Support administrator-selected unbounded assignment results

Required outcome

Support complete registered assignment results when an administrator explicitly selects an unbounded result count.
Keep the default bound and all existing authorization checks.
Application dependency: https://github.com/trainstar/app/issues/1#issuecomment-5972776445.
Related completed feature: #33.

Evidence

Synchro v0.4.0-rc.1 permits only bounds 1–1000.
portable_seed.rs:294-297 rejects larger values.
portable_seed.rs:434-456 rejects a result above the registered bound.
The catalog declares max_scopes INTEGER NOT NULL CHECK (max_scopes BETWEEN 1 AND 1000) at lib.rs:719.

An ordinary-owner TrainStar application fixture created 1,001 distinct valid public exercise dependencies across two workouts.
All application constraints passed before rollback.
The approved application contract requires registered assignment functions and shared entity scopes.
It imposes no global 1,000-dependency quota.
Evidence: https://github.com/trainstar/app/issues/1#issuecomment-5971226974.

Severity: Medium. A valid application dependency closure exceeds the available registration contract and blocks dynamic delivery.
No data exposure or corruption was measured.

Orchestrator decision

SQL NULL in the registered max_scopes value selects unbounded DISTINCT results.
Existing default 1000 and explicit bounds 1–1000 retain complete overflow rejection.
Returned NULL scopes remain invalid.
Preserve function-owner execution, validation, fingerprints, authorization, reconciliation, and provenance.
An independent findings-only review found no blocking design conflict after the NULL-call compatibility decision.

Preserve SQL identity (TEXT, INT), DEFAULT 1000, and RETURNS void.
The function must execute when only the bound is NULL.
For a NULL function name, preserve SQL NULL and no registry write before bound validation.
This includes (NULL, NULL) and (NULL, 0).
Both Rust arguments therefore need nullable handling.
Preserve owner, security mode, search path, and operator-only EXECUTE.

The catalog transition requires dropping NOT NULL on synchro.sync_assignment_function.max_scopes.
The existing range CHECK can remain unchanged because NULL satisfies PostgreSQL CHECK semantics.
The SQL function must use CALLED ON NULL INPUT with the reviewed nullable Rust implementation.
Exact new-version install and forward-upgrade DDL must accompany release preparation.
Published scripts, tags, and artifacts remain immutable.

Bounded implementation and acceptance

The first candidate changes only registration, catalog declaration, result loading, and focused PostgreSQL tests.
It does not change a dependency, protocol field, release version, grant, or published artifact.

Acceptance requires:

Fresh installation and forward upgrade with exact signature, grants, default, and NULL-call compatibility.
Default and explicit bounded overflow rejection without durable assignment changes.
Explicit unbounded registration and 1,001 distinct results with duplicates removed.
Invalid result, function security, ownership, and fingerprint-drift rejection.
Real connect, reconnect, rebuild, and cursor-bearing pull across the complete large assignment set.
Additions, removals, unchanged assignments, two-user isolation, grant union, and provenance cleanup.
Contract, build, lint, security, regression, and independent review evidence.

Request bytes, native response bytes, timeouts, and per-scope resources remain separate measured validation boundaries.
The source review does not establish arbitrary-workload capacity.
No release publication or application dependency update is authorized by this issue alone.

Source candidate: 688d5373601b24e69b150e3b93dd90b1e6161904.
Worktree: isolated branch app-assignment-capacity.
The original checkout and published rc.1 artifacts remain unchanged.

Independent source review found no implementation issue against the binding brief.
The review covered nullable registration, NULL-name compatibility, bounds, DISTINCT results, authorization, health, and history rollback.
This review is not runtime or release acceptance.

Validation attempts remain visible:

make lint-rust-pg failed because native PostgreSQL references a removed MacOSX15.1 SDK.
The bindgen SDK override resolved header generation. The C shim still referenced the removed SDK.
Both supported compiler overrides resolved that configuration failure.
Production Clippy passed. Test compilation rejected a 68-character PostgreSQL test identifier at assignment.rs:759.

The implementation agent is correcting only that identifier under the same brief.
The orchestrator will commit the correction and rerun validation on the exact clean commit.
Runtime signature, lifecycle, upgrade, transport, and packaged acceptance remain open.

Candidate commit: c0fd832d8ade50511e654edab30f3a6eb4596fa2.
The isolated worktree was clean before and after validation.

Change

The reviewed source candidate supports administrator-selected unbounded assignment results through a NULL bound.
The default and explicit bounded contracts remain unchanged.
The correction shortened one PostgreSQL test identifier after its measured compilation failure.

Validation

make lint-rust-pg: passed formatting, production Clippy, and test-feature Clippy.
make test-rust-pg PGRX_TARGET_DIR=/Users/mdspinali/Documents/projects/trainstar/repos/synchro/.pgrx-target: passed 434 tests across three harnesses.
Results: zero failures, zero ignored tests, and zero filtered tests.
The two empty harnesses are the embedding binary and documentation tests. The structured parser accepted the complete 434-test result.
The run used native PostgreSQL 18.3. This Mac fixture is not a supported server package cell.
The generated signature is (TEXT, INT DEFAULT 1000) RETURNS VOID without STRICT.
The catalog permits NULL bounds and preserves the existing range CHECK.
Runtime cases passed for NULL registration, complete NULL-name state preservation, 1,001 distinct scopes, duplicates, user isolation, invalid results, and health.
Existing security, ownership, definition drift, bounded rejection, and regression cases passed.

