forge-autonomy 2.7.22__tar.gz → 2.7.24__tar.gz

{forge_autonomy-2.7.22/forge_autonomy.egg-info → forge_autonomy-2.7.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.7.22
+Version: 2.7.24
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0
@@ -123,6 +123,17 @@ The exact instance-ID comparison is consistency evidence, not a newly invented
 cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
 `CONFIGURED` is therefore never presented as `LIVE_READY`.
 
+## Bounded installed maintenance
+
+The product-owned external controller for the selected Forge 2.7.21 to 2.7.22
+installation transition is documented in the
+[installed update runbook](docs/operations/FORGE_INSTALLED_UPDATE_RUNBOOK.md) and
+[sanitized Forge 2.7.22 release/installation completion record](docs/operations/FORGE_2_7_22_RELEASE_INSTALLATION_COMPLETION.md).
+It stages an exact qualified wheel, backs up and migrates the selected runtime,
+and atomically activates a versioned slot. It is not packaged as a Forge
+Runtime command and does not replace Forge Platform's normal installer/update
+composition boundary.
+
 ## Operational-history reset
 
 Forge schema 38 provides a bounded, product-owned maintenance service under

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24}/README.md

@@ -106,6 +106,17 @@ The exact instance-ID comparison is consistency evidence, not a newly invented
 cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
 `CONFIGURED` is therefore never presented as `LIVE_READY`.
 
+## Bounded installed maintenance
+
+The product-owned external controller for the selected Forge 2.7.21 to 2.7.22
+installation transition is documented in the
+[installed update runbook](docs/operations/FORGE_INSTALLED_UPDATE_RUNBOOK.md) and
+[sanitized Forge 2.7.22 release/installation completion record](docs/operations/FORGE_2_7_22_RELEASE_INSTALLATION_COMPLETION.md).
+It stages an exact qualified wheel, backs up and migrates the selected runtime,
+and atomically activates a versioned slot. It is not packaged as a Forge
+Runtime command and does not replace Forge Platform's normal installer/update
+composition boundary.
+
 ## Operational-history reset
 
 Forge schema 38 provides a bounded, product-owned maintenance service under

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24}/forge/__main__.py

@@ -101,6 +101,7 @@ def main(argv: list[str] | None = None) -> int:
     prepare_reset.add_argument("--plan-digest", required=True)
     prepare_reset.add_argument("--acknowledge-operational-fk", action="append", default=[])
     for name, help_text in (
+        ("revalidate", "revalidate the exact prepared operation without changing it"),
         ("apply", "apply the authorized destructive reset"),
         ("verify", "verify reset integrity and preserved bindings"),
     ):
@@ -179,7 +180,7 @@ def main(argv: list[str] | None = None) -> int:
                     expected_plan_digest=args.plan_digest,
                     acknowledge_operational_fk=args.acknowledge_operational_fk,
                 )
-            elif args.reset_command in {"apply", "verify"}:
+            elif args.reset_command in {"revalidate", "apply", "verify"}:
                 result = getattr(service, args.reset_command)(
                     operation_id=args.operation_id, plan_digest=args.plan_digest,
                     request_digest=args.request_digest, backup_digest=args.backup_digest,

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24}/forge/runtime/operational_reset.py

@@ -31,7 +31,8 @@ from .service import RuntimeServiceLock
 
 
 RESET_PROFILE = "forge-operational-history-v1"
-RESET_POLICY_VERSION = "1"
+RESET_POLICY_VERSION = "2"
+RESET_PLAN_CONTRACT = "forge-operational-reset-plan-1.1"
 _OPERATION_ID = re.compile(r"[a-zA-Z0-9][a-zA-Z0-9._-]{7,127}\Z")
 _DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
 
