promote: foundation batch and platform gates - #20

Merged

BeforeLights merged 93 commits into

mainfrom

Aug 2, 2026

Commits on Aug 2, 2026

chore(ops): refresh checkpoint and batch policy
BeforeLights
committed
d1a9931
feat(infra): add safe local service lifecycle
BeforeLights
committed
4eff6f5
docs(infra): record local foundation evidence
BeforeLights
committed
8ba1d4e
fix(infra): reject duplicate local host ports
BeforeLights
committed
b0a53c1
test(infra): cover local preflight argument failures
BeforeLights
committed
9ce6b6b
docs(infra): document safe local lifecycle
BeforeLights
committed
9f2d047
test(infra): enforce hosted safety boundaries
BeforeLights
committed
b60d942
test(infra): verify production recovery defaults
BeforeLights
committed
caa090a
feat(infra): add daemon-free compose validation
BeforeLights
committed
7d6d1e3
docs(infra): record compose validation evidence
BeforeLights
committed
77deac3
ci: include infrastructure validation in repo checks
BeforeLights
committed
5de31b0
docs(operations): update foundation verification gates
BeforeLights
committed
917e313
fix(telemetry): ignore accessor-backed diagnostics
BeforeLights
committed
69c4459
docs(telemetry): describe hostile field handling
BeforeLights
committed
b51195c
ci: route infrastructure changes through shared gates
BeforeLights
committed
da3d732
fix(ci): correct infrastructure scope assertion
BeforeLights
committed
7fc973b
docs(operations): add foundation batch handoff
BeforeLights
committed
fcabfb3
docs(orchestration): record foundation batch checkpoint
BeforeLights
committed
e424f1a
test(infra): verify local volume and bucket safety
BeforeLights
committed
76c1882
test(infra): reject destructive local bootstrap SQL
BeforeLights
committed
185fa1d
test(infra): guard lifecycle against destructive Docker cleanup
BeforeLights
committed
7bd479b
test(infra): pin GitHub OIDC deployment subject
BeforeLights
committed
8e5071f
test(infra): keep hosted state outside source
BeforeLights
committed
5fa01f6
feat(infra): configure local disk headroom
BeforeLights
committed
49f82db
feat(infra): enable init supervision for local services
BeforeLights
committed
03b79e0
feat(infra): isolate local service network
BeforeLights
committed
d5c0438
docs(operations): reconcile local infrastructure limits
BeforeLights
committed
8f0b50d
docs(plan): specify local infrastructure lifecycle
BeforeLights
committed
5300d95
docs(infra): document non-applying AWS validation
BeforeLights
committed
f941357
docs(operations): define telemetry safety boundary
BeforeLights
committed
bdaf5f5
feat(infra): bound hosted web object retention
BeforeLights
committed
a548584
feat(infra): harden hosted task containers
BeforeLights
committed
340110d
feat(infra): enable production database insights
BeforeLights
committed
d9f1ad1
docs(infra): document production database insights
BeforeLights
committed
bb8a55b
ci: disable checkout credential persistence
BeforeLights
committed
6d3368c
fix(telemetry): fail closed on hostile Python mappings
BeforeLights
committed
7811dbc
fix(infra): make object lifecycle filter explicit
BeforeLights
committed
ced1568
docs(infra): clarify alpha plan-only workflow
BeforeLights
committed
ad12965
feat(infra): expose daemon-free local preflight
BeforeLights
committed
52fc370
docs(infra): record daemon-free preflight evidence
BeforeLights
committed
a0e4d75
test(infra): pin local telemetry signal pipelines
BeforeLights
committed
b989fa5
fix(infra): match indented collector pipeline config
BeforeLights
committed
b6062dc
fix(infra): correct collector safety assertions
BeforeLights
committed
8cd55cc
fix(infra): require immutable production task images
BeforeLights
committed
5755d79
docs(infra): document digest-pinned production images
BeforeLights
committed
d951d4e
fix(infra): allow wrapped image guidance text
BeforeLights