Build configuration used the installed SDK reported by xcrun --show-sdk-path.
Both BINDGEN_EXTRA_CLANG_ARGS and CFLAGS selected that SDK.
The earlier environment and identifier failures remain recorded in the preceding comment.

The original Synchro checkout remains clean at 7bc2f7a34b619099edd6cb0645e44de19fca1e7a.
Published rc.1 artifacts remain unchanged.
Forward upgrade, complete downstream lifecycle, provenance cleanup, contract updates, security, and package gates remain open.
This result does not close #300 or establish application dynamic-scope integration.

The documentation dependency findings have returned with new advisories.
Candidate source: bec42b9cb8b24b9adcf94724a86dfa24466cd898.
Its worktree was clean during the checks.

make docs-build test-conformance-contract passed.
Results include 29 documentation pages, 3,284 internal references, and 162 conformance tests across three packages.
The structured Python gates also passed without skips.
However, npm ci reported seven dependency advisories.
npm audit --json confirmed six High and one Moderate affected package entries.

The direct affected dependency paths are:

astro@7.3.1 -> http-cache-semantics@4.2.0.
astro@7.3.1 -> devalue@5.9.2.
ajv@8.20.0 -> fast-uri@3.1.7.

Other affected package entries inherit the Astro finding.
No synchronization runtime exposure or exploitation was measured.

The High advisory GHSA-ch52-4w7c-c8xp covers http-cache-semantics <=4.2.0.
GitHub reports no first patched version.
The npm registry still reports 4.2.0 as the latest version.
The advisory update time is 2026-10-02T22:36:44Z.
An automatic downgrade to Astro 2.10.9 does not establish a compatible supported correction.
The orchestrator will investigate the smallest compatible corrections and the remaining upstream blocker.

The zero-vulnerability acceptance criterion in #32 is currently unmet.
Release promotion remains blocked under the existing issue contract.
Earlier source and documentation success does not establish a passing security gate.
The assignment-capacity source checks passed. Issue #32 blocks release acceptance.

The orchestrator selected 0.4.0-rc.2 for the next isolated local test candidate.
RELEASE.md requires a new candidate version after changes to a published candidate.
This stage authorizes no push, pull request, publication, deployment, or application dependency change.
Published rc.1 bytes remain immutable.

The downloaded rc.1 server archive has SHA-256:
cbab034e39aee08dcdd606e95c68031f22dfa0f70845d8fbbf39740dc1835dac.
Its measured digest matches the published GitHub asset metadata.
The orchestrator will add this released origin before the forward script.

Independent source review found no missing production object or DDL correction in this forward script:

ALTER TABLE synchro.sync_assignment_function
    ALTER COLUMN max_scopes DROP NOT NULL;

ALTER FUNCTION synchro.synchro_register_assignment_function(TEXT, INTEGER)
    CALLED ON NULL INPUT;

UPDATE synchro.sync_extension_build
SET installed_fingerprint = synchro.synchro_build_fingerprint(),
    installed_at = pg_catalog.now()
WHERE singleton;

The file is extensions/synchro-pg/sql/synchro_pg--0.4.0-rc.1--0.4.0-rc.2.sql.
The source review confirms data preservation and unchanged function identity, default, result type, ownership, ACLs, security mode, and search path.
Runtime upgrade and fresh-install equivalence are still required.

Two upgrade proof gaps remain:

The retained-generation fixture must preserve the older unknown-requirement case and respect rc.1 recorded source requirements.
The upgrade test must preserve a preexisting bounded registration, complete metadata, and assignment history before testing new NULL behavior.

Those test corrections remain under bounded review before implementation.
The existing Class 3 and bootstrap assertions will remain enforced.
Issue #32 remains a separate measured release security blocker.

The independent migration review found no source findings in the integrated upgrade test and local rc.2 preparation.
Local candidate commit: d987b42f87408ca7f0277806776402a55f16fad7.
The isolated branch remains unpublished.
The application still pins rc.1.

The upgrade test preserves complete assignment registration and client history.
It keeps the existing replay, cursor, data, catalog, Class 3, and bootstrap assertions.
It checks the exact legacy NULL and rc.1 requirement 2 paths.
It also checks NULL-name no-ops and intentional unbounded registration after preservation.
Relevant source: conformance/blackbox/integration/real_extension_update_test.go:142, :195, :286.

The clean-commit checks passed:

make version-check.
make test-version-contract: 1 test.
make check-released-update-scripts: both published scripts match their tags.
make docs-build: 29 pages and 3,284 internal references.
make test-conformance-contract: 162 tests across 3 packages.
make lint-conformance: Go vet passed.

The PostgreSQL suite remains in progress.
All three pinned upgrade origins and fresh-install equivalence still need runtime evidence.
A separate Ubuntu 24.04 and PostgreSQL 18.3 fixture is being prepared on the desktop.
It does not use the active application lane or the host PostgreSQL installation.

React Native package preparation succeeded with three peer warnings.
The original checkout and candidate report the same three warnings.
They concern missing Babel and Expect peers in transitive packages.
The original and candidate outputs each contain 188 peer checks.
No runtime or security acceptance follows from that comparison.
The remaining documentation advisory in #32 still blocks release acceptance.

Artifacts: /private/tmp/trainstar-s18-20261002/assignment_rc2_contract.log, assignment_original_rn_peers.log, and assignment_candidate_rn_peers.log.
No acceptance issue is complete.

