Onboard core to opt-in Sonar analysis and main readiness #24

Operator acceptance — 2026-10-23

André explicitly accepted the first workflows/Core analysis-only rollout with its documented limitations and authorized closure of workflows #27 and Core #24. This completes the bounded first wave; it does not assert that the remaining evidence gaps or publication controls have been implemented.

Accepted revisions: workflows f6c806d1060e390a24c1451e7486578c9bdbab23; Core 7544584d1fe00192827f90987f69a162f24381f6. Shared main checks passed, including 259 runner tests on each of Windows and Linux. Core local analysis and isolated failed-gate/recovery checks passed within their recorded scopes. Both exact-main central CI/Sonar readiness sets passed against the accepted baseline, with 6/6 tests, 100% coverage and zero findings/hotspots. Core remains private and admin Browse/See Source Code access is verified. Rollback instructions are documented.

Accepted limits: sampled health does not prove peak/concurrent capacity; the central post-baseline runs have zero new-code denominators; native PR analysis and host-app E2E/deployment are not part of this library wave. Core's active Sonar Quality Gate stops failed analysis/readiness, but its existing tag publisher is independent and remains outside Sonar enforcement. Readiness receipts are short-lived historical evidence, not publication authorization.

Publishing stays unchanged; app-foundation publishing remains disabled. No Actions, service settings, token/policy configuration or other consumers are changed by this acceptance. No further rollout wave is authorized. Follow-up issue creation records planned work only.

Scope

Onboard core as the first Sonar consumer after the accepted app-foundation PoC and shared tooling extraction. Tracking epic: andregoepel/app-foundation#238.

Acceptance

• Add a repository-specific complete analysis/coverage contract and local Windows/Linux entry point using immutable shared tooling.
• Add opt-in main analysis/readiness that validates this repository's exact successful CI run/attempt, Sonar task, analysis, gate and approved baseline.
• Preserve existing CI, tag publisher, Actions and Core library dependencies. This wave does not make the existing publisher Sonar-protected; no tags or package uploads.
• Submit one onboarding PR with local validation and rollback/activation guidance for review, without merging.
• Record two successful exact-main CI/Sonar sets, isolated gate failure/recovery and sampled service capacity. André accepted the wave on 2026-10-23 with peak/concurrent capacity and nonempty new-code evidence explicitly deferred to the linked follow-ups.

E2E, Aspire/PostgreSQL/browser tests and staging deployment are not applicable to this library. Central baseline selection requires an actual main analysis and review; no baseline or readiness may be fabricated. New external storage and other repositories are out of scope.

Core main readiness — two successful sets, 2026-10-23

Core PR #28 is merged. The two requested CI/Sonar readiness sets passed on exact main 7544584d1fe00192827f90987f69a162f24381f6 against the unchanged accepted baseline e3555256-765a-4247-9489-9a22f02ff42b:

Both analyzed both solution projects, passed 6/6 tests, imported 100% coverage with no uncovered lines, and reported zero findings/hotspots with Quality Gate OK and no ignored conditions. Each produced a separate successful task/analysis and a verified readiness receipt bound to the exact CI attempt, source, policy and baseline. Receipt fields are analysisReady: true, releaseEligible: false.

The first set used the existing merge trigger. Exactly one CI rerun was requested after verifying its success; analyses ran sequentially. Both CI attempts passed every mandatory step and skipped publishing. The second receipt supersedes the first's current eligibility; retained receipts are acceptance evidence, not permanent authorization.

There is no new analyzed production code in this revision. Explicit zero denominators support the reviewed handling of absent new-code percentage conditions; nonempty new-code coverage is not claimed. The retained isolated local failure/recovery and Windows/Linux evidence remains separate. Service health and sampled resources showed no incident; gate/profiles, service configuration and the reference project's baseline are unchanged. Short processing tasks fell between samples, so peak/concurrency capacity is not proven. Raw operational evidence remains local.

Tracked follow-ups

• Core NuGet publication gate — enforce the existing Quality Gate before publication; legacy publisher unchanged until separately reviewed migration.
• Core nonempty new-code evidence — validate the central new-code case and scoped failure/recovery evidence.
• Shared Sonar capacity — measure representative peaks/headroom before wider or concurrent rollout.
• Tool and access maintenance — coordinated pins, Core credential renewal and inherited-secret review.
• Deferred recovery and archival review — review backup-copy freshness, broader recovery and independent evidence retention; provisioning remains deferred.
• Independent monitoring evaluation — existing issue, not duplicated.
• Optional branch/PR analysis decision — existing issue, not duplicated.

These follow-ups do not reopen the accepted wave. Implementation, workflow changes, purchases, publishing activation and additional repositories need their own appropriate authorization.