[WIP] Phase 3: image-managed update refusal contract

[andrexibiza]

Implementation in progress on the exact current-main base. This draft will be cleaned to the scoped Phase 3 implementation before review: baked image provenance, shared pre-mutation refusal, durable receipt, and CLI/API/Desktop parity. Architecture owner: #91277; requested carve-out: #91316 comment 5381888616; folds the valid Docker safety behavior from #78958.

[andrexibiza]

Exact Phase 3 materialization/publication receipt — 8bc5ec696d049e2c8ae6ce1de72199db93da1be4

The Phase 3 lane now has a verified exact-source artifact and a corrected publication authority model. It is not yet final branch truth.

Exact current object

• PR head: 8bc5ec696d049e2c8ae6ce1de72199db93da1be4
• Base / exact upstream main: 987064caa4f8845f605ac7346fed5b72fddfb21c
• State: open, draft, mergeable
• Current diff still contains temporary patch/materializer/trigger machinery; generated integration bytes are not yet the PR tree.

Exact materialization proof

• Materializer run 32604705376 — success
• Focused updater/image suite — 54 passed
• Dashboard image/apt refusal selectors — 2 passed, 164 deselected
• Ruff — all checks passed
• Exact generated path-set + manifest — passed

Exact artifact:

• phase3-image-refusal-source-8bc5ec696d049e2c8ae6ce1de72199db93da1be4
• Artifact ID 9483825657
• SHA-256 6b262c99704dbe40458c38e2b756663919cd948e579e45d0af1818e26b8f4ae4
• Size 533512 bytes

The manifest binds exactly these eight generated integration paths:

• Dockerfile
• hermes_cli/main.py
• hermes_cli/update_cmd.py
• hermes_cli/update_inventory.py
• hermes_cli/update_receipt.py
• hermes_cli/web_server.py
• tests/hermes_cli/test_cmd_update_docker.py
• tests/hermes_cli/test_web_server.py

Authority repairs performed

1. The stale astral-sh/setup-uv pin was replaced with the repository's current immutable pin.
2. The PR workflow no longer attempts to push with the upstream fork-PR token. Its upstream role is read-only verification + exact artifact publication.
3. The contributor-owned push path was separated into a fork-only publication job with contents: write. It downloads the same-run artifact, verifies source_head, exact path set, byte counts and every SHA-256, replaces only the declared product files, deletes the seven temporary workflow/patch/trigger files, and creates one product commit.
4. The CLI refusal witness was rebound from retired _prepare_update_output to the current pre-mutation side effects.
5. The dashboard witness now seeds baked image provenance rather than reintroducing legacy detect_install_method == docker authority.

Completion boundary

At final read-back the fork publication job had not produced a new branch head: the PR remains 8bc5ec69... with temporary machinery. Therefore the correct state is verified materialization + repaired publication mechanism, not submitted product implementation.

Completion still requires the exact eight generated files to become this branch's tree, the temporary files to disappear, and fresh exact-final-head CI/Docker/Nix after that mutation. No predecessor green transfers.

[andrexibiza]

Exact-current CI / lifecycle receipt — 8bc5ec696d049e2c8ae6ce1de72199db93da1be4

This runtime/materialization owner is not merge-authorized and has now been read back as draft/WIP.

• Exact CI run 32604705976 is red.
• The sole failing exposed Python job is Python tests 4/4 / job 97108012134.
• That job completed 174 passed / 1 failed / 40 skipped. The reported failure is tests/gateway/test_first_turn_session_meta_rebaseline.py::test_first_turn_meta_rebaseline_loads_from_concrete_gateway_module, asserting the runner retained the original _auto_continue_status_ttl instead of the test's monkeypatched authority.
• The current [WIP] Phase 3: image-managed update refusal contract #92545 changed-file set is Phase-3 product/machinery only; it does not include that gateway test or its runtime owner. File-surface separation is established; semantic non-causation is not inferred from that fact.
• Direct read-back of tests/gateway/test_first_turn_session_meta_rebaseline.py at both exact upstream main@987064caa4f8845f605ac7346fed5b72fddfb21c and the CI merge-source object e3e6c264d89a5b0c025ed5a0d388e7e347e1a794 does not expose the reported failing test name. That source/job mismatch must be reconciled before anyone labels this a Phase-3 regression or an unrelated flake.
• I attempted the narrow safe next step — rerun exact failed job 97108012134 — and GitHub rejected it with 403 Resource not accessible by integration. That is a permission receipt, not a diagnosis.
• The connected convert to draft mutation returned an internal connector error, but authoritative post-write read-back now shows draft: true and title [WIP] Phase 3: image-managed update refusal contract. The mutation therefore did take effect despite the error response. This is exactly why mutation responses are not completion receipts; read-back controls repository truth.

The successful materializer run 32604705376 and artifact 9483825657 remain valid evidence for the generated eight-file candidate only. They do not convert the temporary branch tree into submitted product implementation and do not supersede the red exact-head CI receipt.

Completion remains: reconcile the CI source/job discrepancy; publish the exact eight generated product files onto this branch; remove temporary materializer/trigger/patch machinery; then obtain fresh CI/Docker/Nix on the resulting exact final head.