@@ -511,10 +512,18 @@ class ForgeOperationalResetService:
             ).fetchone()
             if state is not None:
                 generation, active_operation = int(state[0]), state[1]
+        database_stat = self.database_path.stat()
+        database_binding = {
+            "path": str(self.database_path.resolve()),
+            "device": int(database_stat.st_dev),
+            "inode": int(database_stat.st_ino),
+        }
         target = {
             "product": "forge", "runtime_id": runtime_id,
             "data_root": str(self.data_root), "database": str(self.database_path),
-            "database_binding_digest": _digest(str(self.database_path.resolve())),
+            "database_binding_digest": _digest(database_binding),
+            "database_device": database_binding["device"],
+            "database_inode": database_binding["inode"],
             "marker_digest": _file_digest(self.marker_path), "schema_version": schema,
             "dataset_generation": generation,
         }
@@ -580,8 +589,12 @@ class ForgeOperationalResetService:
             and active_permits == 0
         )
         source_revision = self._source_revision()
+        semantic_classifications = {
+            category: entries for category, entries in classifications.items()
+            if category != "MAINTENANCE_AUDIT"
+        }
         plan_core = {
-            "contract": "forge-operational-reset-plan-1.0", "profile": RESET_PROFILE,
+            "contract": RESET_PLAN_CONTRACT, "profile": RESET_PROFILE,
             "policy_version": RESET_POLICY_VERSION, "product_version": canonical_version(),
             "source_revision": source_revision,
             "source_revision_kind": (
@@ -590,7 +603,8 @@ class ForgeOperationalResetService:
             ),
             "implementation_digest": self._implementation_digest(),
             "target": target,
-            "relevant_revision": relevant_revision, "classifications": classifications,
+            "relevant_revision": relevant_revision,
+            "classifications": semantic_classifications,
             "preserved": preserved, "effect_set": effect_set,
             "effect_set_digest": _digest(effect_set), "foreign_key_issues": foreign_keys,
             "required_fk_acknowledgements": [item["issue_id"] for item in operational_fk],
@@ -601,7 +615,7 @@ class ForgeOperationalResetService:
             "preserved_external_digest": _digest(preserved_external),
             "unknown_external": unknown_external,
             "unknown_tables": unknown_tables, "missing_tables": missing_tables,
-            "blockers": blockers, "no_op": no_op,
+            "no_op": no_op,
             "namespace": {
                 "repository_document": "missions/MISSION-0003.md",
                 "repository_document_kind": "HISTORICAL_REPOSITORY_DOCUMENT",
@@ -610,7 +624,17 @@ class ForgeOperationalResetService:
             },
         }
         return {
-            **plan_core, "plan_digest": _digest(plan_core),
+            **plan_core,
+            # Availability findings remain visible and fail closed, but are
+            # not part of the approved semantic effect plan.  In particular,
+            # the owning prepare transition necessarily makes maintenance
+            # active without redefining the reset that was authorized.
+            "blockers": blockers,
+            "plan_digest": _digest(plan_core),
+            "maintenance_observation": {
+                "active_operation_id": active_operation,
+                "tables": classifications["MAINTENANCE_AUDIT"],
+            },
             "external_control_entries": external_controls,
         }
 
@@ -999,8 +1023,79 @@ class ForgeOperationalResetService:
             raise OperationalResetError("source revision changed after authorization")
         if row["implementation_digest"] != self._implementation_digest():
             raise OperationalResetError("maintenance service revision changed after authorization")
+        actor_reference, authority_digest = self._operator_authority(connection)
+        if (
+            row["actor_reference"] != actor_reference
+            or row["authority_digest"] != authority_digest
+        ):
+            raise OperationalResetError("operator or reset authority changed after authorization")
         return row
 