Clean candidate d987b42f87408ca7f0277806776402a55f16fad7 passed make check-pg-sql and all 434 PostgreSQL Rust tests.
It also passed make release-npm-dry-run, make release-pods-check, and make build-check.
The npm preparation retains the three measured peer warnings recorded above.

The complete isolated Linux make test-blackbox run found an update-harness failure.
The 0.3.1 and 0.3.2 update assertions passed with equal updated and clean catalogs.
Each catalog snapshot contained 2,009 lines.
Rc.1 setup then failed before database provisioning with harness update baseline configuration is invalid.
Measured timestamp: 2026-10-03 20:49:06 UTC.

Cause: conformance/blackbox/process.go:65 permits only X.Y.Z.
normalizeHarnessConfig rejects the published rc.1 origin through that pattern at :668-670.
RELEASE.md requires published candidates as update origins.
The release parser already accepts positive rc.N without leading zeros at api/go/internal/releaseversion/releaseversion.go:19.

The bounded correction extends only harness version validation and configuration tests.
It preserves artifact pairing, path normalization, owned fixtures, and current-version rejection.
It does not change production sync behavior or weaken upgrade assertions.
The orchestrator will review the correction and rerun required validation on its clean commit.

The failed attempt remains evidence. It does not count as a passing gate.
The unchanged Linux clone continues the rest of its suite to collect other failures.
The active application lane remains intact.
No acceptance issue is complete.

The independent review found no source findings in the harness correction.
Local commit: cdde556aca236b16d6e7d82df2d7147315b90a0d.
make test-blackbox-harness passed all 237 tests on that clean commit.
make lint-conformance also passed.
The change preserves every existing configuration rejection rule.

A separate clean Linux clone is running the focused three-origin upgrade diagnostic.
This partial diagnostic cannot replace the required complete gate.
The original complete run continues on unchanged d987b42f to collect all failures.
Its recorded rc.1 setup failure remains visible.

The next bounded test covers 1,001 function results through actual connect, complete rebuild, cursor-bearing pull, and reconnect.
It also covers exact additions and removals, grant overlap, second-user reevaluation, and assignment history.
The independent brief review found four ambiguities or proof gaps.
The corrected brief requires user-scoped duplicate SQL, complete scope-state snapshots, empty post-rebuild changes, and active second-user reevaluation.
Implementation is in progress.
Native local provenance cleanup remains a separate acceptance item.

Issues #300 and #32 now use the existing v0.4.0 milestone.
The remaining documentation advisory still blocks release acceptance.
No push, pull request, release, or application dependency update occurred.
No acceptance issue is complete.

The corrected harness passed the real three-origin upgrade diagnostic on clean cdde556aca236b16d6e7d82df2d7147315b90a0d.
Each origin passed: 0.3.1, 0.3.2, and 0.4.0-rc.1.
Each updated catalog equaled a fresh rc.2 installation with 2,009 snapshot lines.

The test preserved client identity, checkpoints, push results, source rows, complete assignment history, and rc.1 registration metadata.
Exact push replay preserved response bytes and durable state.
The pending generation retained its exact source requirement and required the existing Class 3 bootstrap.
Rc.1 also passed all three NULL-name no-op controls and the intentional NULL-bound registration control.

Command: make test-blackbox PARTIAL=1 GO_TEST_ARGS='-v -count=1 -p 1 -run ^TestRealExtensionUpdateFromBaseline$'.
Structured integration result: 4 tests passed, zero failures, and zero skips.
Runtime: isolated Ubuntu 24.04, certified PGDG PostgreSQL 18.3, Rust 1.92.0, cargo-pgrx 0.17.0, and Go 1.25.0.
Artifact: /private/tmp/trainstar-s18-20261002/assignment_rc2_upgrade_diagnostic.log.

This result is a focused diagnostic. It does not replace the complete gate.
The original complete attempt still contains its recorded rc.1 harness failure.
The large-assignment lifecycle implementation remains in progress.
The complete gate must run again on the reviewed integrated commit.
The documentation advisory in #32 still blocks release acceptance.
No acceptance issue is complete.

The reviewed lifecycle test is committed locally in ab33b7e93c7664edcd75a1c01bf2297ba24410d1.
The isolated candidate remains unpublished.

The new real HTTP test covers 1,001 DISTINCT function scopes and 1,004 total scopes.
It covers default overflow rollback, complete rebuilds, cursor-bearing pulls, reconnect, reconciliation, grant overlap, and signed two-user isolation.
It compares exact assignment history and complete scope state.
The independent source review found one reconnect proof gap.
The corrected test checks exact schema action and empty cursor updates.
The final review found no remaining source findings.

On the exact clean commit, make build-conformance lint-conformance test-blackbox-harness passed.
The harness reported 237 tests in one package, with zero failures and zero skips.
Artifact: assignment_integrated_local.log under /private/tmp/trainstar-s18-20261002.

A complete Linux black-box run started from a fresh clean clone of this commit.
It uses isolated Ubuntu 24.04 x64 and PostgreSQL 18.3 containers.
It has no host port mapping and does not replace host extension libraries.
The application test lane remains separate.
Artifacts: integrated-prepare.log, integrated-blackbox.log, and integrated-soak under /home/mdspinali/trainstar-assignment-validation-20261003.

The earlier complete attempt still runs on d987b42f87408ca7f0277806776402a55f16fad7.
Its recorded rc.1-origin harness failure remains visible.
The corrected focused three-origin upgrade diagnostic passed on cdde556aca236b16d6e7d82df2d7147315b90a0d.
That partial diagnostic does not replace the complete gate.

