55 lines
3.3 KiB
Markdown
55 lines
3.3 KiB
Markdown
# Initial standalone validation, 2026-09-12
|
|
|
|
Implementation commit: `2a0fe1714b8ffb2e80203722bcb7987c630f432d`, signed by Nic Weyand.
|
|
The subsequent completion documentation changes no runtime or packaging code.
|
|
|
|
The baseline is Argand commit `47911062b00d87f215ba61c41965faf8a7f4b7f7`.
|
|
All extracted Rust, migration and provider-license bytes match UPSTREAM.json.
|
|
The extracted operator README changes only its working-directory instruction.
|
|
New files provide independent build metadata, examples, policy and release tooling.
|
|
The lockfile shrank from 642 packages to 246 with no new dependency versions.
|
|
|
|
## Acceptance
|
|
|
|
Linux x86_64, Rust/Cargo 1.98.1, Python 3.14, two Cargo build jobs. Passed:
|
|
|
|
- Rust formatting, all-target compilation and Clippy with warnings denied.
|
|
- All 23 Rust tests, zero failures or ignored tests; strict API documentation.
|
|
- Eight Python source-release tests, Python syntax checks, shell syntax and
|
|
ShellCheck for the check script and every workflow shell step.
|
|
- Native all-five-source fixture import, idempotency, alias lookup, explicit
|
|
identity joining, signed approval/activation, revocation and rollback refusal.
|
|
- Identical native CLI, Rust library example and Python example lookup envelopes,
|
|
including provenance, attribution and multiple regional properties. Every
|
|
consumer refused an incorrect generation pin.
|
|
- Two source archives and receipts from the implementation commit were byte-for-byte
|
|
identical. Receipt pin: `811af8fe2fd1e747b7745a44dba24e2397c01b43381e11846753e284caf6a275`.
|
|
- Full acceptance rerun from the verified archive outside the Git checkout, then
|
|
from `/tmp` to exclude the developer's ancestor Cargo configuration. Neither
|
|
extracted copy had a `.git` directory or accessed Argand's source tree.
|
|
|
|
The primary check took 28.24 seconds with 566,388 KiB peak process RSS after the
|
|
initial compiler check. A separate optimized build took 84.15 seconds with
|
|
602,340 KiB peak RSS. The archive check under `/tmp` took 101.64 seconds with
|
|
569,228 KiB peak RSS, including recompilation. These are local single-run toolchain
|
|
measurements, not serving-latency or full-provider capacity claims. Build output,
|
|
fixtures, disposable keys and detailed logs were retained outside the repository.
|
|
|
|
The final initial inventory was reviewed for credentials, private paths, datasets,
|
|
unrelated files and provenance loss. Source archives exclude private-key and dataset
|
|
extensions, symlinks, submodules, traversal paths and uncommitted changes. Tests
|
|
exercise receipt/archive tampering, duplicate JSON keys, unsafe members and
|
|
no-clobber output. All documentation links resolve locally.
|
|
|
|
## Operational state
|
|
|
|
The code is independently buildable. The public Forgejo repository requires
|
|
signed commits and restricts direct pushes and merges to the maintainer; review
|
|
rules apply to administrators. CI workflow commands were validated locally.
|
|
Actions is disabled pending a dedicated isolated runner, so there is no hosted CI
|
|
run or automatically produced remote artifact claim.
|
|
|
|
No provider dataset was newly acquired, no production approval was fabricated,
|
|
and no dataset timer, public Navigate route or registry generation was promoted.
|
|
Argand's live source/build window remained with its beta agent. Its embedded
|
|
registry dependency has not been replaced; docs/CONSUMERS.md describes cutover.
|