-identity'
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.production-source-manifest.ps1 `
+            -Mode verify -Root $root -EvidenceRoot $evidence
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Save test results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()

README.md

@@ -337,13 +337,14 @@ KL-075 now has its first scaling source stage; six-node, open-loop, shard-skew,
 fanout, recovery and movement acceptance remains open. The joined stage has
 passed the local Release build with zero analyzer errors and warnings. The current
 native process-recovery suite passed **235/235**, with no skips. The latest full
-uninstrumented unit report, before the ANN test-scheduling correction, passed
-**2,762/2,763**, with one ANN construction deadline failure and no skips.
-Complete normal/scalar reruns and delivered-source Linux qualification remain
-open. The [original Linux source788 run](docs/implementation/runtime-qualification-37349838022.json)
-passes the official MCP SDK guidance case but fails the complete RF3 and release
-gates. [Checkpoint evidence](docs/implementation/partition-runtime-development-2026-10-05.json)
-keeps those failures and the remaining scalar, recovery, RF3 and scale gates explicit.
+uninstrumented unit report passed **2,763/2,763**. The [original Linux run at
+876c5237](https://github.com/managedcode/KeyLoad/actions/runs/37546085722)
+also passed normal and scalar **2,763/2,763** and recovery **235/235** without skips.
+The subsequent RF3 bootstrap admission and membership-image assertion fixes pass
+the local Release build and focused normal/scalar tests; their complete current-source
+reruns remain open. RF3, functional coverage, scale and release qualification remain
+open. The [implementation status](docs/implementation/status.json) records each
+source and report boundary.
 
 Functional coverage excludes load/comparison runs and admits complete operation
 flows only. The current Query profile binds exactly 25 named cases and 103 source

docs/ADR/ADR-005-canonical-keyspace-codec.md

@@ -106,3 +106,22 @@ normal/scalar suites at2889/2889 each, recovery228/228 and1000 unique actual
 atomic process cuts. Literal fractional decimal goldens pass under invariant
 and custom-sign cultures. Exact delivered-source Linux/RF3 originals, endurance,
 power-loss and measured acceleration remain separate required gates.
+
+TASK-KEYCODEC-NATIVE-IDENTITY makes the existing exact-source Linux review
+concrete. The Build and Tests `verify` job prepares the unchanged native
+CodeQuality production-source manifest and test-image sidecars immediately
+after its Release solution build, runs the original normal/scalar/full-recovery
+commands, then verifies those same receipts and uploads them with the original
+reports. Root freezes and reviews this contract; the workflow owner changes only
+`.github/workflows/build-and-tests.yml` and joins on the existing
+`functional-coverage.production-source-manifest.ps1` prepare/verify calls. Review
+the 33 owned KL-007 source rows and original source/run/attempt/artifact provenance
+against the executed UnitTests and RecoveryTests DLL/PDB hashes, MVID,
+portable-PDB and compiler-source identities from that same build. A different
+job's rebuilt images cannot establish this binding. This adds no schema, binary
+archive, format change, test subset or new acceptance prerequisite. All18 mapped
+normal/scalar cases and the original unfiltered recovery stage must pass; other
+failures remain visible and RF3/endurance/power-loss gates remain separate.
+Verification comprises the existing native source-ownership regressions,
+workflow static checks, and the original Linux artifacts. Rollback removes only
+the additive workflow receipt steps; no storage or runtime rollback is needed.

docs/ADR/ADR-042-admission-resource-ownership.md

@@ -95,3 +95,29 @@ actual configured Linux GitHub gates.
 
 Primary guidance: [CA2000 ownership transfer](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2000)
 and [async disposal](https://learn.microsoft.com/en-us/dotnet/standard/garbage-collection/implementing-disposeasync).
+
+## Physical catalog startup control admission
+
+TASK-ADM-CATALOG-BOOTSTRAP implements the ResourceExecution refinement of
+REQ-RESOURCE-001 / AC-RESOURCE-001 and REQ-ADM-001 / AC-ADM-001. Original Linux
+run37541109923 rejects `BootstrapPhysicalShardCatalog` during node1 startup at
+`PhysicalShardCatalogStartup.SubmitBootstrapAsync`; its ordinary data ceiling is
+4,096 bytes, exactly the governor's envelope floor, and serialized bootstrap
+work cannot fit. Node2's subsequent unavailable-majority error is secondary.
+The initial catalog mutation must use the existing bounded control reserve.
+It remains administrator-authenticated, authorized and RF3 committed through
+the same unique request grain; no admission or credential bypass is introduced.
+
+Root freezes this contract, the worker changes only
+`src/KeyLoad.Core/Features/ResourceExecution/Commands/CommandAdmissionGovernor.cs`
+and its existing `CommandAdmissionGovernorTests.cs`, then root reviews and joins
+strict build/format, focused normal/scalar governor operations and the unchanged
+actual Aspire RF3 admission case. Add only the existing bootstrap operation kind
+to the reserved classifier; preserve every lane ceiling and shared replication
+or inbox consumer. The regression executes full data/control reserve,
+rejection, exact lease release and healthy reuse, rather than asserting the
+classifier result alone. Delivered qualification requires the original Linux
+SDK/control/RF3 flow; source or local governor success cannot establish it.
+No wire, storage, deployment, format or dependency change is needed. Rollback
+removes only this operation's classifier inclusion and its matching regression;
+the original startup failure remains unqualified until real execution passes.