Native provenance cleanup validation and the remaining documentation security blocker #32 remain incomplete.
No release publication or application dependency change has occurred.

Additional checks passed on clean candidate commit ab33b7e93c7664edcd75a1c01bf2297ba24410d1.

make test-swift-unit: 351 tests passed in the macOS xcresult.
make test-kotlin-unit: 718 tests passed in 46 JUnit suites.
Both structured result checks reported zero failures and zero skips.
The source worktree remained clean after both commands.

Artifacts: assignment_integrated_swift_unit.log and assignment_integrated_kotlin_unit.log under /private/tmp/trainstar-s18-20261002.

These unit checks do not replace extension-backed native provenance cleanup checks.
The complete Linux black-box run remains active.
No candidate publication or API dependency change occurred.

The original full attempt ended on d987b42f87408ca7f0277806776402a55f16fad7.
It recorded 533 passing tests and one named failure, TestRealExtensionUpdateFromBaseline.
That named failure is the recorded rc.1 origin parser defect fixed in cdde556a.
The integration package then terminated at exactly 2,400.012 seconds.
The log reports panic: test timed out after 40m0s during TestRealReadinessStaysReadyUnderWriteLoad.
The complete suite did not finish.

The first corrected run on ab33b7e93c7664edcd75a1c01bf2297ba24410d1 was stopped before completion.
It recorded 292 passing tests and no failures or skips before the stop.
This run is not complete gate evidence.
Its log remains integrated-blackbox.log.

The complete corrected run now uses the supported aggregate variable BLACKBOX_TIMEOUT=60m.
It uses the same exact clean commit and certified artifacts prepared from that commit.
No test selector or PARTIAL=1 is present.
Per-test contexts, protocol limits, semantic assertions, and performance assertions remain unchanged.
The aggregate timeout is not a declared test selector in Make or RELEASE.md.

Command: make test-blackbox BLACKBOX_TIMEOUT=60m SOAK_SEED=20260914 SOAK_ARTIFACT_DIR=/validation/complete-soak.
The fresh isolated container is trainstar-assignment-complete-20261003.
Its artifact files are complete-prepare.log, complete-blackbox.log, and complete-soak.
All remote artifacts remain under /home/mdspinali/trainstar-assignment-validation-20261003.
The run remains active.
No complete-gate success is claimed.

The reviewed large-assignment lifecycle passed its focused real HTTP diagnostic on clean ab33b7e93c7664edcd75a1c01bf2297ba24410d1.
Runtime: isolated Ubuntu 24.04 x64 and certified PGDG PostgreSQL 18.3.

TestRealLargeScopeAssignmentLifecycle passed in 59.31 seconds.
Its assertion flow passed in 26.58 seconds.
The structured integration result reported two passing test results in one package.
It reported zero failures and zero skips.

The fixture assigned 1,001 DISTINCT function scopes and 1,004 total scopes.
It rebuilt every scope and checked complete cursor-bearing pulls and reconnect.
It checked exact history, assignment changes, grant overlap, grant removal, and signed second-user isolation.
The encoded cursor-bearing request measured 770,260 bytes for 1,004 scopes.
This fixture does not establish arbitrary-workload capacity or native response capacity.

Command: make test-blackbox PARTIAL=1 GO_TEST_ARGS='-v -count=1 -p 1 -run ^TestRealLargeScopeAssignmentLifecycle$'.
This is a focused diagnostic, not the complete gate.
The complete unfiltered 60-minute aggregate run remains active.

The first diagnostic container stopped during setup because pgrx was not initialized.
No tests ran in that attempt.
The retry initialized pgrx and used a separate generated configuration directory.
Both attempt logs remain available.

Artifacts: large-diagnostic-prepare.log, large-diagnostic-retry-prepare.log, and large-diagnostic.log.
Remote artifact root: /home/mdspinali/trainstar-assignment-validation-20261003.
The candidate remains unpublished and the API still uses published rc.1.

The independent readiness audit does not establish release acceptance for cd03a62ee92bdf1cf98569f5421a636410f4291a.

Change

No release, tag, dependency update, or publication occurred.
The local documentation security correction passed its accepted bounded checks.
API 24 preparation still calls unavailable locksettings at Makefile:1972.
Current Android package records and execution still select API 36 at .github/workflows/release.yml:352,354,512,514.
CHANGELOG.md has no dated 0.4.0-rc.2 section required by scripts/release-publish.py:393.
Package records lack runtime environment fields and environment-to-manifest comparison at verification/packaged_smoke.py:909,1065.
The recorded API 37 ARM64 image does not establish the workflow's x86_64 image revision.

Validation

The declared package matrix requires seven cells and 35 lifecycle obligations.
The 626-test Linux result applies to 5524510, before the dependency correction.
The accepted documentation checks apply to cd03a62 and do not replace complete Candidate or package validation.
All four v0.4.0 milestone issues remain open: Support administrator-selected unbounded assignment results #300, Update vulnerable documentation build dependencies #32, Android emulator preparation fails when API 24 lacks locksettings #301, and Current Android release cells still select API 36 #302.
Published release evidence contains rc.1 and no rc.2.

Required sequence: resolve the source gaps, complete the prescribed dev and master integration, and pass Candidate on the exact promoted commit.
Then validate every sealed package cell and satisfy every milestone acceptance criterion.
Publication requires the protected release approval after those checks.
No issue can close from this readiness audit alone.

