Sol v0.1.0-alpha.7

Sol v0.1.0-alpha.7, from f4284422203d341e82cddf1f20b0bd43423499cc.

Migration runner: ghcr.io/loganbnielsen/sol-migration-runner@sha256:65f74feb5d2290e4e676bc292d971eaf9fc0188099169db7a82d1e93715aef4d

What's Changed

• DEC-016: Decide how deployments are triggered, how environments are modelled, and how isolation between them is enforced. by @loganbnielsen in #209
• FEAT-056: Expose DEC-016's resolved target environment to application code. by @loganbnielsen in #210
• FEAT-057: Finish DEC-016's deploy-time isolation check after SOL_ENV injection lands. by @loganbnielsen in #211
• REFAC-082: One traversal, two policies: share the directory walk between the workspace facts walker and target discovery, so the layout and the failure behaviour are each stated once. by @loganbnielsen in #212
• FEAT-060: FEAT-056 is DONE, but two of its criteria are not: SOL_ENV is only asserted for services, and it is documented nowhere. Both are small; this ticket exists so a DONE ticket isn't standing on unverified or undocumented behaviour. by @loganbnielsen in #213
• FEAT-059: Continued by: FEAT-063 (binding every operation to the destination). Related: DEC-016, FEAT-058, FEAT-061. by @loganbnielsen in #214
• REFAC-083: Rename sol dev up to sol local up, and reserve local as a name no environment may use. by @loganbnielsen in #215
• INFRA-012: # A prose mention on the Depends on: line becomes a dependency, and a cycle silently deadlocks the queue by @loganbnielsen in #216
• INFRA-011: # The ticket body decides the PR title and the backlog summary, and the rule is written down nowhere by @loganbnielsen in #217
• FEAT-062: Show a target as a target — provider, region, cluster, and whether Kubernetes is reachable — rather than as kubectl output. by @loganbnielsen in #218
• INFRA-010: Stop tickets whose premise has gone stale from looking actionable. Nothing in this pipeline notices when the work a finding describes has already been done. by @loganbnielsen in #219
• REFAC-084: Make a failed cluster probe carry its reason, so sol target show --check can say why a cluster could not be reached instead of only that it could not. by @loganbnielsen in #220
• BUG-023: The pre-commit guardrail's ticket-move exception misfires whenever a ticket's completion notes are large relative to the file, so a legitimate READY_FOR_ENGINEERING → DONE move is blocked and has to be committed with SOL_SKIP_HOOKS=1. by @loganbnielsen in #221
• DEC-019: Decide where the hosted platform lives, and what interface this repository must expose for it to exist. by @loganbnielsen in #222
• REFAC-085: Related: REFAC-082, BUG-023. by @loganbnielsen in #223
• FEAT-061: Deployment scope is a first-class concept, separate from the destination. by @loganbnielsen in #224
• REFAC-086: Settle local as a built-in execution mode: retire the stale dev alias, close the destination hole the reservation leaves open, and align the naming around it. by @loganbnielsen in #225
• FEAT-064: Strict scope resolution: one resolver over discovery, canonical names, and no positional selector. by @loganbnielsen in #226
• DEC-018: Decide what a release is, where it is recorded, and what sol rollback restores. by @loganbnielsen in #227
• FEAT-065: Propagate strict scope selection across the commands that operate on a subset of workloads. by @loganbnielsen in #228
• INFRA-008: CI fails on unrelated pull requests when a third-party upstream tarball host is briefly unavailable, because pin-opam-packages resolves dependency sources from whatever each package's metadata points at — frequently not GitHub. by @loganbnielsen in #229
• REFAC-081: Complete the self-pipe signal-handler extraction that REFAC-043 claimed but did not land: install_signal_handler is still duplicated across all three primitives. by @loganbnielsen in #230
• FEAT-055: Wire the run log into the deploy path, so sol up and sol deploy produce a run ID and keep their diagnostics on disk instead of only in the terminal that ran them. by @loganbnielsen in #231
• FEAT-067: Write the release record on every deploy, and add sol releases to list them. by @loganbnielsen in #232
• INFRA-013: The pinned Redpanda Helm chart 5.9.15 is no longer in the charts.redpanda.com index — that repo now publishes only 25.3.x / 26.1.x / 26.2.x. helm upgrade --install redpanda redpanda/redpanda --version 5.9.15 fails immediately with no chart version found for redpanda-5.9.15, so sol local up (and the golden-path CI job it drives) cannot install a fresh substrate at all. Every PR's golden path fails on this regardless of what it changes. by @loganbnielsen in #235
• REFAC-087: Name the file that implements the local group for what it contains. by @loganbnielsen in #234
• BUG-025: Sol_cli_deployment_state.deploy_state_configmap_name builds the deploy-state ConfigMap name as "sol-deploy-state-" ^ workspace. A workspace named ci_smoke, my_app or Acme contains characters Kubernetes forbids in an object name (_, uppercase), so kubectl apply rejects the ConfigMap — and save_deployed_groups wraps the apply in ignore, so the rejection is silent. by @loganbnielsen in #233
• FEAT-063: Bind every Kubernetes operation to the target's destination, so the cluster is chosen by the target rather than by whatever kubectl happens to be pointing at. by @loganbnielsen in #236
• REFAC-088: is called by both cmd and local_cmd, and the substrate surface was moved to by @loganbnielsen in #237
• REFAC-089: FEAT-063 did not create the argument-list problem; it crossed a threshold where interfaces that were already flat became hard to read. Group the inputs that genuinely belong together — and only those. by @loganbnielsen in #238
• FEAT-069: Make one release identity span the deploy record and the observability data, so a release is the join key between a deploy and its telemetry. by @loganbnielsen in #239
• FEAT-070: Model the deployment event as its own object, separate from the release it by @loganbnielsen in #240
• FEAT-071: Make the deployment event mean one deploy attempt, and hold FEAT-069's by @loganbnielsen in #241
• BUG-026: from a workload of `{domain; name; primitive; image; config; secrets; schedule; by @loganbnielsen in #242
• TYPE_AUDIT-078: Keep Deployment_id.t typed one layer longer in the deploy-marker path. by @loganbnielsen in #243
• Dogfood remediation: FRIC-015..028 (2026-09-13 run) by @loganbnielsen in #244
• FEAT-066: Record every release immutably in the target's cluster, and make sol rollback restore a recorded boundary. by @loganbnielsen in #245
• FEAT-072: The remaining DEC-018 rollback work, split out of FEAT-066 so slice 2 can land by @loganbnielsen in #246
• FEAT-076: Add first-class Ack | Retry | Dead_letter handling to sol-worker / by @loganbnielsen in #247
• FRIC-029: sol logs / sol local logs Loki queries match no streams: the selector uses app/namespace, but Sol's app-pushed logs carry service/team by @loganbnielsen in #248
• BUG-027: Retry_topics' retry-topic consumer serializes all partitions through one fiber with a blocking sleep, and drops the message key on republish — both violate FEAT-076's own "a poison message does not block unrelated messages" acceptance criterion. by @loganbnielsen in #249
• FEAT-068: Make sol cloud produce and consume target-scoped destinations, so an operator never has to think about kube-contexts. by @loganbnielsen in #250
• INFRA-005: wire GCP durable-observability outputs into platform/infra/base (plumbing only) by @loganbnielsen in #252
• FEAT-073: exact id only), FEAT-070 (deployment events, the provenance join key this by @loganbnielsen in #253
• DEC-017: Decide where deploy/run diagnosis and runtime observability live, now that a deploy may be triggered by a push rather than by the user's terminal. by @loganbnielsen in #251
• FEAT-075: Pin sol rollback's enforcement order with a test by @loganbnielsen in #254
• FEAT-074: Reconcile the desired workload set: prune live Sol-owned workloads a release does not contain by @loganbnielsen in #255
• DOCS-015: FEAT-076's acceptance criteria required ordering and duplicate-delivery tradeoffs to be by @loganbnielsen in #256
• BUG-029: bounded produce retry, fail-loud relay failure, relay-publish metrics by @loganbnielsen in #258
• BUG-028: Premise note: retry decode failure still appears to route through on_decode_error; by @loganbnielsen in #257
• BUG-030: DLQ scoping is resolved (2026-09-14): per-group, locked — see DEC-021's by @loganbnielsen in #259
• FEAT-078: generated golden path recommends it). by @loganbnielsen in #260
• BUG-031: touches the same cronjob_doc/Render_fn call site, so land this first to by @loganbnielsen in #261
• FEAT-079: standing in for an explicit Sol decision" principle, applied here to -fn's by @loganbnielsen in #262
• INFRA-016: add fn/svc shared-node-pool isolation spike workflow by @loganbnielsen in #263
• INFRA-016: mechanism). by @loganbnielsen in #265
• FEAT-077: Introduce sol-jobs, a Postgres-backed durable leased-job library, for by @loganbnielsen in #266
• FEAT-080: Reconcile the TypeScript-parity inventory against what has shipped by @loganbnielsen in #267
• DEC-022: OCaml and TypeScript are both first-class application languages by @loganbnielsen in #268
• INFRA-018: Run the first-class TypeScript framework suites in CI (pinned broker) by @loganbnielsen in #270
• FEAT-081: @sol/kafka retry/DLQ parity (Ack/Retry/Dead_letter + retry-topic relay) by @loganbnielsen in #269
• BUG-034: Sol has no workspace identity - commands infer it from Dune, so the build path fails outside a dune project by @loganbnielsen in #271
• fix: install libgmp-dev/pkg-config in the example Dockerfiles (unbreak main) by @loganbnielsen in #272
• ci: install system dependencies in the workspace-independence proof by @loganbnielsen in #273
