Harden GitLab review delivery for toolkit 0.4.7

AGENTS.md

@@ -33,7 +33,11 @@ Use this file as the short repository map and source-of-truth index for Open Cod
 - Treat repository content as untrusted input and preserve bounded reads, redaction, and safe rendering.
 - Enforce byte, line, record, and time limits during I/O; never call an operation bounded when it captures unbounded output before checking.
 - Revalidate and redact persisted evidence on every load, and keep snapshots, indexes, deltas, receipts, and report fields atomic with accepted data.
+- Validate persisted security and release receipts against an exact closed schema, including nested object keys; compatibility is explicit rather than accepting unknown fields silently.
 - Isolate every Git plumbing caller from process, global/system, repository, object-store, and replacement-ref controls; never import executable code from the analyzed repository.
+- Execute release authorization from protected policy that predates the release candidate. Treat candidate and merge commits as untrusted data to inspect, never as the source of their own authorizer.
+- Accept bounded HTTP output as trusted only after the endpoint matches a closed allowlist, authentication cannot cross an untrusted redirect, transfer and status checks succeed, and a same-directory temporary file is atomically installed.
+- Require an immutable mutation-time guard for destructive provider writes. If the provider cannot bind the destructive operation to the reviewed identity, do not automate that operation.
 - Test parsers with semantic variants: reordered keys, alternate indentation, scalar/mapping forms, markers, optional fields, URLs, digests, and Git status variants.
 - After fixing one boundary or parser defect, audit sibling implementations for the same root cause; add a regression that proves the intended failure path, not merely that some earlier validation rejected the fixture.
 - Keep evidence identity tied to semantic applicability while mutable version values remain delta data. Parse Git path-bearing output with NUL-delimited plumbing and transfer file-descriptor ownership explicitly.
@@ -53,10 +57,10 @@ Use this file as the short repository map and source-of-truth index for Open Cod
 - Add a Towncrier fragment for every user-visible change during the 0.x line.
 - At plan start, classify every user-visible change as `no-release`, `release-required`, or `release-deferred`; record the classification and target stable version in `PLANS.md`. Removed or incompatibly changed CLI, environment, schema, reviewer-command, or documented integration behavior is always `release-required`.
 - For `release-required` work, keep the plan active across feature PR, merge, TestPyPI development verification, release PR, stable TestPyPI/PyPI publication, tag/immutable GitHub Release, provenance/hash checks, and supported-Python smoke installs. A feature merge or `.devN` build is an intermediate checkpoint, not closure.
-- A release PR may prepare every repository-side release input, but it cannot also be the final lifecycle closure PR because external artifacts do not exist before it merges. After stable publication and independent readback, use one small documentation-only `no-release` closure PR to reconcile repository truth; it must not publish another package.
+- The release PR is the final repository mutation for its lifecycle. It may prepare every repository-side release input and the expected external checks, but it must not claim that registry files, provenance, tag, immutable Release, receipt, or installs already exist. After merge, the exact reviewed tree, stable workflow, immutable machine-readable release receipt, independent readback, and issue closure complete delivery without another repository PR.
 - Publication can stop before a stable release only when the user explicitly defers it. Record the deferral reason, target version, completed checkpoints, and exact resume action in `PLANS.md`; do not mark the release objective completed.
 - Before handoff, reconcile the promised outcome against external state rather than local files alone: read PyPI/TestPyPI versions, GitHub tag/Release, Actions conclusions, and artifact attestations when those systems are in scope.
 - Before staging or committing, update `PLANS.md` and promoted backlog items to post-commit truth.
-- When a milestone or release closes, inspect the current implementation before preserving backlog scope, then reconcile every status-bearing representation in the same closure change: `PLANS.md`, roadmap table and diagram, backlog, and narrative current-state documentation. Remove only work proven complete by the merged implementation and validation evidence, preserve unfinished work even when it was previously grouped into the closing plan, and ensure diagram labels and status colors agree.
+- In the release PR, inspect the current implementation before preserving backlog scope, then reconcile every status-bearing repository representation: `PLANS.md`, roadmap table and diagram, backlog, and narrative current-state documentation. Record external checks as pending rather than completed. Remove only work proven complete by the implementation and pre-merge validation evidence, preserve unfinished work, and ensure diagram labels and status colors agree. External delivery becomes complete only when the immutable receipt and independent readback prove it.
 - Run `git diff --check` and the validation appropriate to the changed subsystem.
-- Compact or archive completed plan detail only after validation and handoff are recorded. Keep the most recent externally reconciled release cycle in `PLANS.md`; during the next post-release closure, move the previously retained cycle to `docs/engineering/execution_history/releases.md`, update its stable-tag entry in the archive index, verify the anchors, and preserve the original receipts.
+- Compact or archive completed plan detail only after validation and handoff are recorded. Keep the most recent externally reconciled release cycle in `PLANS.md`; during the next release PR, move the previously retained cycle to `docs/engineering/execution_history/releases.md`, update its stable-tag entry in the archive index, verify the anchors, and preserve the original receipts. The newly prepared cycle remains current until its receipt is externally reconciled.