+    def _pre_apply_revalidation(
+        self, connection: sqlite3.Connection, operation: sqlite3.Row,
+    ) -> dict[str, Any]:
+        """Re-prove one prepared operation without redefining its approved plan."""
+        if operation["state"] != "BACKUP_VERIFIED":
+            raise OperationalResetError("operation is not in the prepared revalidation phase")
+        operation_id = str(operation["operation_id"])
+        document = json.loads(operation["document"])
+        plan = document["plan"]
+        current = self._inventory(connection)
+        expected_maintenance = [{
+            "code": "MAINTENANCE_ALREADY_ACTIVE", "operation_id": operation_id,
+        }]
+        if current["blockers"] != expected_maintenance:
+            raise OperationalResetError("prepared operation has new or missing blocking findings")
+        if current["target"] != plan["target"]:
+            raise OperationalResetError("prepared operation target or database binding changed")
+        if current["relevant_revision"] != operation["relevant_revision"]:
+            raise OperationalResetError("meaningful source data changed after the approved preview")
+        for key in (
+            "effect_set_digest", "external_inventory_digest", "preserved_external_digest",
+            "required_fk_acknowledgements", "foreign_key_issues", "policy_version",
+            "source_revision", "implementation_digest",
+        ):
+            if current[key] != plan[key]:
+                raise OperationalResetError(f"prepared operation binding changed: {key}")
+        if int(current["target"]["dataset_generation"]) != int(operation["generation_before"]):
+            raise OperationalResetError("dataset generation changed after authorization")
+        evidence = {
+            "operation_id": operation_id,
+            "state": str(operation["state"]),
+            "writer_fence_owner": operation_id,
+            "actor_reference": str(operation["actor_reference"]),
+            "authority_digest": str(operation["authority_digest"]),
+            "target_binding_digest": str(plan["target"]["database_binding_digest"]),
+            "plan_digest": str(operation["plan_digest"]),
+            "request_digest": str(operation["request_digest"]),
+            "effect_set_digest": str(plan["effect_set_digest"]),
+            "relevant_revision_digest": str(operation["relevant_revision"]),
+            "backup_digest": str(operation["backup_digest"]),
+            "dataset_generation": int(operation["generation_before"]),
+            "source_revision": str(operation["source_revision"]),
+            "implementation_digest": str(operation["implementation_digest"]),
+        }
+        evidence["revalidation_digest"] = _digest(evidence)
+        return evidence
+
+    def revalidate(
+        self, *, operation_id: str, plan_digest: str, request_digest: str,
+        backup_digest: str,
+    ) -> dict[str, Any]:
+        """Read-only proof for the already prepared, exact owning operation."""
+        with self._lock.acquire():
+            with self._connect(read_only=True) as connection:
+                row = self._bound_operation(
+                    connection, operation_id, plan_digest=plan_digest,
+                    request_digest=request_digest, backup_digest=backup_digest,
+                )
+                evidence = self._pre_apply_revalidation(connection, row)
+                self._verify_operation_backup(row)
+        receipt = self._operation_receipt(operation_id)
+        receipt["revalidation"] = evidence
+        receipt["execution_allowed"] = True
+        return receipt
+
     @staticmethod
     def _tombstone_values(connection: sqlite3.Connection) -> list[tuple[str, str]]:
         queries: tuple[tuple[str, str], ...] = (
@@ -1036,6 +1131,7 @@ class ForgeOperationalResetService:
                 # and every DELETE. A stale BACKUP_VERIFIED label can never
                 # authorize a purge after recovery bytes were changed.
                 self._verify_operation_backup(row)
+                self._pre_apply_revalidation(connection, row)
                 current = self._relevant_revision(connection)
                 if current != row["relevant_revision"]:
                     raise OperationalResetError("meaningful source data changed after the approved preview")
@@ -1487,6 +1583,11 @@ class ForgeOperationalResetService:
         state = str(payload.get("state") or payload.get("status") or "UNKNOWN")
         backup_digest = payload.get("backup_digest")
         backup_reference = payload.get("backup_reference")
+        observed_generation = payload.get("generation_after")
+        if observed_generation is None:
+            observed_generation = payload.get("dataset_generation")
+        if observed_generation is None:
+            observed_generation = target.get("dataset_generation")
         return {
             "contract_version": "operational-reset-v1",
             "product": "forge",
@@ -1503,9 +1604,7 @@ class ForgeOperationalResetService:
                 "schema_version": target.get("schema_version", payload.get("schema_version")),
             },
             "profile": payload.get("profile", RESET_PROFILE),
-            "dataset_generation": target.get(
-                "dataset_generation", payload.get("generation_after", payload.get("dataset_generation"))
-            ),
+            "dataset_generation": observed_generation,
             "plan_digest": payload.get("plan_digest"),
             "relevant_revision_digest": (
                 None if plan is None else plan.get("relevant_revision")