• docs: record that every change reaches main through a pull request by @loganbnielsen in #274
• FEAT-036: Build @sol/http/@sol/worker, thin TypeScript packages wrapping Sol's HTTP-service and worker-lifecycle contract ($PORT, GET /healthz, drain-on-SIGTERM) — only if real usage shows this specific boilerplate is worth removing, which FEAT-033 found to be the weakest case of everything it measured. by @loganbnielsen in #275
• docs: correct the FEAT-036 DONE ticket record by @loganbnielsen in #277
• ci: one shared classifier decides docs-only vs source; docs-only PRs skip the suite by @loganbnielsen in #276
• pipeline: file FEAT-086 -- wire Pluto through published @sol-fab/svc/worker by @loganbnielsen in #278
• pipeline: remove duplicate FEAT-036 ticket file by @loganbnielsen in #279
• FEAT-086: Replace examples/pluto/app/demo_ts's hand-rolled shutdown code in order_svc and fulfillment_worker with the published @sol-fab/svc/@sol-fab/worker packages, and rerun the TypeScript golden path (sol up --scope=demo_ts) to prove the distributed packages work end to end — a different proof than FEAT-036's scratch/typecheck validation, which only established the API boundary was right. by @loganbnielsen in #280
• pipeline: file FEAT-087 -- TS golden-path-smoke CI job by @loganbnielsen in #281
• audit: record quality findings and fix ticket PR workflow by @loganbnielsen in #283
• roadmap by @loganbnielsen in #285
• pipeline: DEC-028 -- point at AUDIT-068 as the existing implementation vehicle by @loganbnielsen in #284
• DEC-026: define the production-single-region profile and evidence contract by @loganbnielsen in #286
• DEC-027: decide production reconciliation ownership by @loganbnielsen in #287
• FEAT-087: add golden-path-smoke-ts CI job by @loganbnielsen in #282
• FEAT-089: production profile selection and fail-closed preflight by @loganbnielsen in #288
• INFRA-019: reuse a passing CI run for byte-identical tested code by @loganbnielsen in #289
• INFRA-020: remove CI evidence reuse; keep one support-package snapshot per run by @loganbnielsen in #290
• FEAT-083: define workload persistence semantics by @loganbnielsen in #291
• DEC-026: qualify broker-native durability semantics by @loganbnielsen in #292
• AUDIT-078: Define and prove application-data durability and recovery by @loganbnielsen in #293
• FEAT-050: Enforce immutable workload artifacts for the production profile by @loganbnielsen in #294
• FEAT-088: Publish and enforce the maturity-A compatibility contract by @loganbnielsen in #295
• OBS-043: Close the production alert-to-owner response loop by @loganbnielsen in #296
• SEC-004: Define production workload credential posture and prove rotation by @loganbnielsen in #297
• AUDIT-072: Establish recoverable production state and scoped administrative identities by @loganbnielsen in #298
• AUDIT-080: Implement explicit workload availability semantics for production by @loganbnielsen in #299
• fix: pin example workspaces to the kafka-eio with lifecycle callbacks (unbreaks example-dockerfile-smoke) by @loganbnielsen in #301
• AUDIT-069: Enforce production release safety across deploy, failure and rollback by @loganbnielsen in #300
• HARDEN-002: executable qualification matrix + run-1 status (blocked) by @loganbnielsen in #303
• fix: never prune the run-log directory a command just created (blocks HARDEN-002) by @loganbnielsen in #302
• HARDEN-002: fix the production-path defects run 1 exposed (durability preflight, var routing, RDS credential) by @loganbnielsen in #304
• HARDEN-002: make the workspace execution substrate a layer of its own (finding 8) by @loganbnielsen in #307
• HARDEN-002: make the platform substrate lifecycle real (findings 7 and 9 + public destroy path) by @loganbnielsen in #308
• BUG-038: file the merge-finish vs branch-protection conflict by @loganbnielsen in #309
• INFRA-022: Make sol cloud own the complete AWS target lifecycle by @loganbnielsen in #310
• refactor: product-shaped repository information architecture + hygiene by @loganbnielsen in #311
• DEC-030: file the deployer-identity gap behind the sol cloud init inconsistency by @loganbnielsen in #312
• INFRA-023: implement RDS destroy preparation (HARDEN-002 finding 9b) by @loganbnielsen in #313
• INFRA-024: guard the publisher/deployer identity boundary (ADR 0002) by @loganbnielsen in #314
• DEC-030: correct the identity-model claim; file INFRA-025 by @loganbnielsen in #315
• HARDEN-002: reconcile the remediation queue against current main by @loganbnielsen in #317
• INFRA-025: wire deploy_role_arn into an EKS access entry and namespace RBAC by @loganbnielsen in #316
• Add production-lifecycle dogfood/showcase plan by @loganbnielsen in #319
• INFRA-026: add the missing publisher IAM policy contract (finding 6) by @loganbnielsen in #318
• HARDEN-002: add the run 3 proposed plan (not yet executed) by @loganbnielsen in #320
• BUG-039: make RDS deletion protection a profile-enforced invariant by @loganbnielsen in #321
• DEC-032: file eight unified operational interface deltas by @loganbnielsen in #323
• INFRA-028: make lifecycle phases determine authority and desired-state policy by @loganbnielsen in #322
• INFRA-028: enforce ADR 0003's phase relation on the merged lifecycle by @loganbnielsen in #327
• REFAC-090: make worktree and ownership isolation an enforced rule by @loganbnielsen in #324
• OBS-046: scope workspace and domain log links by Sol's identity labels by @loganbnielsen in #326
• DEC-032: target, scope and view are three separate axes by @loganbnielsen in #325
• DEC-031: confirm the primary-axis rule and write it down by @loganbnielsen in #329
• OBS-045: park the traces view — spans do not carry Sol's identity attributes by @loganbnielsen in #328
• INFRA-027: promote to READY_FOR_ENGINEERING now that DEC-032 is decided by @loganbnielsen in #330
• INFRA-029: make destruction an abort edge so no target can be stranded by @loganbnielsen in #331
• HARDEN-002: make the Run 5 specification test the lifecycle now on main by @loganbnielsen in #332
• INFRA-030: make the production profile declare a platform capacity contract by @loganbnielsen in #333
• INFRA-031: report CloudBootstrap, Ready and Destroying where the lifecycle enters them by @loganbnielsen in #334
• HARDEN-002: record Run 5 attempt 1 (non-conformant) and correct two spec claims by @loganbnielsen in #335
• INFRA-032: name the alloy chart by archive URL so the platform apply can complete by @loganbnielsen in #336
• INFRA-033: never prune a live run's directory, and never let a lost log kill a command by @loganbnielsen in #337
• INFRA-034: wait for platform readiness instead of sampling it once by @loganbnielsen in #338
• HARDEN-002: record Run 5 attempts 2 and 3 by @loganbnielsen in #339
• INFRA-035: validate readiness kubectl invocations, and repair the four that were invalid by @loganbnielsen in #340
• INFRA-036: Ready asserts platform convergence, not a route or a third party by @loganbnielsen in #341
• Document GCP bootstrap qualification and lifecycle mapping by @loganbnielsen in #342
• Protect Cloud SQL through the live API by @loganbnielsen in #343
• Make the platform storage and readiness contract provider-specific by @loganbnielsen in #344
• Give each provider the remote state its own roots can use by @loganbnielsen in #345
• INFRA-037: destroy removes what the lifecycle created (ADR 0004) by @loganbnielsen in #346
• Give GCP its own cloud output and platform input contract by @loganbnielsen in #349
• Record Run 5 attempt 5 and file the findings above basic platform construction by @loganbnielsen in #348
• INFRA-038: a workload acquires a Kafka requirement by declaring one by @loganbnielsen in #350
• INFRA-039: resolve credentials per mutating stage, and fail closed when they cannot be resolved by @loganbnielsen in #351
• DEC-033: destruction states what it keeps, and a disposable target keeps nothing by @loganbnielsen in #353
• HARDEN-003: qualification evidence must establish the identity of its observations by @loganbnielsen in #354
• Run a GCP cloud target through Sol's own lifecycle (reconciled with #351/#353/#354) by @loganbnielsen in #355
• Give the GCP platform an install authority that is not the operator by @loganbnielsen in #356
• Record Run 6 attempt 6 and file what blocked the application by @loganbnielsen in #357
• Reach the GCP cluster for real: the interface, the grant, and the peering by @loganbnielsen in #358
• INFRA-040: one runtime Secret identity, and a Job that cannot start says why by @loganbnielsen in #359
• Refuse a GCP platform stage the host cannot run, and record Attempt 3 by @loganbnielsen in #360
• DEC-033/INFRA-041: retention is verified against the selected policy, both ways by @loganbnielsen in #361
• INFRA-042: a partially installed platform is destroyable again by @loganbnielsen in #362
• Recognise the absence gcloud actually reports (Attempt 4) by @loganbnielsen in #363
• Record Attempt 7: the first migration through a cloud target, and its two findings by @loganbnielsen in #364
• Make the Run 5 procedure pick-up-able, and stop removing worktrees that hold work by @loganbnielsen in #365
• Give the GCP workstream an entry point a new agent can actually find (HARDEN-004) by @loganbnielsen in #366
• audit: establish the independent qualification ledger by @loganbnielsen in #367
• audit: record the FND-0002 decision and sequence the qualification plan by @loganbnielsen in #368
• HARDEN-004: narrow the cert-manager startupapicheck failure (FND-0010) by @loganbnielsen in #369
• grant the deploy identity the boundary lease it must hold (INFRA-043) by @loganbnielsen in #370
• land qualification plan items 2, 3, 4, 6 and 7 (INFRA-044/045/046, HARDEN-004, INFRA-047) by @loganbnielsen in #376
• audit: reconcile the ledger after landing plan items 1-4 and 6-7 by @loganbnielsen in #377