Change

Local commit 43f75c2726c14786c0bec2485cdcfd88cdf428f6 selects stable iOS Simulator 27.0 and Xcode 27.0 for both current Apple package cells.
The workflow uses the official xcode-27 runner label.
RELEASE.md distinguishes simulator execution from current stable device release checks.
Minimum iOS 16.4, Xcode 16.4, macos-15, and committed Android selectors remain unchanged.

Validation

Root reviewed the complete two-file diff and ran all 32 offline release-artifact tests successfully.
Astra reconstructed both files exactly from f293942 using only approved edits.
YAML and embedded manifest parsing passed.
All action pins, execution checks, lifecycle assertions, and publication gates remain unchanged.
The official image provides stable Xcode 27.0 and Simulator 27.0.
The runner image remains preview.

This stage remains local. No pull request, push, tag, release, or dependency update occurred.
Fresh candidate-start resolution, sealed environment binding, hosted prerequisites, and package execution remain required.
This stage does not establish physical iOS 27.0.1 execution or issue completion.
Review brief: docs/agent-tasks/2026-10-04-synchro-current-apple-selector-review.md in the app worktree.

Change

The executed-environment source diagnosis traced all seven required cells and their 35 lifecycle obligations.
No current cell file or collected summary records executed environment values.
Manifest environments originate as authored workflow dictionaries.
Current final validation compares source and artifact hashes, but not resolved_support_cells.

Exact source boundaries at 43f75c2726c14786c0bec2485cdcfd88cdf428f6:

verification/packaged_smoke.py:816 and :875 omit environment values from completed cells.
verification/packaged_smoke.py:921 rejects additional cell members.
verification/packaged-smoke-cell.schema.json:6 excludes undeclared members.
verification/packaged_smoke.py:1032 collects operations and artifacts without environment values.
verification/packaged_smoke.py:1117 does not compare resolved environments with executed evidence.
Makefile:2276 and :2280 measure Android API through unscoped adb.
verification/consumers/kotlin/test-consumer-device.sh:12 uses its retained explicit serial with different selection precedence.
verification/consumers/react-native/test-consumer.sh:81 requests RN 0.83.10 but does not record installed RN runtime metadata.

These are source findings. No new device mismatch or runtime failure was measured.
The existing terminal lifecycle and artifact checks must remain intact.
Environment evidence must bind the measured execution to the exact sealed cell environment.
Android evidence must include the API, image revision, and emulator version required by #302.

Root corrected two inaccurate descriptive sentences introduced in the Apple selector stage.
Local commit 2beeead3f7d65077c71ac0d2b168f10b76f72226 changes them to must record and must check requirements.
Astra accepted the exact two-line correction.
The selector workflow is unchanged.
No release, push, pull request, dependency update, or issue closure occurred.

Diagnosis brief: docs/agent-tasks/2026-10-04-synchro-executed-environment-diagnosis.md in the app checkout.
The orchestrator retains the environment binding design and all external operations.
#302 and #300 remain open.

Independent review accepted the corrected sealed-environment contract for bounded implementation.
Contract SHA-256: ed9e903f287b9f58034e67ae4e09611c126480bd4cdb445f08ed63b7f1c03deb.

Change

Use one closed environment representation and shared standard-library validator.
Bind actual measurements to each selected environment in the sealed manifest.
Check serial conflicts before Make or the emulator action overwrites their original values.
Bind required Linux Android measurements to the selected socket owner, PID, executable, AVD, and image metadata.
Reject replaced executables, changed process identities, wrong images, malformed versions, and duplicate JSON names or cell records.
Preserve failed-cell diagnostics without invented environment evidence.
Preserve all seven required cells and all 35 lifecycle obligations.

Validation and limits

Root verified the official stable Linux archive SHA-1 before extraction.
Both exact x86_64 engine names returned version 37.2.12.0, build 16428233, and exit zero.
The probe started no AVD and made no database operation.
Explicit ARM development-device console reads returned the exact AVD name, path, guest SDK, and matching runtime image directory.
These observations do not prove a running Linux process chain or a required package cell.
Complete process provenance, mismatch controls, resume checks, evidence propagation, and seven real package gates remain required.
Fresh authoritative platform checks remain required at candidate start.

The first implementation stage is bounded to the shared validator and both release-manifest validation paths.
Actual probes, consumers, evidence schemas, summaries, workflows, and final release execution remain later stages.
No release, milestone closure, or app dependency update follows from this design review.

Change

Local commit 491a39ba881af41ebcb0bb05d7e94ce423d3d3b2 adds the shared sealed-environment validator.
The stage changes five files with 456 insertions and 31 deletions.
Both artifact staging and sealed-manifest verification enforce the same seven closed profiles.
Duplicate JSON members and duplicate cell identities are rejected before conversion.
The existing Make gate now runs the environment unit suite.

Validation

Independent review accepted the complete stage and the Make gate.
Root ran make test-release-artifacts.
The runner self-test passed once.
The artifact and environment suites passed all 46 tests.
There were zero failures, errors, skips, or expected failures.
Python compilation and git diff --check passed.

Remaining work

This commit remains local on the upstream branch.
Workflow dictionaries, actual execution probes, consumers, cell schemas, and summary propagation remain pending.
Existing Android workflow dictionaries need the newly required image and emulator fields before candidate execution.
No package gate, release, app dependency update, or issue closure is accepted from this stage.

