CI/source truth: validate merged registry-auth fix on default branch before runtime promotion

[reprewindai-dev]

Why this is open

PR #40 (fix(security): fail closed on missing production registry token) merged to main as 43effd8bac1b3ee7278d11514227641ac396548a even though its exact-head GitHub Actions gate never exposed executable install/test/build steps.

The source change is security-positive and should not be rolled back merely because verification is incomplete: it fail-closes registry registration outside explicit local/development/test environments and requires the Bearer scheme when CAPI_REGISTRY_TOKEN is configured.

Current verification state

• PR fix(security): fail closed on missing production registry token #40 exact head: 623baa8d0d338060f8c4aa039d426be2fa358284
• merge commit: 43effd8bac1b3ee7278d11514227641ac396548a
• merge commit has no GitHub Actions workflow run returned for that SHA
• current combined commit status exposes two failed Vercel contexts (Vercel – c-api, Vercel – veklom-id-59uw)
• therefore default-branch test/build/deployment readiness is NOT_VERIFIED

Required correction / evidence

1. Run the checked-in cAPI CI on the current default-branch SHA (or a small follow-up SHA containing no unrelated changes) and obtain executable npm ci, test, and build evidence.
2. Diagnose the two failed Vercel contexts instead of treating the merge itself as deployment success. If either context is intentionally non-authoritative for cAPI, document/remove that stale deployment binding rather than ignoring it.
3. Re-run focused registry-auth negatives: unset/staging/unknown NODE_ENV without a token must fail closed; raw-token Authorization must fail; valid Bearer must pass.
4. Do not promote cAPI into verified_runtime_state until deployed SHA + HTTP health/protocol identity + listener 3003 + Traefik routing agree after restart.
5. Only after cAPI runtime verification should Gnomledger→cAPI registration be promoted from NOT_VERIFIED.

This issue tracks verification/merge-gate truth, not a rollback of the corrected auth semantics.

[reprewindai-dev]

2026-08-11 reconciliation: current default-branch head has advanced to 9f85b05bfa064018be1a87164e6dfbca60aa63c4 (fix(runtime): remove stray Docker CMD from healthcheck block). The Dockerfile change leaves the healthcheck explicitly targeting http://127.0.0.1:3003/health, which is aligned with REPORTED_RUNTIME_STATE cAPI 3003, but GitHub exposes no Actions workflow run for this current head. This does not satisfy #42's executable default-branch CI gate and does not promote runtime. cAPI remains NOT_VERIFIED pending clean exact-head CI plus deployed SHA, HTTP/protocol identity, listener 3003, and Traefik agreement.

[reprewindai-dev]

Fresh default-branch reconciliation on main SHA 7689d5213b74b60d42bbbb3304d563f8752952c0:

• GitHub branch protection is now enabled and requires the verify context (still reported with enforcement level non_admins, so admin-bypass remediation remains tracked separately in ci/security: enforce exact-head required checks for admins before merge #49).
• Exact default-branch verify check 99124593526 completed success.
• Exact default-branch deployment check 99124593761 completed failure. The checked-in Deploy to Coolify workflow invoked curl with an empty webhook URL and empty bearer value, producing curl: (3) URL rejected: Malformed input to a URL function.
• Both Vercel status contexts on this SHA also report failure.

Truth boundary: this is meaningful source/CI improvement, but not deployed runtime verification. reported_runtime_state = cAPI:3003; verified_runtime_state = NOT_VERIFIED. Do not proceed to promote Gnomledger→cAPI registration until cAPI deployment/restart, HTTP/protocol identity, listener 3003, deployed SHA/image, and Traefik routing agree.

Also note PR #55 previously replaced the protected verify job with split jobs. I have pushed follow-up commit 2f4a3194f74d0eb426bec061a6d6ca65ee680ec3 on #55 to restore verify as an aggregate over lint/test/dependency-audit/build so merging the CI expansion cannot silently orphan the required status context.