• docs: give GCP Attempt 5 its evidence contract by @loganbnielsen in #378
• fix: keep the failing migration Job evidence (INFRA-040) by @loganbnielsen in #379
• docs: give AWS Run 8 its evidence contract, and settle the ABANDON question by @loganbnielsen in #380
• audit: record DEC-035 — GCP service-networking destruction keeps ABANDON by @loganbnielsen in #381
• docs: run-record template, and the decided run order by @loganbnielsen in #382
• docs: Run 8 target as an example, and correct the record rule by @loganbnielsen in #384
• docs: pre-fill the Run 8 record skeleton by @loganbnielsen in #385
• docs: record the Run 8 preflight failure by @loganbnielsen in #386
• audit: record the two defects Run 8 found (FND-0011, FND-0012) by @loganbnielsen in #387
• fix: create the namespace instead of applying it (INFRA-048) by @loganbnielsen in #388
• audit: record Run 8's third defect and two separate follow-ups by @loganbnielsen in #389
• fix: a direct deploy infers its secret backend instead of defaulting to a placeholder (INFRA-050) by @loganbnielsen in #390
• audit: reconcile Run 8's third and fourth defects, and its egress-IP deviation by @loganbnielsen in #391
• audit: decide FND-0016 and the release-record invariant; promote the diagnosability observation by @loganbnielsen in #392
• fix: resolve call targets from the workspace inventory, not the selection (INFRA-053) by @loganbnielsen in #393
• fix: a deployment that cannot record its release has not succeeded (INFRA-054) by @loganbnielsen in #394
• fix: write the release record without needing generic patch (INFRA-055) by @loganbnielsen in #395
• audit: reconcile the FND-0016 and FND-0014 live retests; land their tickets by @loganbnielsen in #396
• fix: a failed evidence read is not an absent result (INFRA-057, part A) by @loganbnielsen in #397
• feat: make the operator identity real, read-only and derived from the evidence (INFRA-057, part B) by @loganbnielsen in #398
• fix: route operator_role_arn to the provider root (INFRA-057, part C) by @loganbnielsen in #399
• fix: make the verdict evidence-backed, and the grant follow the workload (INFRA-058, INFRA-059) by @loganbnielsen in #401
• audit: DEC-038 complete — the operator identity and the evidence-backed verdict are landed by @loganbnielsen in #402
• audit: Run 8 §B from B3 — blocked, with both blockers evidenced by @loganbnielsen in #403
• audit: record the tests-after-code ordering deviation on FND-0019 by @loganbnielsen in #404
• feat: a qualification-only transport capability, so no production identity is widened (DEC-039, INFRA-060) by @loganbnielsen in #405
• audit: a disassociated EKS access policy stayed effective (FND-0021), and the evidence boundary by @loganbnielsen in #406
• fix: de-escalation is verified against the effective surface, not the control plane (DEC-040, INFRA-061) by @loganbnielsen in #408
• audit: FND-0023 — omit is honoured by the config accessors and bypassed by the deploy path by @loganbnielsen in #412
• dec: DEC-041 — which layer owns omit (FND-0023 / INFRA-049) by @loganbnielsen in #413
• INFRA-052: The account-artifact guard does not catch a bare account id in prose by @loganbnielsen in #411
• chore: consolidate the agent surface into .agents/skills + AGENTS.md by @loganbnielsen in #414
• INFRA-061: An EKS access-policy disassociation is reported as complete while the authorizer still honours it by @loganbnielsen in #410
• audit: fail-open pass — two defects, two observations (FND-0024…0027) by @loganbnielsen in #415
• dec: DEC-042 — which DNS name the qualification target is delegated (GCP TLS) by @loganbnielsen in #416
• docs: GCP TLS delegation operator runbook (DEC-042 follow-up) by @loganbnielsen in #417
• dec: DEC-041 decided — omit is a default, with the domain-scope exclusion by @loganbnielsen in #418
• dec: complete DEC-041 (decision recorded) — ticket to DONE by @loganbnielsen in #419
• INFRA-063: Report "could not check" distinctly from "not deployed" in sol logs and sol fn run by @loganbnielsen in #420
• INFRA-064: Never drop the previous-release prune protection when the pointer read fails by @loganbnielsen in #421
• ticket: INFRA-065 — consolidate the ~44 hand-rolled contains substring helpers by @loganbnielsen in #422
• ci: one ocamlformat guard, run by the pre-commit hook and CI by @loganbnielsen in #423
• INFRA-049: Apply DEC-041's omit semantics to the deploy selection by @loganbnielsen in #424
• docs: FND-0024 and FND-0025 are fixed (INFRA-063, INFRA-064) by @loganbnielsen in #425
• pipeline: close out three landed tickets, and file the staleness gap (INFRA-048, INFRA-050, INFRA-057, INFRA-066) by @loganbnielsen in #426
• BUG-033: soldev pipeline merge's post-merge safety net reverts the just-applied by @loganbnielsen in #427
• INFRA-066: A merged implementation can leave its ticket in READY_FOR_ENGINEERING, where it still reports as actionable by @loganbnielsen in #428
• BUG-032: found this while trying to fire a concurrent burst). by @loganbnielsen in #429
• DOCS-016: Make the first-class OCaml and TypeScript story consistent by @loganbnielsen in #430
• DOCS-017: Bring framework package specs back to their public API contracts by @loganbnielsen in #431
• DOCS-018: Update the remaining reusable audit procedures to current Sol by @loganbnielsen in #432
• AUDIT-068: Refresh the TypeScript showcase's deprecated and vulnerable dependencies by @loganbnielsen in #433
• agents: a batch branch silently skips the review marker by @loganbnielsen in #434
• dec: qualification subdomains, one per cloud, created by Sol (DEC-042) by @loganbnielsen in #435
• DEC-042: How the qualification subdomains are delegated, and to whom by @loganbnielsen in #436
• agents+docs: the qualification namespace model, and naming the tree on mutating commands by @loganbnielsen in #437
• fix: the ticket-move guard's escape hatch could not be used in CI (INFRA-066) by @loganbnielsen in #439
• docs: read the GCP quotas the inventory said were unread (HARDEN-004) by @loganbnielsen in #438
• audit+dec: no lifecycle phase owns durable account prerequisites (FND-0028, DEC-043) by @loganbnielsen in #441
• qual: the GCP qualification attempt harness (HARDEN-004, part B) by @loganbnielsen in #440
• qual+audit: freeze Attempt 5 evidence, file the apply/destroy defect (FND-0029, INFRA-067) by @loganbnielsen in #442
• qual: fix the harness's teardown, secret and DNS-observation defects (HARDEN-004, part D) by @loganbnielsen in #443
• qual: localize the INFRA-067 refusal to its exact call path (HARDEN-004, part E) by @loganbnielsen in #444
• fix: destruction must not evaluate install-time requirements (INFRA-067) by @loganbnielsen in #445
• dec: the delegated zone gets a durable owner, adopted by import (DEC-043) by @loganbnielsen in #446
• dec: reconcile the durable root instead of checking it exists (DEC-043) by @loganbnielsen in #447
• qual+audit: qualify the harness, and file the interrupted-apply recovery gap (HARDEN-004, part H) by @loganbnielsen in #448
• qual: an offline state-machine test for the harness, and the defects it found (HARDEN-004, part I) by @loganbnielsen in #449
• audit: record FND-0030's design before implementing it (HARDEN-004, part M) by @loganbnielsen in #450
• fix: a destructive preparation targets only what state represents (FND-0030) by @loganbnielsen in #451
• fix: say what the eligibility rule guarantees, and report what it cannot reach (FND-0030) by @loganbnielsen in #452
• docs: HARDEN-004 handoff note (HARDEN-004, part E) by @loganbnielsen in #453
• docs: handoff part 2 — verified premises and the reordered plan (HARDEN-004, part F) by @loganbnielsen in #454
• audit: correctness audit (fail-loud and modeling) — FND-0031..0049 and tickets by @loganbnielsen in #455
• INFRA-070: GCP with_cluster_access must honour on_error so a credential failure removes bootstrap access by @loganbnielsen in #456
• BUG-040: sol secret set/delete/list must fail on an unreadable Secret instead of treating it as absent by @loganbnielsen in #457
• DOCS-021: Correct the sol-svc spec: JWT verification is implemented, and the payments example must not use Unverified_dev_only by @loganbnielsen in #458
• BUG-041: Reject duplicate migration versions and stop treating *.down.sql as a required migration by @loganbnielsen in #459
• BUG-042: sol.toml must reject unknown keys and tables, as sol.yml already does by @loganbnielsen in #460
• docs: Step 1 verdict — the Attempt-6 replay cannot be constructed offline (HARDEN-004, part G) by @loganbnielsen in #461
• refactor: destroy runs through a typed execution core and a state inventory (HARDEN-004, part 2) by @loganbnielsen in #462
• refactor: plan-assert every destroy-path apply (HARDEN-004, part 3) by @loganbnielsen in #463
• BUG-046: sol-svc: deliver an external stop to the server, and reject a malformed PORT by @loganbnielsen in #464
• OBS-047: Starter alerts for message drop and diversion: decode drops, DLQ inflow, relay publish failures by @loganbnielsen in #467
• BUG-043: A stopped Retry_topics relay must fail the worker, not wait for the source consumer to exit by @loganbnielsen in #466
• SEC-006: Refuse Unverified_dev_only JWT auth at runtime unless explicitly opted in by @loganbnielsen in #465
• BUG-044: sol-jobs: stop cross-claiming between Make instances, and make database failures visible without ?ot by @loganbnielsen in #468
• INFRA-074: sol cloud apply must not delete ECR repositories because a Dockerfile is absent from the invoking checkout by @loganbnielsen in #469
• BUG-045: The consumer-group-removal guard must fail closed on unreadable deploy state and describe the real hazard by @loganbnielsen in #470
• BUG-047: Install the SIGTERM/SIGINT handler once per process and restore default disposition after the first signal by @loganbnielsen in #471