Change

Local commit d998ad192b7ab656dd98f7af3d685f0fac7583da retains measured environments in package cell and summary evidence.
Exactly three files changed with 565 insertions and 22 deletions.
Client and server completion require independent initial/resume measurements and the sealed manifest.
Complete environments and source identity must match before passed evidence is written.
Summaries retain all seven measured records and all 35 lifecycle obligations.
Failed evidence can omit unavailable measurements without fabrication.

Validation

Independent review accepted source and the recorded root gate.
Root ran the packaged-smoke, support-environment, and release-artifact suites.
All 74 tests passed in 11.629 seconds.
There were zero failures or skips.
Both changed Python sources compiled.
Schema parsing and git diff --check passed.
No prior test method or assertion was removed.

Remaining work

The commit remains local.
Consumer integration, actual probes, workflow dictionaries, seven real package cells, and fresh current-stable authority remain pending.
No release or app dependency acceptance is claimed.

Apple probe source stage: local commit 4aa4b5585627ec0060302e1c460af78e4d84a4f6.

Root read both complete new files. Independent review accepted the source with zero material blockers.
Root offline gate: 24 tests passed in 0.203 seconds. No failures or skips occurred.
The log is synchro_apple_environment_probe_root_tests.log.

Root measured the retained, already booted iPhone without installing or changing an app.
Record: synchro_apple_native_current_measured.json.
Cell: SUP-IOS-CURRENT-001. Actual iOS: 27.0. Actual Xcode: 27.0.
Xcode diagnostics: Build version 27A266a.
The first command used an invalid cell ID and failed before measurement. The corrected command used the CLI's declared ID.

Xcode 16.4 metadata compatibility and the required iOS 16 runtime remain unproved.
Consumer initial/resume binding, real package cells, push, pull request, and release acceptance remain pending.
No issue is closed by this source stage.

Apple consumer integration source stage: local commit bc44629.

Both native Swift and React Native iOS smoke consumers now require the explicit sealed manifest and retained simulator UDID.
The React Native simulator build uses that exact UDID.
Both consumers measure actual environment metadata immediately before initial and resume launch.
Measurement files persist in .environments/ through later failure cleanup.
Completion compares initial, resume, and sealed manifest environments before emitting a pass.
All artifact, PID, kill, replay, convergence, server, and 35 lifecycle obligations remain intact.
Cleanup, React Native Android behavior, native canary behavior, and React Native build-only behavior remain unchanged.

Root read the complete diff and reran the applicable offline gate.
Validation: 52 tests passed in 6.704 seconds. Zero failures or skips occurred.
Both shell syntax checks and git diff --check passed.
Independent review accepted the exact three-file source stage with zero material blockers.
Root gate: synchro_apple_consumer_environments_root_tests.log under /private/tmp/trainstar-s18-20261002.

PostgreSQL and Android measurement integration remains unfinished.
Minimum Xcode/iOS compatibility, actual package initial/resume evidence, fresh current-stable verification, and release acceptance remain pending.
No push, pull request, tag, publication, or application dependency change occurred.
Neither issue is closed by this local source stage.

Reviewed source stages are pushed in draft PR #306, targeting dev.
Head: 0bbbc58ae9507923d720e62cee350c9d65c08ca8.
The PR is linked to the active work session.

Change

f379c5dfba200d361f9ff3c324519171cc0c1db1 adds the retained PostgreSQL environment probe.
e5c5cc0 binds initial and resume server consumer measurements to the explicit sealed manifest.
0bbbc58ae9507923d720e62cee350c9d65c08ca8 adds probe tests to the source-quality Make gate.

The PostgreSQL probe verifies actual Ubuntu 24.04 x86_64 identity and selected binary/server version equality.
It isolates libpq variables and uses bounded read-only server queries.
The first source review found an incorrect PGDATABASE URI assumption in the root brief and implementation.
Root verified PostgreSQL 18.3 source and corrected the same brief before source acceptance.
The query now receives parsed host, port, decoded database, SSL mode, credentials, and fixed bounds.
Connection data stays out of CLI arguments and diagnostics.

The server consumer keeps both measurements at <cell-result>.environments/initial.json and resume.json.
It checks an explicit readable manifest before provisioning.
Both probes use the retained binary directory and command-local provisioner credentials.
The completion command requires both measurements and the selected manifest.
Lifecycle, protocol, PID, replay, convergence, seed, bootstrap, artifact, and cleanup gates remain unchanged.

Validation

Corrected PostgreSQL probe and shared-validator unit tests: 36 passed in 0.136 seconds.
Server consumer and related release-tooling unit tests: 100 passed in 12.145 seconds.
Actual make test-release-artifacts: 1 runner test and 72 combined tests passed.
All recorded gates have zero failures, errors, and skips.
Python compilation, shell syntax, and diff checks passed.
Independent reviews accepted each complete source stage and the CI gate.

Source-quality CI run 37214942455 is in progress for this exact head.
The PR-triggered run does not execute the master-only candidate package jobs.
No candidate or package acceptance is claimed from those skipped jobs.
All new PostgreSQL platform and database unit-test operations are mocked.
Actual Linux provisioner/package execution, Android consumer integration, seven real sealed cells, and candidate checks remain pending.
No release, registry publication, application dependency update, milestone closure, or issue closure follows from these source stages.

Reviewed source stages are pushed in draft PR #306, targeting dev.
Head: e0ad9204e712c9d41895bf8678df9115e70b3b8b.
The PR is linked to the active work session.