committed
93a6df6
feat(infra): parameterize worker task capacity
BeforeLights
committed
a78e135
fix(infra): remove unused ECS task secret permissions
BeforeLights
committed
199ce77
ci: bound every runner job with a timeout
BeforeLights
committed
f291fd5
fix(ci): bound release provenance runtime
BeforeLights
committed
385dae7
ci: fail when release artifacts are missing
BeforeLights
committed
d3cf73c
feat(infra): add bounded local log diagnostics
BeforeLights
committed
0cacf2f
fix(infra): validate local compose project names
BeforeLights
committed
e69e5cd
fix(infra): honor safe project override from environment
BeforeLights
committed
560f5d7
ci: require every provenance artifact
BeforeLights
committed
6a0efe7
fix(ci): validate provenance output arguments
BeforeLights
committed
291d3d3
ci: validate SBOM output arguments
BeforeLights
committed
38a4670
test(infra): reject invalid disk threshold environment
BeforeLights
committed
7bef4fd
fix(infra): bound local container log storage
BeforeLights
committed
74737c5
docs(infra): explain local log retention
BeforeLights
committed
511e70c
docs(ci): record supply chain gate evidence
BeforeLights
committed
039de6b
docs(orchestration): refresh foundation batch checkpoint
BeforeLights
committed
f293d1a
docs(operations): record foundation batch commit window
BeforeLights
committed
b1bb092
feat(infra): verify Redis persistence after restart
BeforeLights
committed
20ff047
fix(infra): distinguish restart and persistence checks
BeforeLights
committed
a19917e
fix(telemetry): fail closed on hostile trace headers
BeforeLights
committed
46145ee
docs(telemetry): document hostile header handling
BeforeLights
committed
30421f5
ci: require explicit read-only repository permissions
BeforeLights
committed
0072076
ci: require the protected release environment
BeforeLights
committed
6e5b930
fix(infra): protect hosted web bucket deletion
BeforeLights
committed
f0251d4
docs(orchestration): finalize foundation batch checkpoint
BeforeLights
committed
33a6398
fix(repo): satisfy formatting and lint gates
BeforeLights
committed
d9598a2
docs(operations): record foundation verification boundary
BeforeLights
committed
214e45b
Merge pull request #19 from DatabreezeService/feat/fnd003-local-infra-batch
BeforeLights
authored
0f47f81
test(cli): verify generated artifact contents
BeforeLights
committed
2b79e49
fix(local): bind published services to loopback
BeforeLights
committed
f263be7
fix(local): bound Docker probes and cleanup sentinels
BeforeLights
committed
901d76f
fix(telemetry): normalize hostile reflection failures
BeforeLights
committed
0d5635b
fix(infra): enforce AWS policy and Fargate constraints
BeforeLights
committed
2ebadd5
docs(infra): mark persistence evidence environment-gated
BeforeLights
committed
2286770
test(local): exercise preflight and service topology
BeforeLights
committed
2a1df9e
fix(ci): parse workflow policy as YAML
BeforeLights
committed
806a81f
style(cli): format infrastructure assertions
BeforeLights
committed
24d117d
docs(ci): record external release protection gate
BeforeLights
committed
432fe76
docs(infra): list complete local command surface
BeforeLights
committed
68218b2
style(local): format service lifecycle code
BeforeLights
committed
48a596a
Merge pull request #21 from DatabreezeService/fix/promotion-20-review
BeforeLights
authored
7a242f5
test(telemetry): assert normalized hostile errors
BeforeLights
committed
8118456
fix(infra): scan Terraform blocks safely
BeforeLights
committed
a19238d
fix(ci): require commands in run steps
BeforeLights
committed
01dc664
Merge pull request #22 from DatabreezeService/fix/promotion-20-review
BeforeLights
authored
0172494
test(infra): cover Terraform slash comments
BeforeLights
committed
bfb1214
Merge pull request #23 from DatabreezeService/fix/promotion-20-review
BeforeLights
authored
783a471