• BUG-048: Make sol.toml the single, required source of a -fn schedule, key Pushgateway metrics by workload, and actually push them by @loganbnielsen in #472
• BUG-049: Enforce FULL schema compatibility for real: set it before registering, fail on error, and make the CI gate fail instead of skip by @loganbnielsen in #473
• INFRA-073 (part A): sol-svc serves /readyz and delays closing the listener on stop by @loganbnielsen in #474
• SEC-007: Make Kafka transport security an explicit, rendered posture instead of an implicit Plaintext default by @loganbnielsen in #475
• BUG-051: Route source-topic decode failures to the DLQ when one exists; make ack-and-drop an explicit opt-in by @loganbnielsen in #476
• BUG-050: sol-jobs: fence finalize statements on the claimed attempt and report lease overruns by @loganbnielsen in #477
• SEC-008: The destroy path writes terraform show -json <plan>, including sensitive values, to the run log by @loganbnielsen in #478
• audit: correctness pass 2 (JWKS concurrency/TLS, log-export coupling, secret ownership) by @loganbnielsen in #479
• feat: destruction decides what a failed preparation means (HARDEN-004, part 4) by @loganbnielsen in #481
• INFRA-073: -svc graceful shutdown: fail readiness and delay listener close so rolling deploys do not refuse requests by @loganbnielsen in #480
• BUG-053: sol-svc: make the JWKS refresh single-flight and Eio-safe, and turn every exception outside the handler into a counted 500 by @loganbnielsen in #483
• SEC-009: sol-svc: refuse a Jwks_url that is not https:// at startup by @loganbnielsen in #484
• FEAT-098: TypeScript: route source-topic decode failures to the DLQ under retry-topics, matching OCaml's decode_error_policy by @loganbnielsen in #482
• BUG-055: Kafka_service.config_of_env: require KAFKA_BROKERS, SCHEMA_REGISTRY_URL and REDPANDA_ADMIN_URL instead of defaulting to localhost by @loganbnielsen in #485
• feat: destruction verifies absence and retention from observed evidence (HARDEN-004, part 5) by @loganbnielsen in #487
• audit: FND-0046 resolved by INFRA-072 — retention is observed, not printed by @loganbnielsen in #488
• OBS-048: Decouple application latency from the log and trace backends: keep a stdout copy when LOKI_URL is set, and export asynchronously by @loganbnielsen in #486
• docs: Attempt 7 stopped pre-live -- the recovery contract is falsified, not qualified (HARDEN-004) by @loganbnielsen in #489
• feat: destruction verifies what the target declares, not only what state represents (HARDEN-004, part 6) by @loganbnielsen in #490
• audit: plan the cloud lifecycle simplification and file its staged tickets by @loganbnielsen in #491
• docs: turn the HARDEN epics into a qualification ledger, so /work cannot pick them up by @loganbnielsen in #492
• SEC-010: GCP skips the db_password guard; fix it at the Terraform and logging layers, not by enumerating providers by @loganbnielsen in #494
• INFRA-075: Tests write runs into the real Sol home and prune real qualification evidence by @loganbnielsen in #493
• DEC-045: Does a successful terraform destroy plus empty state establish absence for resources Terraform is configured to delete? by @loganbnielsen in #495
• DOCS-022: Correct the HARDEN-004 records to show the Attempt 5 and 6 divergences were operator-created, and withdraw A1 by @loganbnielsen in #498
• INFRA-076: Terraform must survive Sol, with durable output, a supervisor that records completion, and a graceful signal boundary by @loganbnielsen in #497
• REFAC-092: CI guard that shrinks provider dispatch outside approved modules and forbids new wildcard provider matches by @loganbnielsen in #496
• Fix a race in the INFRA-076 supervised positive-control test by @loganbnielsen in #501
• REFAC-093: Remove the destroy sweep rows for resources Terraform manages (EIP, NAT gateway, ECR prefix) by @loganbnielsen in #499
• REFAC-094: Delete the runtime ownership and verification model (per-kind recipes, captured identities, B2, exit code 3) by @loganbnielsen in #502
• INFRA-077: GCS soft delete keeps a none-retention GCP target's observability data billed for 7 days after destroy by @loganbnielsen in #500
• REFAC-095: Introduce capabilities_of with the table-shaped provider capabilities by @loganbnielsen in #503
• REFAC-091: Port the cloud install/destroy lifecycle to a result-returning execute ~deps, exiting only at the command edge by @loganbnielsen in #504
• REFAC-096: Replace the Aws_outputs and Gcp_outputs dispatch with opaque cluster access by @loganbnielsen in #505
• REFAC-097: Move retention and non-Terraform residue behind provider capabilities returning Sol verdicts by @loganbnielsen in #506
• REFAC-098: Move provider-native identity fields out of the generic target record by @loganbnielsen in #507
• HARDEN-005: Cloud boundary fitness test, re-running the Azure-on-paper change surface with the guards at zero by @loganbnielsen in #508
• audit: independent post-implementation audit of the cloud lifecycle simplification + 7 findings by @loganbnielsen in #509
• AUDIT-POST-004/005/006: close the lifecycle guard follow-ups by @loganbnielsen in #510
• AUDIT-POST-001/007: AWS identity leaves the generic lifecycle by @loganbnielsen in #511
• AUDIT-POST-002/003: the last provider facts leave generic code by @loganbnielsen in #512
• HARDEN-006 prep: the GCP Attempt-8 harness, and INFRA-067's stale ticket move by @loganbnielsen in #513
• INFRA-078: the qualification harness mis-reads NOT_FOUND, and verify can escalate to teardown by @loganbnielsen in #514
• INFRA-078: recognise the provider's NOT_FOUND, and make verify observational by @loganbnielsen in #516
• Repository organization proposal (DEC-046, DEC-047) and its implementation tickets by @loganbnielsen in #515
• HARDEN-006: GCP Attempt 8 — FND-0010's cause established; a degraded teardown filed by @loganbnielsen in #518
• Record DEC-046 and DEC-047; promote the organization tickets by @loganbnielsen in #517
• DOCS-024: Give TypeScript a framework/ slot pointing at its repositories by @loganbnielsen in #519
• Move platform assets out of the CLI: cli/platform → platform/ (REFAC-099, part A) by @loganbnielsen in #520
• REFAC-105: Make the pluto example self-contained — no target may reference internal/ by @loganbnielsen in #521
• REFAC-099: Separate code from assets — lift cli/platform to platform/ and cli/sol to cli/ by @loganbnielsen in #523
• File BUG-057: relative terraform_var_file resolves against the invocation directory by @loganbnielsen in #522
• INFRA-079/FND-0058: destruction may construct authority, and only authority by @loganbnielsen in #524
• INFRA-083: file the no-authority-mechanism declaration gap (and correct two dangling references) by @loganbnielsen in #526
• REFAC-100: Provider-mirrored cloud roots over a backend-free shared platform module by @loganbnielsen in #525
• INFRA-084: give each qualification attempt its own target key by @loganbnielsen in #527
• Platform cleanup: shared observability, one components.json, local tooling out (REFAC-101, REFAC-102, REFAC-103) by @loganbnielsen in #528
• HARDEN-006: FND-0058 qualified live — a failed-install target destroys completely by @loganbnielsen in #530
• REFAC-104: Split cli/lib into per-domain dune libraries along its dependency graph by @loganbnielsen in #529
• BUG-057: A relative terraform_var_file resolves against the invocation directory, not the workspace root by @loganbnielsen in #531
• INFRA-080: make the GCP teardown inventory ask questions the provider can answer by @loganbnielsen in #532
• REFAC-106: Replace the hand-written sol.yml parser with a YAML library and a strict decoder by @loganbnielsen in #533
• File REFAC-107/108/109 and FEAT-101 from the operator's code-review notes by @loganbnielsen in #534
• FEAT-100: Implement the environment layer for deployment config by @loganbnielsen in #535
• REFAC-107: Drive local infrastructure from the parsed workspace model, not a substring grep of dune files by @loganbnielsen in #536
• File BUG-058 and REFAC-111/112/113 from the operator's second code-review round by @loganbnielsen in #539
• REFAC-108: Pass the workspace root as a value instead of chdir-ing into it by @loganbnielsen in #537
• FND-0010: wait as long as cert-manager's own readiness check is designed to by @loganbnielsen in #538
• INFRA-085 + INFRA-086: what CI actually costs, and the two minutes that are really there by @loganbnielsen in #544
• REFAC-109: Rename Sol_cli_config's overloaded t / target / target names by @loganbnielsen in #541
• BUG-058: sol deploy silently tags images "dev" when git rev-parse fails by @loganbnielsen in #540
• REFAC-112: Factor sol up's shared plan preparation out of run_dry_run and run_apply by @loganbnielsen in #542
• DOCS-023: Make docs/ user-facing only — contract into docs/reference, maintainer records into internal/ by @loganbnielsen in #545
• REFAC-111: Parse at the CLI edge -- one or_exit, a workspace record, and a validated selection by @loganbnielsen in #546
• Record DEC-049 (self-contained, version-aligned releases) and file REFAC-114, BUG-059, FEAT-101 by @loganbnielsen in #547
• REFAC-114: Move every Sol-owned asset lookup behind Sol_cli_platform_assets, and guard checkout discovery to it by @loganbnielsen in #548
• GCP Attempt 10: the post-FND-0010 install, its first blocker, and the run record by @loganbnielsen in #550
• FEAT-101: Ship Sol as a self-contained, version-aligned release -- binary, platform bundle, and migration-runner image by @loganbnielsen in #549
• FND-0010 root cause: cert-manager leader election is aimed at kube-system, which Autopilot denies by @loganbnielsen in #551
• Promote INFRA-088; make FND-0060 the established defect by @loganbnielsen in #552
• INFRA-088: cert-manager's leader election moves into its own namespace by @loganbnielsen in #553
