release: gate the v0.2.4 cut on physical Debian 13 validation

[SSobol77]

Purpose

Track the final ECLI v0.2.4 release-cut gate without tagging, publishing, or merging the Debian installer prematurely.

Release branch

The release branch has been cut from the approved post-PR-145 main baseline:

release/v0.2.4
0f60a83d22a6f848d05da270b23ba401f0261864

The branch is present locally and on origin at the same commit.

Debian validation implementation

The Debian installer work is carried by:

test/v0.2.4-debian-installer
3c97d8f610ad53808703ba3c08cce143fcd65caf

The implementation commit is:

8c7b158fd32d0808af89aa18273dc3e181b3b6a1

The follow-up test-isolation commit is:

3c97d8f610ad53808703ba3c08cce143fcd65caf

The implementation has completed independent source, artifact, reproducibility, Lintian, lifecycle, Debian 13 container clean-room review, and cross-platform contract validation.

Final Debian artifact candidate:

releases/0.2.4/ecli_0.2.4_linux_x86_64.deb

SHA-256:

020148a9b934ba5a972d7bb2bb83d25ad7937d11bcf6e607b1ff909e5a579fe9

Validated engineering contract

The Debian path uses two explicit stages:

1. run the standalone ECLI linter installer;
2. install the ECLI .deb.

The validated toolchain contract is:

11 managed tools
8 Debian-provided tools
19 provisioned and verified executables
14 registered F4 diagnostic providers

The .deb does not download linters, run package managers from maintainer scripts, or mutate user home directories.

GitHub validation status

Draft PR #147 is open against release/v0.2.4 and remains unmerged.

All required contract workflows passed on the exact head:

3c97d8f610ad53808703ba3c08cce143fcd65caf

• CI: PASS — https://github.com/SSobol77/ecli/actions/runs/29203098806
• PyPI Contract Validate: PASS — https://github.com/SSobol77/ecli/actions/runs/29203103953
• macOS Contract Validate: PASS — https://github.com/SSobol77/ecli/actions/runs/29203111258
• Windows Contract Validate: PASS — https://github.com/SSobol77/ecli/actions/runs/29203119075

Mandatory remaining gate

The installer must be physically validated on a second clean machine running Debian 13 amd64.

The physical test must verify:

• Python bootstrap and the complete four-file linter-installer bundle;
• one full linter installation using the interactive A selection;
• dependency installation;
• /opt/ecli/payload ownership and permissions;
• /etc/profile.d/ecli_payload.sh PATH activation;
• 19/19 version probes;
• ECLI .deb checksum verification and installation;
• ecli --version;
• ecli --f4-check;
• real F4 Diagnostics use from the installed application;
• reinstall;
• upgrade behavior where applicable;
• remove and purge;
• preservation of user-owned data.

Any problem discovered during the physical test must be fixed on the same Debian validation branch, re-run through CI/review, and physically revalidated before merge.

Publication boundary

Until the physical Debian 13 validation passes:

• do not merge the Debian validation PR;
• do not merge the release branch to main;
• do not tag v0.2.4;
• do not create a GitHub Release;
• do not publish to PyPI;
• do not start publication of the complete 21-artifact release matrix;
• do not claim completed clean-machine Debian validation.

Completion criteria

This issue may be closed only after:

1. the Debian validation PR is green;
2. physical Debian 13 validation is recorded with evidence;
3. any physical-test defects are fixed and revalidated;
4. the Debian validation PR is merged into release/v0.2.4;
5. the release branch is confirmed ready for the next approved release-matrix step.

Next action

Prepare the exact four-file linter bundle and verified Debian package candidate, transfer them to the second clean Debian 13 amd64 machine, and perform the mandatory physical installation and F4 validation. Keep PR #147 as a draft and unmerged until that evidence is complete.

[coderabbitai]

🔗 Related PRs

#124 - Define OS-aware F4 linter provisioning contracts [merged]
#126 - feat: wire F4 provisioning evidence gates into packaging [merged]
#141 - ci: wire Linux evidence drift into release gate [merged]
#144 - docs: align release validation gate contracts [merged]
#145 - chore: prepare v0.2.4 release metadata [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[SSobol77]

Draft PR #147 has been opened against release/v0.2.4 from test/v0.2.4-debian-installer at commit 8c7b158fd32d0808af89aa18273dc3e181b3b6a1.

The PR remains draft and must not be merged until the mandatory physical Debian 13 validation on the second clean machine passes and the evidence is recorded.

PR: #147