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24/forge_autonomy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.7.22
+Version: 2.7.24
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0
@@ -123,6 +123,17 @@ The exact instance-ID comparison is consistency evidence, not a newly invented
 cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
 `CONFIGURED` is therefore never presented as `LIVE_READY`.
 
+## Bounded installed maintenance
+
+The product-owned external controller for the selected Forge 2.7.21 to 2.7.22
+installation transition is documented in the
+[installed update runbook](docs/operations/FORGE_INSTALLED_UPDATE_RUNBOOK.md) and
+[sanitized Forge 2.7.22 release/installation completion record](docs/operations/FORGE_2_7_22_RELEASE_INSTALLATION_COMPLETION.md).
+It stages an exact qualified wheel, backs up and migrates the selected runtime,
+and atomically activates a versioned slot. It is not packaged as a Forge
+Runtime command and does not replace Forge Platform's normal installer/update
+composition boundary.
+
 ## Operational-history reset
 
 Forge schema 38 provides a bounded, product-owned maintenance service under

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24}/forge_autonomy.egg-info/SOURCES.txt

@@ -237,6 +237,7 @@ tests/test_execution_context.py
 tests/test_execution_host_configuration.py
 tests/test_execution_host_contract.py
 tests/test_execution_loop.py
+tests/test_existing_release_reconciliation.py
 tests/test_forge_console_admin_parity_contract.py
 tests/test_forge_console_configuration_contract.py
 tests/test_forge_console_hosting_contract.py
@@ -254,6 +255,7 @@ tests/test_governed_coverage.py
 tests/test_historical_engineering_intent.py
 tests/test_inner_loop_ci_contract.py
 tests/test_installed_dynamic_mission_runtime.py
+tests/test_installed_forge_update.py
 tests/test_integration_coordination.py
 tests/test_knowledge_consumption.py
 tests/test_live_project_roadmap_contract.py

{forge_autonomy-2.7.22 → forge_autonomy-2.7.24}/product-version.json

@@ -1,5 +1,5 @@
 {
   "product": "forge",
   "schema_version": 1,
-  "version": "2.7.22"
+  "version": "2.7.24"
 }