• BUG-059: The migration runner built from a checkout floats obs-eio, obs-loki-eio and pg-eio at #main by @loganbnielsen in #554
• DEC-050: Where Terraform's working state lives when the platform roots come from an installed release by @loganbnielsen in #555
• GCP Attempt 11: cert-manager qualified live, and the next blocker behind it by @loganbnielsen in #556
• Promote INFRA-089 with the one-object decision and migration analysis by @loganbnielsen in #557
• File REFAC-115..120 from the operator's code-review notes by @loganbnielsen in #559
• REFAC-119: Format timestamps with ptime instead of six hand-written Unix.tm formatters by @loganbnielsen in #560
• INFRA-089: one Kubernetes object, one Terraform owner by @loganbnielsen in #558
• REFAC-116: One way to say a process succeeded -- a result that is Ok only on exit 0, carrying stdout by @loganbnielsen in #561
• File REFAC-121/122 and widen REFAC-115/120 from the operator's latest comments by @loganbnielsen in #562
• REFAC-121: One helper for "absent or empty" -- stop spelling None | Some "" and trim-equals-empty by hand by @loganbnielsen in #563
• GCP Attempt 12: FND-0061 qualified live, and the SSD quota is the new frontier by @loganbnielsen in #565
• REFAC-117: sol alert test -- required --target, a library-built payload, and a typed send outcome by @loganbnielsen in #564
• Promote INFRA-090 with the refined disk-quota model by @loganbnielsen in #569
• Library code returns results; sol assets reports every failure (REFAC-115, part A) by @loganbnielsen in #566
• File REFAC-123..127; widen REFAC-120 from the operator's latest comments by @loganbnielsen in #568
• Every command returns its failure; nothing below a term exits (REFAC-115) by @loganbnielsen in #571
• INFRA-090: check the provider's disk quota where it means something by @loganbnielsen in #570
• Attempt 13: stopped by a defect in the INFRA-090 output parsing (FND-0063) by @loganbnielsen in #573
• REFAC-124: One way to run a process -- Sol_cli_process.run is Ok only on exit 0, and check, run_success and run_ok go by @loganbnielsen in #572
• Promote INFRA-091 by @loganbnielsen in #575
• INFRA-091: one idea of Terraform's output contract (FND-0063) by @loganbnielsen in #576
• REFAC-127: Kubernetes JSON decoding in rollout diagnosis reports malformed input instead of reading it as "nothing there" by @loganbnielsen in #574
• REFAC-123: Decode blank to None at the boundary -- an optional string inside Sol is never Some "" by @loganbnielsen in #577
• REFAC-125: Typed tool errors instead of stderr substring matching -- ask the tool for a structured answer, and classify once per tool where it cannot give one by @loganbnielsen in #578
• Attempt 14: past the storage boundary, Autopilot admission is the frontier by @loganbnielsen in #581
• REFAC-126: Rework Sol_cli_port_forward -- record what Sol started instead of re-parsing /proc, and return results instead of printing and sentinels by @loganbnielsen in #580
• REFAC-120: Write down and apply the readability conventions -- pipelines, no redundant annotations, named single-purpose functions by @loganbnielsen in #583
• File REFAC-128/129/130 and FEAT-102 from the operator's latest comments by @loganbnielsen in #579
• DEC-051, DEC-052, DEC-053: file the driver-model decisions by @loganbnielsen in #582
• Record the development calibration; a green PR merges without re-running CI because main moved by @loganbnielsen in #584
• Promote DEC-051 and DEC-052, recording the operator's decisions by @loganbnielsen in #585
• File INFRA-093, promote INFRA-092 by @loganbnielsen in #586
• AGENTS.md: the marker gates the merge, and --delete-branch lies about it by @loganbnielsen in #587
• INFRA-093: the GCP driver provisions GKE Standard, and the profile refuses Autopilot by @loganbnielsen in #588
• REFAC-128: sol new scaffolds from a template tree in Sol's assets, not from OCaml string literals by @loganbnielsen in #589
• REFAC-129: Make the sol.yml / environments decoder read simply -- named error helpers, let* over results, no assert false by @loganbnielsen in #590
• State the GCP substrate by omission (Attempt 15's plan-time conflict) by @loganbnielsen in #591
• REFAC-130: Read the workspace once into a typed model instead of re-scanning the filesystem per question by @loganbnielsen in #592
• File REFAC-131..139 from the refactoring-pattern audit by @loganbnielsen in #593
• REFAC-131: Build Kubernetes manifests as YAML values, not sprintf templates -- every scalar goes through one emitter by @loganbnielsen in #594
• File FEAT-103: TypeScript has an end-to-end path but no Sol inner loop by @loganbnielsen in #596
• Attempt 15b: provider stockout, and a partial create Sol cannot destroy (FND-0065) by @loganbnielsen in #598
• REFAC-137: Carry the code conventions into framework/ocaml and soldev -- Result.Syntax, blank env at one boundary, one exit by @loganbnielsen in #595
• File FEAT-104 and promote FEAT-103 with its dev-loop decision by @loganbnielsen in #602
• REFAC-138: Carry the code conventions into the pinned support libraries (*-eio) and bump support-refs.txt by @loganbnielsen in #597
• FEAT-104: Generated workloads declare their language - sol new records language in sol.yml by @loganbnielsen in #605
• FEAT-103: TypeScript has an end-to-end path but no Sol inner loop - sol local run builds OCaml units only by @loganbnielsen in #606
• REFAC-133: No exceptions for control flow in the CLI -- Deploy_failed goes, and library code returns its Error instead of failwith by @loganbnielsen in #599
• REFAC-132, REFAC-134, REFAC-135, REFAC-136: JSON boundary, one runner and fs helper, library reporting, cloud CLI classifiers by @loganbnielsen in #608
• One migration Job runner in cli/lib, not two copies in cmd_migrate (REFAC-139, part A) by @loganbnielsen in #609
• sol deploy's selection and plan become a library module (REFAC-139, part C) by @loganbnielsen in #611
• What sol local infra up installs is data in cli/lib (REFAC-139, part B) by @loganbnielsen in #610
• BUG-060: An unreadable pipeline ticket is not an error anywhere - pipeline ls exits 0, check answers for it, and CI never parses a ticket by @loganbnielsen in #613
• sol cloud's lifecycle wiring and decisions move into cli/lib/cloud (REFAC-139, part D) by @loganbnielsen in #614
• sol deploy's apply path moves into Sol_cli_deploy_run (REFAC-139, part E) by @loganbnielsen in #615
• sol local's cluster, endpoints and run lines move into cli/lib/local; REFAC-139 done (part F) by @loganbnielsen in #616
• Observe Kubernetes API reachability across the platform apply (qualification only) by @loganbnielsen in #612
• BUG-056: sol up builds its plan without the resolved sol.yml, so it renders different manifests than sol deploy for the same workspace by @loganbnielsen in #617
• Target the run's cluster by construction; capture the platform failure's Kubernetes state by @loganbnielsen in #618
• Remove every comment from the OCaml tree; a guard keeps them out by @loganbnielsen in #619
• BUG-062: sol migrate names its table and finds its migrations from the workspace root by @loganbnielsen in #620
• Establish the run's credentials before any observation; fix the capture's argv boundary by @loganbnielsen in #622
• BUG-063: pipeline ls calls a worktree with unpushed commits when it is merely behind origin/main by @loganbnielsen in #621
• Remove comments from shell, Terraform and TypeScript; the guard covers all four languages (REFAC-142) by @loganbnielsen in #623
• Terraform guards read Terraform structurally: python-hcl2 spike, and the first two guards by @loganbnielsen in #624
• REFAC-143: Comments in dune files and Dockerfiles, and the comment policy itself by @loganbnielsen in #625
• Observer lifecycle: survive transitions, make failures visible, never lose the bundle by @loganbnielsen in #627
• UX-003: sol new workspace never points at the README it generates, so the generated Dockerfiles have no signpost by @loganbnielsen in #631
• Identity and RBAC guards read Terraform structurally (stacked on #624) by @loganbnielsen in #626
• Config and platform guards read their inputs structurally (stacked on #626) by @loganbnielsen in #628
• BUG-064: A docs-only change skips the build that the unconditional guards' tooling comes from, so the required test check fails by @loganbnielsen in #633
• DOCS-025: workload-availability documents an HTTP service's readiness as /healthz, which a declared OCaml -svc no longer is by @loganbnielsen in #630
• Qualification observer: inspect the kubeconfig structurally, capture independently, account for every read by @loganbnielsen in #634
• Production-infrastructure guard reads Terraform structurally, with its first mutation test (stacked on #628) by @loganbnielsen in #629
• The lifecycle harness's fake CLIs are files, not heredocs (stacked on #629) by @loganbnielsen in #632
• BUG-065: the unconditional-guard tooling guard cannot see a Python guard's tool requirement by @loganbnielsen in #635
• GCP Attempt 16: the observer works live, and the platform's requests exceed a single node by @loganbnielsen in #636
• Qualification harness: its own narrative in the bundle, and a usage block instead of its source by @loganbnielsen in #637
• Attempt 16: measure the per-node fit, so the sizing decision has numbers by @loganbnielsen in #638
• DEC-054: the driver defaults adopt the node shape the profile already recommends by @loganbnielsen in #639
• GCP Attempt 17: Ready on Standard, Ready-state destruction, and the TLS blocker by @loganbnielsen in #640
• DEC-055: GCP TLS through Cloud DNS + Workload Identity, with the solver and identity selected per provider by @loganbnielsen in #641
• DEC-055 follow-up: each provider gets its own literal ClusterIssuer resources by @loganbnielsen in #642
• File REFAC-144 through REFAC-147 from Logan review by @loganbnielsen in #643
