v1.1.0

v1.1.0

This release gathers complete standalone local validation, optional hosted
validation that defaults off, the weekly template updater, staged Docker
policies and deployment boundary-v2 adoption guidance.

• Annotated tag object ID: a963f867ca5f9a968d7cb57088870e7cd8f5824e
• Template commit: 32db46f1247b184f267bdc6c401d63b69598fe6e
• Reviewed ci-fleet commit: aa9bbb27a4746fc80ce27d8932de68450b28364b
• Reviewed deployer ci-fleet commit: c67d18d24ceb5f22569d8887b94f7198a448ccde

Complete local validation

scripts/local_validate.py runs all 11 stages without an Actions event, hosted
minutes or a paid account. Source, reviewed head, base, main, stored tree,
independent engine policy and trusted-suite revision/tree have explicit
identities. Coverage includes conventional commits, committed-history secret
scanning, syntax, independent engine policy, stricter standalone transitions,
exact-core/deployer compatibility, initializer success/failure, policy, updater,
release-update and validation-program regressions.

Seven required test inventories come from the pinned standalone suite and
exercise candidate programs. Candidate-owned test files cannot replace or remove
required definitions. Candidate-added IDs are supplemental. Plans require unique
nonempty IDs and matching executed counts; actual skips fail. Initialized
adopters retain the complete public fixtures and applicable candidate checks.
An absent optional workflow receives the pinned local-availability case, not a
runtime skip. Runner self-tests use trusted workflow resources without restoring
that absent candidate workflow.

Initial SHA-only fetches build verified frozen seeds. Each stage uses independent
copies that preserve modes and symlinks without hardlinks or repeated fetches.
The driver checks seeds and stage copies before execution and afterward. Git
identity checks disable replacement refs and grafts and filter inherited Git
overrides. A pinned outer Linux supervisor owns descendants through cleanup.
Adopter policy, updater and release-update stages run their public and candidate
checks together in separate fixtures. Both must pass. The parent assembles both
outputs after supervised cleanup and hashes the authoritative stage log.
Readiness checks require cancellation and timeout fixtures to start before the
tests can pass.

Use the documented supervised disposable Linux environment and separate signing
authority. Manifest and process checks do not sandbox hostile root or transient
same-stage tampering. Signing keys stay off execution machines.

Optional hosted validation and updater

Hosted validation defaults off. Opt-in requires
CI_FLEET_HOSTED_VALIDATION=true, a full reviewed engine SHA in
CI_FLEET_VALIDATOR_REVISION, and a compatible full public standalone-suite SHA
in CI_FLEET_SUITE_REVISION. Candidate, suite and engine occupy separate sibling
checkouts without persisted credentials. The pinned suite's absolute entry point
runs with read-only permissions. Missing or malformed pins fail validation.

Its job is hosted-validation; neither a skipped nor passing result supplies an
existing required validate gate. Application Actions scheduling and self-hosted
fleet-worker routing keep their contract. The convenience flag does not enable
the separately authorized repository-writing updater.

The weekly updater verifies stable annotated-tag, template, ordinary-CI core and
boundary-v2 deployer identities before proposing one reviewed three-way update.
It preserves adopter-owned fleet and active/next-engine evidence. Conflicts,
schema migrations and deployment-boundary changes require manual handling. Its
classic-protection and required-validate write gate remain in force. Verified
manual imports support maintenance after a deliberate local-only cutover.

Configuration and adoption

Fleet schema remains v3. The ordinary-CI compatibility baseline and staging
deployer remain independently pinned to the identities above. Public examples
keep their fictional engine pin and omit unstaged optional fields. The template
adds staged optional Docker default-bridge policy and exclusive-daemon storage
retention, plus review-only initializer fragments and operator adoption guidance.
Engine support, capability staging and private activation remain separate.

Adoption from published v1.0.0 requires manual compatibility review because the
deployment boundary changes from v1 to v2. The updater produces a draft/manual
report and imports no partial change. Follow the verified import procedure in
docs/UPDATING.md. Preserve adopter-owned fleet and delivery configuration,
active and next-engine sidecars, runtime pins, custom application workflows and
immutable release history. Record this release in TEMPLATE_RELEASE only after
publication and independent immutable-identity verification. Historical prepared
v1.0.1 notes, the compatibility preparation record and published v1.0.0 remain
unchanged.

Boundary v2 documents separately authorized external standalone staging
adoption with protected host-local policy and an independent deployer pin.
Production operations, persistent testers, image builders and deploy-ref writers
remain outside that reviewed executable contract. Configuration inventory does
not supply deployment approval or credentials.

Exact merged-source proof

Final release source 32db46f1247b184f267bdc6c401d63b69598fe6e has actual first parent
970e8c75758abe413770da65578b85a18e0f7196 and tree
181539f036e1a417bcf473e49764f35a28c70d42. Original reviewed head and independently pinned
suite are 0e061d5ae1c6ab3052e8537f6aaa85b9ce571edf. The source proof scans both
actual and original reviewed histories. Engine policy remains independently
pinned to the ordinary-CI identity above.

The actual source and a fresh initialized integrated adopter derived directly
from it ran sequentially without competing tests or retries. Both passed all
11 stages with no expected or actual skips. The source took
223.333 seconds; the adopter took 216.172 seconds.

Required corpus	Source	Adopter public	Adopter candidate
Policy	94	94	91
Updater	14	14	14
Release update	6	6	6
Local-validation caller	49	n/a	49
Supervisor	16	n/a	16
Candidate runner	17	n/a	17
Workflow	11	11	1

The adopter has its optional hosted workflow removed and all seven candidate
owned test files neutralized. Reviewed/applied trees match, actual first parents
match their declared base, and prior/current fleet plus active/next sidecars
remain byte-identical. All 22 canonical logs and six paired diagnostic logs were
copied and verified. Fresh bundles recover both actual and original reviewed
source histories and both adopter histories, including complete commit/object
inventories and strict fsck. Final input checkouts are clean and execution roots
are absent.

• Actual source report SHA-256: 648b9ac3158e9788b873519cde4fdf4b9cd50b08fd809a6489d0b769d24d1573
• Initialized-adopter report SHA-256: f8e765c7b56932b4b55bbc6544e03df74c454a61ee6efc6c2235b74efbe40479

These are local unsigned functional results. Earlier over-target local
measurements remain preserved. Optional hosted validation was skipped; no enabled
hosted execution or setup timing is claimed. Its five-minute ceiling remains
unchanged, and these payload times do not prove that hosted checkout and setup
fit within it.

Tooling publication does not activate a host or establish signed host acceptance.
Independent signing authority, compatible-manager and checkpoint recovery,
private engine promotion, host activation and operational policy migration remain
separately authorized work. Established required checks need deliberate coverage,
recovery and policy migration before removal.