docs/ADR/ADR-106-partition-owner-movement.md

@@ -222,3 +222,22 @@ integration, strict checks, original Linux RF3 evidence and commit. No stored-da
 an unmapped route or undisposed owner cannot be reported as delivered membership.
 
 Ownership movement and current same-view session tokens retain the contract in [ADR-017](ADR-017-ownership-session-tokens.md). Unknown or unverifiable lineage invalidates explicitly.
+
+## Native immutable-image oracle repair
+
+TASK-MEMBERSHIP-IMAGE-ORACLE implements the existing AC-MEMBERSHIP-006 pre-start
+identity check using pinned Aspire13.6.0 semantics. The native
+[`WithImageSHA256` implementation](https://github.com/dotnet/aspire/blob/v13.6.0/src/Aspire.Hosting/ContainerResourceBuilderExtensions.cs)
+stores its supplied digest unchanged and retains tag metadata; native
+[`TryGetContainerImageName`](https://github.com/dotnet/aspire/blob/v13.6.0/src/Aspire.Hosting/ApplicationModel/ResourceExtensions.cs)
+adds the `@sha256:` separator for the runtime reference. The accepted KeyLoad
+builder already supplies the unprefixed digest correctly. Repair only the
+existing test oracle's contradictory null-tag/prefixed-digest expectations.
+Root freezes this contract before the worker changes
+`tests/KeyLoad.IntegrationTests/Features/ClusterRouting/Assertions/TwoRf3MembershipImageAssertions.cs`;
+root reviews and joins strict build/format and the unchanged actual six-container
+startup, signed membership, closed-client and teardown flow. Require exact
+accepted repository/tag/digest metadata and exact resolved reference for all
+six nodes before Start. No new helper, image/provider replacement, deployment
+change, bound increase or omitted assertion is required. Rollback changes only
+the test expectation; actual Linux RF3 evidence remains required and unqualified.

docs/AGENTS.md

@@ -22,3 +22,7 @@
 - Read the [root policy](../AGENTS.md), [architecture map](Architecture.md), [RepositoryGovernance feature](Features/RepositoryGovernance.md), and [ADR-032](ADR/ADR-032-mcaf-governance.md) first.
 - This documentation module owns durable records for all canonical slices: `RepositoryGovernance`, `BenchmarkComparisons`, `DocumentStorage`, `EventStreams`, `Messaging`, `GraphTraversal`, `TimeSeries`, `Search`, `QueryExecution`, `Authorization`, `ChangeFeeds`, `StorageRecovery`, `ClusterReplication`, `ClusterRouting`, `ClientApi`, and `BackupRestore`.
 - Feature docs use `Features/<SliceName>.md`; architecture, implementation and ADR records remain under their existing global documentation roots.
+
+## Native TUnit entry, owner correction 2026-10-07
+- ADR-117 and the root's latest native-entry correction supersede the earlier outer AppHost test commands here. CI invokes native TUnit/Microsoft.Testing.Platform directly after build with Detailed output; C# fixtures own Aspire startup, readiness, discovered endpoints, real client workloads and joined cleanup. `scripts/Features/TestInfrastructure/run-tests.mjs` selects native arguments and environment only. Preserve every required suite, original report, exact-source Linux gate and development/qualification distinction.
+- The canonical current Build and Tests workflow is `.github/workflows/build-and-tests.yml`; historical `ci.yml` references above are not current dispatch instructions.

docs/Features/Authorization.md

@@ -11,6 +11,24 @@ the cluster control boundary is defined by [ADR-036](../ADR/ADR-036-orleans-foun
 | REQ-AUTH-002: public credential changes cannot disable or impersonate the cluster's membership authority | AC-AUTH-002: a persisted protected internal principal has no public API key; even an administrator cannot edit it or create a credential for it; revoking a public administrator does not revoke internal membership |
 | REQ-AUTH-003: internal authority can perform only its approved membership control operation | AC-AUTH-003: ordinary callers cannot submit Membership; the internal principal cannot submit data/security operations; real store outcomes preserve exact denial and unchanged effects |
 
+
+### Current unit case-to-acceptance crosswalk
+
+| Native case class | Existing requirement / acceptance | Evidence boundary |
+|---|---|---|
+| `ClusterPrincipalPolicyTests`, `ClusterPrincipalInitializationIntegrityTests` | REQ-AUTH-002 / AC-AUTH-002 | Protected internal-principal bootstrap/idempotence, public edit/credential denial, snapshot copy, and missing/modified/corrupt row rejection at an existing apply cut. This is local store/snapshot evidence, not quorum or RF3 proof. |
+| `ClusterPrincipalAuthorizationTests` | REQ-AUTH-003 / AC-AUTH-003 | Ordinary/public internal-membership denial, internal data/security denial, and internal membership after public-root revocation. |
+| `DocumentRowTenantMutationAuthorizationTests` | REQ-AUTH-005 / AC-AUTH-005, with the owning document boundary REQ-DSTORE-003 / AC-DSTORE-003 | Put/Patch/Delete cannot forge row owner or tenant. It does not cover all row-scoped read/query adapters. |
+| `DocumentFieldMutationAuthorizationTests`, `DocumentReplacementFieldAuthorizationTests`, `DocumentDeleteIndexAuthorizationTests` | REQ-AUTH-006 / AC-AUTH-006, with the owning document boundary REQ-DSTORE-003 / AC-DSTORE-003 | Persisted field-write and index-use grants are independently enforced on the tested mutation paths; this is not the complete adapter/lineage matrix. |
+| `ResourcePolicyUpdateTests`, `ResourcePolicyUpdateRejectionTests`, `ResourcePolicyUpdateVisibilityTests` | See the exact REQ-RPOL-001..004 mapping in [ResourcePolicyUpdates](Authorization/ResourcePolicyUpdates.md) | The unit cases map to RPOL-001/002/003; RPOL-004 remains the real SDK/MCP RF3 criterion. The blob-quota exclusion case is validator-only, not a store-apply flow. |
+
+`SignedEnvelopeTests` is physically under the Authorization test directory but
+is owned by InternalSerialization: map it only to REQ-IS-007 / AC-IS-007 in
+[InternalSerialization acceptance](InternalSerialization/Acceptance.md#requirements-and-acceptance).
+It is not evidence for public credential verification or persisted principal
+authorization.
+
+
 Slice map: new policy code `src/KeyLoad.Core/Features/Authorization/`; focused
 tests mirror `tests/KeyLoad.UnitTests/Features/Authorization/`. HTTP/MCP adapters
 remain ClientApi and invoke Orleans request grains. Principals/API keys remain

docs/Features/ClusterRouting/PartitionTransfer.md

@@ -52,10 +52,11 @@ above against actual ZoneTree/TestDatabase primitives, without mocks, fake view,
 skips or weakened limits. Preserve callbacks' borrowed lifetime. Root reviews
 the complete private packets, then executes Aspire normal/scalar tests.
 
-Complete ownership is a later root-owned stage. Current epoch7 outcome keys have
-no partition locator; their hash cannot recover one. Copying every global outcome
-or dropping outcomes is incorrect. Existing-store migration needs its exact
-accepted upgrade/rollback contract. Current persisted authorization remains
+Complete ownership is a later root-owned stage. Global control outcomes have no
+movable partition locator; their hash cannot recover one. Copying every global
+outcome or dropping outcomes is incorrect. The current product must preserve
+explicit partition-associated outcomes and shared control authority without a
+data conversion or alternate reader. Current persisted authorization remains
 authority and an acknowledged revocation must fence all serving groups. Source
 and destination group indexes are never directly comparable; explicit ownership
 epoch invalidation is the first candidate under KL-072, pending full freeze.
@@ -81,7 +82,7 @@ flowchart LR
     Page --> Later[Later complete ownership and fenced transfer]
 ```
 
-The accepted native epoch/outcome prerequisite is [TokenOwnershipLineage](TokenOwnershipLineage.md), REQ/AC-PMOVE-005..006 and REQ/AC-MTOKEN-001..004 under ADR-017. Its partition-associated locator is additive; global authority and old unknown-scope outcomes remain explicit complete-image blockers. Family pages or a locator alone do not authorize installation or cutover.
+The accepted native epoch/outcome prerequisite is [TokenOwnershipLineage](TokenOwnershipLineage.md), REQ/AC-PMOVE-005..006 and REQ/AC-MTOKEN-001..004 under ADR-017. Its partition-associated locator is part of the current product; shared global authority remains an explicit complete-image dependency. Family pages or a locator alone do not authorize installation or cutover.
 
 
 # Accepted Stage 1A: shared Orleans membership; later physical movement contracts
@@ -92,7 +93,7 @@ Related: [PartitionTransfer](PartitionTransfer.md), [PhysicalShardCatalog](Physi
 
 ## Scope and source-backed boundary
 
-The original plan requires controlled copy/catch-up/barrier/switch/cleanup (KL-036), whole atomic partitions with generation readiness and restartable cleanup (KL-071), and either a supported old-token invalidation or correct lineage translation without comparing independent log positions (KL-072). Current contracts intentionally stop before those operations: AC-PMOVE-004 forbids an installer, `AtomicPartitionPlacementV1` only resolves to the single committed `DefaultShard`, `PhysicalShardCatalog` only boots epoch 1, and AC-MTOKEN-004 explicitly excludes epoch bump/cross-group cutover. This proposal is a new movement contract; it does not reclassify current PMAP, bounded pages, token issuance, outcome association or prior-frame compatibility as movement. Source anchors: `docs/design/architecture-v0.3.uk.md` §§4, 6, 28 and KL-036/071/072; `docs/ADR/ADR-016-atomic-physical-placement.md` §§1–5; `docs/ADR/ADR-017-ownership-session-tokens.md`; current `PhysicalShardCatalog`/`AtomicPartitionPlacement` and `PartitionTransfer` contracts.
+The original plan requires controlled copy/catch-up/barrier/switch/cleanup (KL-036), whole atomic partitions with generation readiness and restartable cleanup (KL-071), and either pre-movement token invalidation or correct lineage translation without comparing independent log positions (KL-072). Current contracts intentionally stop before those operations: AC-PMOVE-004 forbids an installer, `AtomicPartitionPlacementV1` only resolves to the single committed `DefaultShard`, `PhysicalShardCatalog` only boots epoch 1, and AC-MTOKEN-004 explicitly excludes epoch bump/cross-group cutover. This proposal is a new movement contract; it does not reclassify current PMAP, bounded pages, token issuance, outcome association or current-frame recovery as movement. Source anchors: `docs/design/architecture-v0.3.uk.md` §§4, 6, 28 and KL-036/071/072; `docs/ADR/ADR-016-atomic-physical-placement.md` §§1–5; `docs/ADR/ADR-017-ownership-session-tokens.md`; current `PhysicalShardCatalog`/`AtomicPartitionPlacement` and `PartitionTransfer` contracts.
 
 Stable identity remains the complete four-field `PartitionRef` / `AtomicPartitionId`. Physical shard identity remains a separate opaque ID for an independently configured RF3 replica group. A node-local `PartitionHost` owns its canonical ZoneTree store, replica log, file locks, materializer and apply gate. Orleans activation migration changes no physical ownership. Replica voters and Orleans silos are not separate logical shards.
 
@@ -361,3 +362,21 @@ transport/test ownership, and root owns integration and native evidence.
 There is no data/wire migration. Rollback disables the explicit profile and
 cannot retain an unmapped authority handler or abandoned disposable owner as a
 working six-node implementation.
+
+### Native immutable-image oracle repair
+
+TASK-MEMBERSHIP-IMAGE-ORACLE repairs the pre-start test oracle for the existing
+AC-MEMBERSHIP-006. `RuntimeContainerImage.Add` supplies the accepted tag and the
+64-character digest separately to native Aspire13.6.0. Its image annotation
+retains the tag and stores the digest without the `sha256:` prefix; the native
+resolved reference uses `repository@sha256:digest`. The current test's null-tag
+and prefixed-annotation assertions reject that valid pinned configuration before
+any of the six resources starts. Require the exact accepted repository, tag and
+digest metadata plus exact native resolved reference on all six resources;
+retain the existing fail-before-start mismatch behavior and actual six-container
+startup, signed membership, closed public calls and joined teardown. The patch
+owns only `TwoRf3MembershipImageAssertions.cs`; no image construction, profile,
+credential, topology, timeout or production behavior changes. Root freezes and
+reviews the contract, the worker prepares the guarded correction, and root joins
+strict build/format plus the existing exact-source Linux RF3 case. Source review
+alone does not qualify membership. Rollback restores only the prior test oracle.