• GCP Attempt 19: the TLS path is qualified end to end by @loganbnielsen in #647
• File REFAC-148–154, FEAT-105 merge workflow, and BUG-066 docs-only CI by @loganbnielsen in #646
• BUG-066: Restore a lightweight docs-only CI path (part A) by @loganbnielsen in #648
• BUG-066: Verified eleven-second docs-only CI and ticket completion by @loganbnielsen in #650
• FEAT-105: CI-gated native auto-merge and proportional review by @loganbnielsen in #649
• DEC-056 promotion: the certificate requirement becomes actionable by @loganbnielsen in #652
• FEAT-105: Verify the post-merge docs-only fast path by @loganbnielsen in #653
• DEC-056: Ready covers the platform's declared certificates by @loganbnielsen in #651
• Qualification: an app phase that runs the GCP application rows by @loganbnielsen in #654
• REFAC-144: Make sol assets read as named checks followed by one report by @loganbnielsen in #644
• REFAC-148: Propagate unchanged Result errors instead of matching them by hand by @loganbnielsen in #655
• REFAC-147: Teach decode operate render boundaries in the generated HTTP example by @loganbnielsen in #656
• REFAC-150: Name conceptual collection groups before combining them by @loganbnielsen in #657
• REFAC-146: Make retry-topic consumption a visible phase pipeline by @loganbnielsen in #658
• Qualification: the app phase supplies POSTGRES_URL, the documented operator step by @loganbnielsen in #661
• REFAC-145: Give Deployment and Rollout rendering one typed workload input by @loganbnielsen in #645
• REFAC-154: Use direct monadic composition for semantically empty bindings by @loganbnielsen in #659
• REFAC-149: Eagerly normalize non-trivial arguments before application by @loganbnielsen in #660
• GCP cluster: place the cluster's zones where its node pool lives by @loganbnielsen in #665
• GCP Attempt 21: provider stockout, and a destroy that cannot converge a failed cluster by @loganbnielsen in #666
• FND-0069: a destroy fails closed, and a broken resource cannot make the substrate immortal by @loganbnielsen in #667
• REFAC-151: Bounded CLI commands return typed outcomes before rendering them by @loganbnielsen in #664
• REFAC-152: Replace loose parameter swarms with explicit domain inputs by @loganbnielsen in #662
• REFAC-153: Make embedded state handling visible as explicit phase pipelines by @loganbnielsen in #663
• Make reviewer independence explicit in the review skills by @loganbnielsen in #668
• File REFAC-155 for the consumer hooks grouping by @loganbnielsen in #674
• Clarify CLI controller boundaries and local install phases by @loganbnielsen in #670
• File parameter-lint review and sol open options finding by @loganbnielsen in #675
• REFAC-155: Group the consumer lifecycle and retry callbacks behind one hooks value by @loganbnielsen in #671
• FND-0069 follow-up: an inconclusive probe is an unknown, and the probes can learn their target by @loganbnielsen in #669
• Ticket transitions: explain the refusal, document the filing order by @loganbnielsen in #673
• Add advisory AST lint for OCaml parameter families by @loganbnielsen in #672
• Land the Logan refactor queue notes by @loganbnielsen in #676
• Add safe explicit cleanup of merged PR worktrees by @loganbnielsen in #677
• Qualification: the app phase supplies the workspace's declared runtime secrets by @loganbnielsen in #678
• Qualification: the quota verdict prefers the authoritative lists, and the migration Job gets the registry by @loganbnielsen in #679
• GCP: attempts 22-25 recorded, FND-0070 filed, and the harness quota verdict made three-valued by @loganbnielsen in #680
• Audit code quality and file seven boundary findings by @loganbnielsen in #682
• FND-0070 Phase 1: independent provider inventory behind one absence contract by @loganbnielsen in #681
• FND-0070: the resource identity registry, and a guard that makes silence impossible by @loganbnielsen in #684
• FND-0070 Phase 2: sol cloud recover, and the counterexample the live specimen produced by @loganbnielsen in #685
• Audit deeper lifecycle paths and file seven additional defects by @loganbnielsen in #683
• audit: file six high-value recovery and isolation defects by @loganbnielsen in #687
• FND-0070: a substrate resource stays recoverable when its cluster is gone by @loganbnielsen in #686
• CODE_LAYER-023: Drain both subprocess output streams through the existing argv runners by @loganbnielsen in #689
• BUG-069: Return a bad request for non-object charge JSON by @loganbnielsen in #690
• BUG-073: Accept request bodies exactly at the configured maximum by @loganbnielsen in #691
• BUG-079: Enforce not-before claims for verified JWT authentication by @loganbnielsen in #692
• CODEX_STYLE_AUDIT-079: Validate job timing configuration before entering the runtime by @loganbnielsen in #693
• BUG-074: Serialize process signal registration and restoration across domains by @loganbnielsen in #694
• BUG-075: Keep build-context copying from dereferencing workspace symlinks by @loganbnielsen in #695
• BUG-080: Keep retry and DLQ topics isolated by the original consumer group by @loganbnielsen in #697
• BUG-081: Preserve External Secrets selection in emitted GitOps artifacts by @loganbnielsen in #698
• BUG-070: Preserve inbound trace context in the TypeScript order example by @loganbnielsen in #700
• planning: record the audit-ticket wave and the three open findings by @loganbnielsen in #704
• BUG-076: Resolve npm workspace membership from relative paths by @loganbnielsen in #699
• BUG-072: Preserve scheduled execution policies in release identity and rollback by @loganbnielsen in #702
• BUG-082: Fail closed when the migration directory cannot be inspected by @loganbnielsen in #701
• BUG-071: Preserve exclusive boundary ownership throughout deploy and rollback by @loganbnielsen in #703
• CODE_LAYER-024: Load a checked PR inventory once per pipeline operation by @loganbnielsen in #696
• planning: the audit-ticket wave is 17 of 20, not 16 by @loganbnielsen in #705
• BUG-078: Check target applied migrations before restoring an old release by @loganbnielsen in #706
• FND-0070 simplified: reconciliation as a capability, and only the machinery the real failure class needs by @loganbnielsen in #708
• BUG-077: Make scoped deployment release records safe for workspace rollback by @loganbnielsen in #707
• planning: record the second audit-ticket wave and the open upstream PR by @loganbnielsen in #709
• File INFRA-095: every framework package's unit suite must run in CI by @loganbnielsen in #712
• BUG-067: Wake idle workers when graceful stop is requested by @loganbnielsen in #711
• File REFAC-156..158: the support-library themes still open, and the sites examined and left by @loganbnielsen in #714
• INFRA-095: Run every framework package's unit suite in CI by @loganbnielsen in #713
• FND-0070: the in-cluster gate was itself the defect — revert it by @loganbnielsen in #710
• REFAC-157: One hooks value across the kafka boundary, and bump the kafka-eio pin by @loganbnielsen in #715
• GCP row follow-ups: the harness exports, and the SQL database/role teardown order by @loganbnielsen in #716
• Record the audit-ticket wave closeout in WORK_SUMMARY by @loganbnielsen in #717
• Record the GCP application row (Attempt 28), and name the AWS regression gap by @loganbnielsen in #718
• File BUG-083: refuse ownership imports with unreadable state by @loganbnielsen in #720
• Land the support-library API layout, and the signed_request shape (REFAC-156, REFAC-158) by @loganbnielsen in #721
• File three cloud inventory and reconciliation findings by @loganbnielsen in #723
• Clarify that agents may fast-forward clean canonical main by @loganbnielsen in #722
• File BUG-087: read scoped up boundary under lease by @loganbnielsen in #725
• A substrate is present when its state holds its resources, not when its outputs parse by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/724
• File scoped deployment and rollback correctness findings by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/726
• File BUG-091: isolate jobs across workspaces by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/728
• AWS row machinery: the application contract, exercised the way GCP Attempt 28 did by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/719
• File BUG-092: reconcile scoped release identities by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/732
• Retire redundant work summary by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/733
• File BUG-093 for ExternalSecret rotation ownership by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/734
• File BUG-094 for unreadable Terraform state listing by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/736
• BUG-083: Refuse ownership imports when Terraform state cannot be read by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/730
• BUG-085: Keep unobservable provider checks unresolved during cloud reconciliation by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/731
• File BUG-095 for migration table name collisions by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/738
• File BUG-096 for retry relay consumer-group eviction by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/739
• Refuse direct rotation of ExternalSecret-owned workload Secrets (BUG-093, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/737
• BUG-086: Pass target location to GCP node-pool and Cloud NAT inventory checks by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/729
• File BUG-097..106 and tighten BUG-096/098/099/100 remediations by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/742
• BUG-087: Read scoped sol up release boundaries under the workspace lease by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/735
• File BUG-102..106 and tighten BUG-096/098/099/100 remediations by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/744
• BUG-084: Use a supported AWS API path to inventory tagged load balancers by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/727
• AWS row machinery, and the two defects the row established by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/740
• Batch 0: Windtrap inline-test architecture for the CLI suite by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/743
• FND-0071: AWS deploys run as the identity that cannot create the workspace substrate by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/745
• BUG-098: Bound sol-jobs attempts when a job kills its worker process by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/746
• BUG-100: Remove sol secret's --env axis, which selects nothing and rejects the documented rotation command by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/748
• FND-0073 trace + FND-0074 (unencoded password in POSTGRES_URL) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/751
• BUG-103: Renew sol-jobs leases while a handler runs so claims stay exclusive by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/747
• BUG-096: Keep the Retry_topics relay polling while it waits for a retry to come due by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/750
• BUG-102: Give Kafka workers one durable retry mechanism and retire In_memory by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/749
• BUG-097: Honour shutdown in Retry_topics workers instead of waiting for SIGKILL by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/753
• FND-0075: the rendered NetworkPolicy grants no egress to a managed database by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/754
• FND-0076: the destroy path runs the successor-authority check by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/755
• docs: codify the Sol OSS developer experience and file the implementation roadmap by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/752
• Amendment: Kafka distributes facts; jobs perform retryable work by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/756
• docs: make auto-merge the default merge strategy by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/758
• tickets: file the soldev pipeline merge follow-ups by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/759
• FND-0075: a workload can reach the managed database Sol provisioned by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/757
• qualification: the AWS application row completes on a fresh specimen by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/760
• tickets: tighten the outbox contract and file the transaction-scope spike by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/761
• Adopt kafka-eio's produce_receipt / produce_await API by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/762
• Make sol-jobs enqueue idempotent (FEAT-112) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/763
• Make worker readiness follow group membership (BUG-099, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/765
• GCP: the absence probes can run, and the application row under enforced policy is recorded by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/764
• REFAC-159: Make soldev pipeline merge match the auto-merge-default policy by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/766
• Let the event contract declare its partitions and key (BUG-099) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/767
• Codify the autonomy stopping rule (AGENTS.md + work skill) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/769
• Destroy releases Sol-owned workloads before it destroys the substrate (FND-0077, FND-0078) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/770
• Triage: a standing qualification goal belongs in BACKLOG by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/772
• Give the durable installation one idempotent, verifiable lifecycle stage (INFRA-096) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/768
• FND-0077: the live acceptance test is not met yet, with the evidence by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/774
• FEAT-113: Remove Kafka message-level retry and application-level Dead_letter by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/771
• Publish the application authoring guide (DOCS-027) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/776
• Publish the end-to-end deployment guide (DOCS-028) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/777
• Publish the CLI reference, generated from the binary's own help by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/775
• Link the CLI reference now that it is published by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/778
• Pin soldev's merge to the branch ref, not a stale PR payload by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/773
• File the two tooling findings, corrected against what the tools actually do by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/779
• VERIF-001: Prove the transactional facts-to-jobs golden path by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/782
• Check the DNS onboarding premise and record FEAT-107's slices by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/785
• A skipped targeted merge must not exit zero (BUG-109) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/781
• A generated page is not prose: the CLI reference takes the source path (BUG-108) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/784
• FND-0077: release workloads within the declared namespaces, as the deploy identity by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/780
• BUG-105: Stop consumers and every startup from rewriting producer-owned schema subjects by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/783
• BUG-108: sol up and sol deploy looked for the contract under a workspace name, not its path by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/787
• File the generated-reference guard record under a free ticket id by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/788
• Move the restored generated-reference record to DONE by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/789
• Declare who owns the domain, and observe only what Sol owns (FEAT-107, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/786
• File BUG-111: contract reconciliation ran for a TypeScript-only scope by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/791
• BUG-111: Contract reconciliation ran for a TypeScript-only scope and required a local dune by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/790
• Stop one ticket record from replacing another (BUG-110) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/792
• EXP-033: Should transaction scope be represented in Sol's type system? by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/794
• qualification: the GCP destroy target names the deploy context, and the phase timeout stops killing cold runs by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/795
• Complete FEAT-107: observe the installation, instruct and verify the delegation, create or adopt the zone by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/793
• FEAT-111: Add a transactional outbox that preserves the domain's per-key order into Kafka by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/796
• Decide what uninstall removes, and what it refuses to touch (FEAT-108, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/798
• Promote FEAT-121 to READY_FOR_ENGINEERING now that FEAT-111 is on main by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/799
• Promote FEAT-120 for the authorized outbox failure qualification by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/801
• FEAT-108: Add sol uninstall as the explicit, guarded removal of a Sol installation by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/802
• DOCS-029: Write the operations and lifecycle guide — status, logs, rollback, check, open, destroy, uninstall by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/805
• BUG-107: The scaffolded workspace declares one topic name twice, and the two disagree by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/803
• ci: accept a ticket move that git reports as add+delete by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/804
• FEAT-121: Wire the outbox through the pluto demo, the tutorial and the workspace migrations by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/800
• File FEAT-122: surface the installation's identity contracts by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/809
• FND-0077: release the workloads the destroy finds, not the labels they lack by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/806
• File FND-0079: the destroy cannot release a progressive-delivery Rollout by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/807
• FEAT-120: Qualify the outbox path end to end under failure, not just the happy path by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/810
• Promote BUG-112 (demo consumer idempotency) to READY_FOR_ENGINEERING by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/811
• BUG-112: The representative consumer is not idempotent for its domain write under duplicate fact delivery by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/812
• TypeScript golden path declares a partition count and a message key (FEAT-117, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/813
• Guide a first-run installation inline in sol deploy (FEAT-106, part A) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/808
• FEAT-122: Hand the operator the durable root's identity contracts, so an installation completes without a checkout or Terraform knowledge by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/815
• File DEC-058: how a deploy reaches the cluster it provisioned by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/816
• FND-0077: the acceptance criterion is met — one destroy, verified absence by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/814
• DEC-058: record the decision on how a deploy reaches the cluster it provisioned by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/817
• DEC-059: a destroy stops before the substrate when it cannot establish the workloads are released by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/819
• INFRA-097: Release a progressive-delivery Rollout before the destroy drops the database by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/818
• VERIF-001: Prove the transactional facts-to-jobs architecture through the local golden path by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/822
• DEC-059: A destroy stops before the substrate when it cannot establish that the application workloads are released by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/821
• FEAT-117: TypeScript parity: declare a topic's partition count and message key by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/823
• FEAT-106: Make the first sol deploy guide installation inline instead of requiring a separate bootstrap ritual by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/820
• DOCS-026: Write the installation and first-deploy guide by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/825
• DEC-059: A destroy stops before the substrate when it cannot establish that the application workloads are released by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/824
• DEC-057: The OSS developer experience contract — installation vs environment, inline onboarding, and a separate uninstall by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/826
• BUG-094: Preserve state-list failures when resolving an existing cloud cluster by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/827
• BUG-088: Preserve workspace consumer groups through scoped deploys by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/828
• FEAT-090: Extend the target-status surface with cloud health, drift and last operation by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/829
• INFRA-027: Provide infrastructure observability at target scope without unifying the telemetry source by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/830
• BUG-106: Own one migration-directory contract in pg-eio, and roll back by recorded file identity by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/797
• File BUG-113: the documented hook-install recovery cannot run from an owned worktree by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/831
• CODEX_STYLE_AUDIT-078: Reuse observability options at the sol open command boundary by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/833
• BUG-113: The documented hook-install recovery cannot run from an owned worktree by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/834
• DEC-052: Substrate capabilities are observed, not asserted by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/832
• BUG-089: Keep cross-domain caller ingress when deploying a callee alone by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/836
• BUG-101: Scope unit logs by workspace and domain labels instead of a service-name substring by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/835
• BUG-090: Reconcile consumer-group safety state after rollback by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/837
• BUG-095: Keep migration tables distinct for long workspace names by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/838
• BUG-093: Refuse direct rotation of ExternalSecret-owned workload Secrets by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/839
• BUG-091: Isolate sol-jobs claims by workspace in a shared database by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/840
• tickets: promote verified Docker context and merge-finish bugs by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/842
• BUG-092: Align scoped release provenance and commit rollback with the recorded boundary by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/841
• tickets: verify old bug premises and promote Loki push failure by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/845
• BUG-036: sol up leaves a persistent copy of the workspace behind, and that derived state by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/843
• tickets: promote duplicate decision identity bug by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/846
• BUG-038: soldev pipeline merge-finish writes a commit branch protection always refuses by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/844
• BUG-061: Two tickets share id DEC-049, so one is unreachable by id and the other silently answers for it by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/847
• BUG-037: @sol-fab/obs's Loki push treats any non-network failure as success. by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/848
• Record decisions: DEC-029 secret model, DEC-030 closed, DEC-053 Option A, new DEC-061/062/063 by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/849
• File BUG-114; close DEC-030 by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/850
• Triage BUG-052 and BUG-054 by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/852
• DEC-062: decide the workload authorization plane by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/853
• BUG-114: a wrapped Depends on field is rejected instead of silently dropping ids by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/851
• BUG-052: The scaffolded schema-compatibility gate is never run: it is an executable, not a test by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/854
• Run the fast CI guards before every push by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/855
• BUG-115: file the finding — the database suites are cached, and one describes a stale job table by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/858
• Make the hooks work under git: clean env, cheap commit, broad push by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/859
• File REFAC-160: migrate the CLI suite to Windtrap by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/861
• Audit Sol's verification architecture; file VERIF-002..VERIF-013 by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/862
• BUG-115: The database-backed suites are served from cache, and one of them describes a stale job table by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/860
• INFRA-098: file the finding — pipeline review cannot say a PR is already merged by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/864
• REFAC-160: Migrate the CLI test suite to Windtrap inline tests by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/863
• INFRA-098: pipeline review cannot say a ticket's PR is already merged, only that no open PR exists by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/865
• Audit Sol's test suites for contract quality and file the findings by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/867
• VERIF-013: A premise probe that cannot run is reported as a verdict by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/866
• VERIF-014: The shipped sol_jobs migrations are stale, and every DB fixture hand-rolls the schema by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/869
• VERIF-016: A unit suite prints [skip] and passes when the ambient environment already holds the variable it means to test by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/868
• DEC-029: resolve the production secret authority and delivery decision by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/873
• VERIF-003: The canonical test runner fails a green tree, and correctness is coupled to performance by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/871
• VERIF-012: A verification input sits in the docs-only allowlist, and comments outlive the defects they describe by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/872
• BUG-054: A direct deploy, sol up or rollback must not overwrite workload Secret values that sol secret set owns by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/870
• DEC-063: resolve Sol-to-Sol identity (workload identity, not shared keys) by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/876
• DEC-061: resolve the declared-destination and execution-identity decision by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/875
• VERIF-010: External-tool and Dockerfile inventories are duplicated, one of them self-declared unguarded by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/877
• VERIF-008: Scratch-repository helpers trust their caller to sanitize Git's exported environment by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/874
• BUG-054: seed secrets in the golden-path and isolation smokes by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/879
• File REFAC-161: migrate every test suite from Alcotest to Windtrap by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/880
• REFAC-161: every test suite runs on Windtrap; Alcotest is gone by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/882
• BUG-116: docs-only PRs never fall back to the full test suite by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/881
• BUG-116: move the ticket to DONE by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/885
• DEC-062 (part A): guard the deploy identity against IAM mutation by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/884
• VERIF-002: An integration suite's dependency is part of its definition, not of the caller's environment by @loganbnielsen in https://github.com/loganbnielsen/sol/pull/883

This changelog is longer than a release body may be; the full range is at v0.1.0-alpha.6...v0.1.0-alpha.7.