Change

f379c5dfba200d361f9ff3c324519171cc0c1db1 adds the retained PostgreSQL environment probe.
e5c5cc0 binds initial and resume server consumer measurements to the explicit sealed manifest.
0bbbc58ae9507923d720e62cee350c9d65c08ca8 adds probe tests to the source-quality Make gate.
e0ad9204e712c9d41895bf8678df9115e70b3b8b refreshes the existing scope-bound mutation patch for the optional limit condition.

The PostgreSQL probe verifies actual Ubuntu 24.04 x86_64 identity and selected binary/server version equality.
It isolates libpq variables and uses bounded read-only server queries.
The first source review found an incorrect PGDATABASE URI assumption in the root brief and implementation.
Root verified PostgreSQL 18.3 source and corrected the same brief before source acceptance.
The query now receives parsed host, port, decoded database, SSL mode, credentials, and fixed bounds.
Connection data stays out of CLI arguments and diagnostics.

The server consumer keeps both measurements at <cell-result>.environments/initial.json and resume.json.
It checks an explicit readable manifest before provisioning.
Both probes use the retained binary directory and command-local provisioner credentials.
The completion command requires both measurements and the selected manifest.
Lifecycle, protocol, PID, replay, convergence, seed, bootstrap, artifact, and cleanup gates remain unchanged.

Validation

Corrected PostgreSQL probe and shared-validator unit tests: 36 passed in 0.136 seconds.
Server consumer and related release-tooling unit tests: 100 passed in 12.145 seconds.
Actual make test-release-artifacts: 1 runner test and 72 combined tests passed.
All recorded gates have zero failures, errors, and skips.
Python compilation, shell syntax, and diff checks passed.
Independent reviews accepted each complete source stage and the CI gate.

CI run 37214942455 failed at the stale mutation patch for head 0bbbc58.
The completed source-quality job log identified the exact mismatch at lines 9922–9924.
The correction preserves the intended bound-disable mutation and changes no production code, test, or manifest binding.
Root ran make test-integration-mutant-manifest: 13 tests and one package passed, with zero failures or skips.
The package elapsed time was 17.338 seconds.
Independent review accepted the complete patch and recorded gate before the commit.
Replacement CI run 37216089983 is queued for the new exact head.
The PR-triggered run does not execute the master-only candidate package jobs.
No candidate or package acceptance is claimed from those skipped jobs.
All new PostgreSQL platform and database unit-test operations are mocked.
Actual Linux provisioner/package execution, Android consumer integration, seven real sealed cells, and candidate checks remain pending.
No release, registry publication, application dependency update, milestone closure, or issue closure follows from these source stages.

Reviewed source stages are pushed in draft PR #306, targeting dev.
Head: e0ad9204e712c9d41895bf8678df9115e70b3b8b.
The PR is linked to the active work session.

Change

f379c5dfba200d361f9ff3c324519171cc0c1db1 adds the retained PostgreSQL environment probe.
e5c5cc0 binds initial and resume server consumer measurements to the explicit sealed manifest.
0bbbc58ae9507923d720e62cee350c9d65c08ca8 adds probe tests to the source-quality Make gate.
e0ad9204e712c9d41895bf8678df9115e70b3b8b refreshes the existing scope-bound mutation patch for the optional limit condition.

The PostgreSQL probe verifies actual Ubuntu 24.04 x86_64 identity and selected binary/server version equality.
It isolates libpq variables and uses bounded read-only server queries.
The first source review found an incorrect PGDATABASE URI assumption in the root brief and implementation.
Root verified PostgreSQL 18.3 source and corrected the same brief before source acceptance.
The query now receives parsed host, port, decoded database, SSL mode, credentials, and fixed bounds.
Connection data stays out of CLI arguments and diagnostics.

The server consumer keeps both measurements at <cell-result>.environments/initial.json and resume.json.
It checks an explicit readable manifest before provisioning.
Both probes use the retained binary directory and command-local provisioner credentials.
The completion command requires both measurements and the selected manifest.
Lifecycle, protocol, PID, replay, convergence, seed, bootstrap, artifact, and cleanup gates remain unchanged.

Validation

Corrected PostgreSQL probe and shared-validator unit tests: 36 passed in 0.136 seconds.
Server consumer and related release-tooling unit tests: 100 passed in 12.145 seconds.
Actual make test-release-artifacts: 1 runner test and 72 combined tests passed.
All recorded gates have zero failures, errors, and skips.
Python compilation, shell syntax, and diff checks passed.
Independent reviews accepted each complete source stage and the CI gate.

CI run 37214942455 failed at the stale mutation patch for head 0bbbc58.
The completed source-quality job log identified the exact mismatch at lines 9922–9924.
The correction preserves the intended bound-disable mutation and changes no production code, test, or manifest binding.
Root ran make test-integration-mutant-manifest: 13 tests and one package passed, with zero failures or skips.
The package elapsed time was 17.338 seconds.
Independent review accepted the complete patch and recorded gate before the commit.
Replacement CI run 37216089983 passed for the new exact head.
Source quality, Swift unit tests, four CodeQL language jobs, and dependency scan/results passed.
The PR-triggered run does not execute the master-only candidate package jobs.
No candidate or package acceptance is claimed from those skipped jobs.
All new PostgreSQL platform and database unit-test operations are mocked.
Actual Linux provisioner/package execution, Android consumer integration, seven real sealed cells, and candidate checks remain pending.
No release, registry publication, application dependency update, milestone closure, or issue closure follows from these source stages.