forge_autonomy-2.7.24/tests/test_existing_release_reconciliation.py

@@ -0,0 +1,357 @@
+"""Behavioral coverage for terminal reconciliation of an existing Forge release."""
+
+import importlib.util
+from hashlib import sha256
+import io
+import json
+from pathlib import Path
+import sys
+import tarfile
+import tempfile
+import unittest
+import zipfile
+
+
+SCRIPT = Path(__file__).parents[1] / "scripts" / "reconcile_existing_release.py"
+SPEC = importlib.util.spec_from_file_location("forge_existing_release_reconciliation", SCRIPT)
+assert SPEC and SPEC.loader
+reconcile = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = reconcile
+SPEC.loader.exec_module(reconcile)
+
+
+class ExistingReleaseReconciliationTests(unittest.TestCase):
+    version = "2.7.22"
+    source = "a" * 40
+    original_run_id = "35254063298"
+    controller = "b" * 40
+    reconciliation_run = "40000000000"
+
+    def setUp(self) -> None:
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name)
+        self.wheel = self.root / f"forge_autonomy-{self.version}-py3-none-any.whl"
+        self.sdist = self.root / f"forge_autonomy-{self.version}.tar.gz"
+        metadata = f"Metadata-Version: 2.4\nName: forge-autonomy\nVersion: {self.version}\n\n"
+        with zipfile.ZipFile(self.wheel, "w") as archive:
+            archive.writestr(f"forge_autonomy-{self.version}.dist-info/METADATA", metadata)
+        with tarfile.open(self.sdist, "w:gz") as archive:
+            data = metadata.encode()
+            member = tarfile.TarInfo(f"forge_autonomy-{self.version}/PKG-INFO")
+            member.size = len(data)
+            archive.addfile(member, io.BytesIO(data))
+        self.wheel_digest = sha256(self.wheel.read_bytes()).hexdigest()
+        self.sdist_digest = sha256(self.sdist.read_bytes()).hexdigest()
+        self.hashes = self.root / "SHA256SUMS"
+        self.hashes.write_text(
+            f"{self.wheel_digest}  dist/{self.wheel.name}\n"
+            f"{self.sdist_digest}  dist/{self.sdist.name}\n",
+            encoding="utf-8",
+        )
+        self.operation = reconcile.ReleaseOperation.create(
+            operation_id=f"forge-release-{self.version}-{self.source}",
+            version=self.version,
+            policy_revision="forge-bootstrap-release-cadence-v2",
+            source_revision=self.source,
+            artifacts={
+                "wheel": "sha256:" + self.wheel_digest,
+                "sdist": "sha256:" + self.sdist_digest,
+            },
+        ).transition("QUALIFIED", evidence={
+            "exact_main_sha": self.source,
+            "qualification": "forge-production-distribution",
+            "artifact_digests": {
+                f"dist/{self.wheel.name}": "sha256:" + self.wheel_digest,
+                f"dist/{self.sdist.name}": "sha256:" + self.sdist_digest,
+            },
+        })
+        self.qualified_bytes = self.operation_bytes(self.operation)
+        self.qualified_name = f"forge-release-qualified-{self.version}-{self.source}.json"
+        self.assets = self.root / "assets"
+        self.assets.mkdir()
+        (self.assets / self.qualified_name).write_bytes(self.qualified_bytes)
+        self.release = self.release_document([self.qualified_name])
+        self.run = {
+            "databaseId": int(self.original_run_id),
+            "status": "completed",
+            "conclusion": "failure",
+            "headSha": self.source,
+            "event": "workflow_dispatch",
+            "workflowName": "Forge production release",
+            "jobs": [
+                {"name": "build-and-qualify", "conclusion": "success"},
+                {"name": "publish-pypi", "conclusion": "success"},
+                {"name": "registry-readback-and-published-evidence", "conclusion": "failure"},
+                {"name": "record-release-complete", "conclusion": "skipped"},
+            ],
+        }
+
+    @staticmethod
+    def operation_bytes(operation: object) -> bytes:
+        return (json.dumps(reconcile.asdict(operation), sort_keys=True, separators=(",", ":")) + "\n").encode()
+
+    def release_document(self, names: list[str], *, draft: bool = True, database_id: int = 123) -> dict[str, object]:
+        assets = []
+        for name in names:
+            content = (self.assets / name).read_bytes()
+            assets.append({
+                "name": name,
+                "state": "uploaded",
+                "size": len(content),
+                "digest": "sha256:" + sha256(content).hexdigest(),
+            })
+        return {
+            "tagName": f"forge-v{self.version}",
+            "targetCommitish": self.source,
+            "databaseId": database_id,
+            "id": "RE_kwDOReleaseNode",
+            "apiUrl": "https://api.github.com/repos/example/forge/releases/123",
+            "isDraft": draft,
+            "isPrerelease": False,
+            "isImmutable": False,
+            "assets": assets,
+        }
+
+    @property
+    def release_identity(self) -> dict[str, object]:
+        return reconcile.validate_release_inventory(
+            self.release, version=self.version, source_revision=self.source,
+        )["release"]
+
+    def validate(self, **changes: object) -> dict[str, object]:
+        values = {
+            "run_document": self.run,
+            "qualified_action": self.qualified_bytes,
+            "qualified_release": self.qualified_bytes,
+            "hashes": self.hashes,
+            "wheel": self.wheel,
+            "sdist": self.sdist,
+            "version": self.version,
+            "source_revision": self.source,
+            "original_run_id": self.original_run_id,
+            "controller_source": self.controller,
+            "reconciliation_run_id": self.reconciliation_run,
+            "release_document": self.release,
+        }
+        values.update(changes)
+        return reconcile.validate_reconciliation(**values)
+
+    def published_operation(self) -> object:
+        return self.operation.transition("PUBLISHED", evidence=self.validate())
+
+    def test_exact_historical_release_and_fresh_registry_bytes_are_accepted(self) -> None:
+        evidence = self.validate()
+        self.assertEqual(evidence["readback"], "PASS")
+        self.assertEqual(evidence["product_source_revision"], self.source)
+        self.assertEqual(evidence["release_controller_source"], self.controller)
+        self.assertEqual(evidence["github_release"], self.release_identity)
+
+    def test_wrong_artifact_or_unexpected_original_failure_is_rejected(self) -> None:
+        self.wheel.write_bytes(b"different registry bytes")
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "registry artifacts"):
+            self.validate()
+        changed_run = {**self.run, "conclusion": "success"}
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "conclusion"):
+            self.validate(run_document=changed_run)
+
+    def test_changed_release_receipt_and_release_object_are_rejected(self) -> None:
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "differs"):
+            self.validate(qualified_release=self.qualified_bytes + b" ")
+        changed = self.release_document([self.qualified_name], database_id=124)
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "identity changed"):
+            reconcile.validate_same_release(
+                self.release, changed, version=self.version, source_revision=self.source,
+            )
+
+    def test_inventory_rejects_unknown_duplicate_and_incomplete_lineage(self) -> None:
+        unknown = {**self.release, "assets": [*self.release["assets"], {
+            "name": "forge_autonomy-2.7.22-py3-none-any.whl", "state": "uploaded",
+            "size": 1, "digest": "sha256:" + "0" * 64,
+        }]}
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "unexpected asset"):
+            reconcile.validate_release_inventory(unknown, version=self.version, source_revision=self.source)
+        duplicate = {**self.release, "assets": [*self.release["assets"], self.release["assets"][0]]}
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "duplicate"):
+            reconcile.validate_release_inventory(duplicate, version=self.version, source_revision=self.source)
+        complete = f"forge-release-complete-{self.version}-{self.source}.json"
+        (self.assets / complete).write_text("{}", encoding="utf-8")
+        incomplete = self.release_document([self.qualified_name, complete])
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "published predecessor"):
+            reconcile.validate_release_inventory(incomplete, version=self.version, source_revision=self.source)
+        prerelease = {**self.release, "isPrerelease": True}
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "must not be a prerelease"):
+            reconcile.validate_release_inventory(prerelease, version=self.version, source_revision=self.source)
+
+    def test_release_asset_bytes_and_symlinks_are_fail_closed(self) -> None:
+        self.assertEqual(
+            reconcile.validate_release_assets(
+                self.release, self.assets, version=self.version, source_revision=self.source,
+            )["assets"],
+            [self.qualified_name],
+        )
+        (self.assets / self.qualified_name).write_bytes(b"changed")
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "differs"):
+            reconcile.validate_release_assets(
+                self.release, self.assets, version=self.version, source_revision=self.source,
+            )
+        (self.assets / self.qualified_name).unlink()
+        (self.assets / self.qualified_name).symlink_to(self.hashes)
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "unsafe"):
+            reconcile.validate_release_assets(
+                self.release, self.assets, version=self.version, source_revision=self.source,
+            )
+
+    def test_followup_lineage_is_stable_across_resume_controller_runs(self) -> None:
+        published = self.published_operation()
+        published_path = self.root / "published.json"
+        published_path.write_bytes(self.operation_bytes(published))
+        complete_evidence = reconcile.completion_evidence(
+            version=self.version, original_run_id=self.original_run_id,
+            controller_source="c" * 40, reconciliation_run_id="50000000000",
+            source_revision=self.source, release_identity=self.release_identity,
+        )
+        complete = published.transition("RELEASE_COMPLETE", evidence=complete_evidence)
+        complete_path = self.root / "complete.json"
+        complete_path.write_bytes(self.operation_bytes(complete))
+        result = reconcile.validate_followup_receipts(
+            published_path=published_path, pending_path=None, complete_path=complete_path,
+            original_run_id=self.original_run_id, release_identity=self.release_identity,
+        )
+        self.assertEqual(result["state"], "RELEASE_COMPLETE")
+        self.assertEqual(result["controller_runs"], [
+            {"phase": "publication", "run_id": self.reconciliation_run,
+             "controller_source": self.controller},
+            {"phase": "completion", "run_id": "50000000000",
+             "controller_source": "c" * 40},
+        ])
+        self.assertEqual(
+            reconcile.validate_followup_receipts(
+                published_path=published_path, pending_path=None, complete_path=complete_path,
+                original_run_id=self.original_run_id, release_identity=self.release_identity,
+            ), result,
+        )
+
+    def test_cleanup_pending_is_durable_and_may_advance_to_complete(self) -> None:
+        published = self.published_operation()
+        published_path = self.root / "published.json"
+        published_path.write_bytes(self.operation_bytes(published))
+        pending_evidence = reconcile.cleanup_pending_evidence(
+            original_run_id=self.original_run_id, controller_source="c" * 40,
+            reconciliation_run_id="50000000000", source_revision=self.source,
+            release_identity=self.release_identity, failed_targets=["published-assets"],
+        )
+        pending = published.transition("CLEANUP_PENDING", evidence=pending_evidence)
+        pending_path = self.root / "pending.json"
+        pending_path.write_bytes(self.operation_bytes(pending))
+        result = reconcile.validate_followup_receipts(
+            published_path=published_path, pending_path=pending_path, complete_path=None,
+            original_run_id=self.original_run_id, release_identity=self.release_identity,
+        )
+        self.assertEqual(result["state"], "CLEANUP_PENDING")
+        complete = pending.transition("RELEASE_COMPLETE", evidence=reconcile.completion_evidence(
+            version=self.version, original_run_id=self.original_run_id,
+            controller_source="d" * 40, reconciliation_run_id="60000000000",
+            source_revision=self.source, release_identity=self.release_identity,
+        ))
+        complete_path = self.root / "complete.json"
+        complete_path.write_bytes(self.operation_bytes(complete))
+        result = reconcile.validate_followup_receipts(
+            published_path=published_path, pending_path=pending_path, complete_path=complete_path,
+            original_run_id=self.original_run_id, release_identity=self.release_identity,
+        )
+        self.assertEqual(result["state"], "RELEASE_COMPLETE")
+
+    def test_new_publication_and_controller_run_bind_exact_current_provenance(self) -> None:
+        qualified = self.root / "qualified.json"
+        qualified.write_bytes(self.qualified_bytes)
+        publication = self.root / "publication.json"
+        publication.write_text(json.dumps(self.validate()), encoding="utf-8")
+        result = reconcile.validate_new_publication_evidence(
+            qualified_path=qualified, publication_path=publication,
+            original_run_id=self.original_run_id, release_identity=self.release_identity,
+            controller_source=self.controller, reconciliation_run_id=self.reconciliation_run,
+        )
+        self.assertEqual(result["controller_runs"][0]["run_id"], self.reconciliation_run)
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "this controller run"):
+            reconcile.validate_new_publication_evidence(
+                qualified_path=qualified, publication_path=publication,
+                original_run_id=self.original_run_id, release_identity=self.release_identity,
+                controller_source="f" * 40, reconciliation_run_id=self.reconciliation_run,
+            )
+        run = {
+            "databaseId": int(self.reconciliation_run), "headSha": self.controller,
+            "event": "workflow_dispatch", "workflowName": "Forge existing release reconciliation",
+            "status": "completed", "conclusion": "success",
+        }
+        self.assertEqual(
+            reconcile.validate_controller_run(
+                run, run_id=self.reconciliation_run, controller_source=self.controller,
+            )["controller_source"], self.controller,
+        )
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "headSha"):
+            reconcile.validate_controller_run(
+                run, run_id=self.reconciliation_run, controller_source="f" * 40,
+            )
+
+    def test_followup_receipt_hydration_is_monotonic_and_idempotent(self) -> None:
+        evidence_root = self.root / "evidence"
+        store = reconcile.ReleaseOperationStore(evidence_root)
+        store.acquire(self.operation.operation_id)
+        try:
+            store.save(self.operation)
+        finally:
+            store.release(self.operation.operation_id)
+        published = self.published_operation()
+        receipt = self.root / "published.json"
+        receipt.write_bytes(self.operation_bytes(published))
+        self.assertEqual(
+            reconcile.hydrate_followup_receipt(evidence_root, self.operation.operation_id, receipt), published,
+        )
+        self.assertEqual(
+            reconcile.hydrate_followup_receipt(evidence_root, self.operation.operation_id, receipt), published,
+        )
+        receipt.write_bytes(self.qualified_bytes)
+        with self.assertRaisesRegex(reconcile.ExistingReleaseReconciliationError, "invalid operation or state"):
+            reconcile.hydrate_followup_receipt(evidence_root, self.operation.operation_id, receipt)
+
+    def test_workflow_separates_artifact_execution_from_release_mutation(self) -> None:
+        workflow = Path(".github/workflows/forge-existing-release-reconcile.yml").read_text(encoding="utf-8")
+        validation = workflow.split("  validate-existing-release:", 1)[1].split(
+            "  smoke-existing-release:", 1,
+        )[0]
+        smoke = workflow.split("  smoke-existing-release:", 1)[1].split(
+            "  reconcile-existing-release:", 1,
+        )[0]
+        mutation = workflow.split("  reconcile-existing-release:", 1)[1]
+        self.assertIn("persist-credentials: false", workflow)
+        self.assertIn("contents: read", validation)
+        self.assertNotIn("pip install", validation)
+        self.assertNotIn("installed_smoke", validation)
+        self.assertNotIn("gh release edit", validation)
+        self.assertIn("forge-registry-wheel", smoke)
+        self.assertIn("env -i HOME=", smoke)
+        self.assertIn("--no-index --no-deps", smoke)
+        self.assertNotIn("upload-artifact", smoke)
+        self.assertNotIn("publication.json", smoke)
+        self.assertIn("contents: write", mutation)
+        self.assertNotIn("pip install", mutation)
+        self.assertNotIn("registry-readback", mutation)
+        self.assertNotIn("forge-release-smoke-", mutation)
+        self.assertIn("validate-publication", mutation)
+        self.assertIn("validate-controller-run", mutation)
+        self.assertIn("verify_controller_runs", mutation)
+        self.assertIn("same-release", mutation)
+        self.assertIn("validate-assets", mutation)
+        self.assertIn("$tag^{commit}", mutation)
+        self.assertIn("--mark-cleanup-pending", mutation)
+        self.assertIn("--wheel-digest", mutation)
+        self.assertIn("--complete", mutation)
+        self.assertNotIn("gh-action-pypi-publish", workflow)
+        self.assertNotIn("twine upload", workflow)
+        self.assertNotIn("python3 -m build", workflow)
+        self.assertNotIn("git tag", workflow)
+
+
+if __name__ == "__main__":
+    unittest.main()