The reviewed Android probe stage is in commit 0033fc9 on app-assignment-capacity.
Root pushed that commit to GitHub PR #306.

Change

verification/probe_support_environment.py:273 binds every ADB command to the explicit local server socket.
verification/probe_support_environment.py:278 resolves one online emulator without a fallback device.
verification/probe_support_environment.py:396 checks the local socket owner, process, and installed executable.
verification/probe_support_environment.py:463 measures guest API, AVD, installed image, revision, emulator version, and build.
Initial and resume measurements must retain complete process and metadata identities.
verification/test_probe_support_environment.py:686 checks hostile inherited ADB endpoint settings.

Validation

Root recorded 48 passing tests, zero failures, and zero skips in 0.373 seconds.
Command: PYTHONDONTWRITEBYTECODE=1 python3 -m unittest verification.test_probe_support_environment.
git diff --check passed.
Independent review accepted this bounded source stage.
Existing Apple and PostgreSQL logic and tests remain unchanged.
The probe SHA-256 is f1e66765b39799e4029b828820f9536126a22905f2c0f139db446ac6a943823a.
The test SHA-256 is 241072fa4f3f5a347a961b89393cd3f2ea37c8ad42b0279403256a393519224a.
The recorded log SHA-256 is 3522d5711b0a31fe3feb23854f952c38eb22921913f7ed864c22714b685f3512.

Make, workflow, and consumer integration remain pending.
Actual Linux cells, seven sealed cells, and current-stable release checks remain pending.
This source result does not close #302, #300, app #1, or app epic #4.

The reviewed Android consumer stage is in commit a8c7107 on app-assignment-capacity.
Root pushed the commit to GitHub PR #306.

Change

Both Android consumers require an explicit readable sealed manifest.
They check original inherited serials before they export one retained device selection.
All 45 device calls use the exact SDK, explicit local ADB server, and retained serial.
The call totals are 25 Kotlin and 20 React Native calls, including cleanup.
Initial and resume measurements stay outside temporary app cleanup.
Resume checks the complete initial environment and process identity before launch.
Completion receives both measurements and the explicit sealed manifest.
The existing Apple implementation, build-only behavior, lifecycle checks, and artifact checks remain unchanged.

Source: verification/consumers/kotlin/test-consumer-device.sh:10.
Source: verification/consumers/react-native/test-consumer.sh:49.

Validation

Independent review accepted this bounded source stage.
Both sh -n checks passed.
The offline probe, shared-validator, and packaged-smoke suite passed 86 tests in 6.397 seconds.
No test failed or skipped.
git diff --check passed.
Kotlin SHA-256: aa478ee564346c3d44b0b63447573fcc1473bc39cb26d099e38d37c0c266937c.
React Native SHA-256: 8c290c22cef700c4150d98906d309fc9679bbbc51fcea225bdc7531bb4eb7df5.
Recorded log SHA-256: bd46fe71672e0ca837f92fa4fe2f3eb4c2b2cc8c0c41d6ad9ff794b1979d5353.

Make and workflow propagation remain pending.
Per-command bounds and real Linux package cells remain pending.
All seven sealed cells and fresh current-stable release evidence remain pending.
This result does not close #302, #300, app #1, or app epic #4.

Fixed in 2c5ae52dbf8c7e814777bc0d1a05ddbfe298ab9e on dev, through PR #306.

Change

SQL NULL selects unbounded DISTINCT assignment results.
The default limit remains 1,000.
Explicit bounds retain complete overflow rejection.
Registration identity, NULL-name behavior, grants, ownership, isolation, fingerprints, and transactional reconciliation remain unchanged.
Fresh installation and the new forward update contain the same correction.
Published update scripts remain unchanged.

Validation

PostgreSQL: 434 tests passed, with zero failures, ignored tests, or filtered tests.
Forward updates from 0.3.1, 0.3.2, and rc.1 matched the fresh 2,009-line catalog.
The real protocol fixture delivered 1,001 function scopes and 1,004 total scopes.
It proved connect, reconnect, rebuild, cursor-bearing pull, additions, removals, unchanged assignments, grant union, and two-user isolation.
Real Swift provenance scenarios passed 15 results. Kotlin API24 and API37 each passed 16 results.
The complete retained Linux run passed 626 tests and three packages, with zero failures or skips.
Contract, build, lint, and documentation security checks passed. The corrected documentation audit found zero vulnerabilities.
Exact-head PR CI37237129124 passed source quality, Swift, CodeQL, dependency scanning, and the required aggregate.
Astra accepted the complete diff and reconciled every issue acceptance criterion.
Root confirmed current assignment implementation, tests, adapter, SQL, and native source remain byte-identical to the accepted runtime source.

The retained full run used 5524510, not the final PR head.
Later changes affect package environment controls and preserve the assignment-specific measured source.
Earlier setup, timeout, classification, documentation, and stale-mutant failures remain in this issue's history.
Their successful corrections are separate measured runs.

This closes the development feature criteria.
It does not prove arbitrary-workload capacity, a large native fixture, or release package acceptance.
Release publication and the application dependency update remain pending.

Navigation Menu

Repository navigation

Support administrator-selected unbounded assignment results #300

Required outcome

Evidence

Orchestrator decision

Bounded implementation and acceptance

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support administrator-selected unbounded assignment results #300

Description

Required outcome

Evidence

Orchestrator decision

Bounded implementation and acceptance

Activity

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

mdspinali commented on Oct 3, 2026

8 remaining items

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

mdspinali commented on Oct 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions