Qualify two signed shadow trains with zero unresolved disagreements

[shiny-code-bot]

Objective

Qualify the exact final policy against the authoritative physical runbook before enforcement.

Finish Line

Two distinct signed shadow trains complete with every disagreement resolved and none unresolved or legacy-correct.

Current Status

Parked at Chris's request (2026-09-08): No active execution is underway for this plan. Resume only when this workstream is explicitly selected again; the evidence, remaining gates, dependencies, and next steps below remain authoritative.

Signed shadow qualification remains incomplete. Preserve retained Train 1 evidence and Train 2 artifacts without upgrading partial evidence to an approved ledger.

The migration workstream #681 has prepared and internally distributed signed 1.0.66 build 202609072309 from d7eac129ecb30efa42d04fb18b2c8e830a57b6b6 on all four platforms. Its corrected 1.0.65-to-1.0.66 beta comparison and bounded Mac app/widget runtime proof are recorded in #681. That beta slice does not satisfy a complete current-policy shadow train or the RC/release all-surface floor. Shared-view lineage and visual/placement approval remain incomplete.

The operational entry point is docs/validation-authority.md. Use current-policy shadow evaluation to classify disagreements while preserving the physical runbook as authoritative. The existing live submission evidence verifier remains enabled in enforce mode and must reject missing current-policy evidence; shadow evaluation is not authorization to bypass it. Two distinct signed trains with no unresolved or legacy-correct disagreement remain required before #612's canary/cutover work.

The bounded collection repair #680 is merged and independently approved by Opus and Gemini. Hosted retained Train 2 run34179639223 passed on merge8b2d7ba with 16 verified/agent-inspected PNGs and eight explicit Mac/tvOS unsupported records; exact inputs, bindings and visual limitations are recorded in #655. This is historical 1.0.63 shared-view collection evidence, not current 1.0.66 approval, human approval, or a completed signed shadow train. #655 remains open for Mac/tvOS adapter gaps and consolidated review. Unsupported capture must not become an unrequested signed-gallery walkthrough; existing Mac render tests remain diagnostic output rather than formal receipts.

Next: qualify the next applicable natural signed train against its complete authoritative comparison, manifests, current runtime evidence, shared-view and placement requirements, and approved lineage. Resolve every disagreement and retain fragile/reference-only replay classifications and residual risks. Documentation reconciliation approves no train, changes no policy or threshold, and does not manufacture another full-fleet ceremony.

Documentation and operator guidance reconciled in PR #691, merged as 3258d08ee36bd9f2c22470e4b1ccb23da6f482f5. Opus and Gemini approved the exact diff; local gates and PR CI/CodeQL passed. This is documentation and discovery metadata only.

Acceptance Criteria

• Run two distinct signed trains, not two executions of one train.
• Preserve the current physical runbook as authoritative throughout both trains.
• Classify every disagreement with public-safe evidence.
• Any unresolved or legacy-correct disagreement blocks enforcement and requires a policy correction plus requalification.
• Replay the complete cited defect corpus under the exact final policy.
• Do not manufacture a new full-fleet ceremony solely to satisfy this gate.
• Record zero unresolved disagreements before Cut over simulator-first RC validation #612 may begin.

Relationships

• Sub-issue of Make RC validation simulator-first and risk-triggered #608.
• Blocked by Implement machine-derived physical-device escalation rules #610, Automate simulator evidence and scoped device actions #611, and the defect corpus.
• Blocks Cut over simulator-first RC validation #612.

[cbusillo]

Signed shadow train 1 nomination — August 31, 2026

The next natural signed train is nominated before execution:

• Train: beta
• Version/build: 1.0.62 (202608311348)
• Source commit: a8b37d624e8a10167a476669219aa47a6357d170
• Prior authoritative full manifest: 1.0.60 (202608101107), manifest f73c3746766bd8e2b6afb7b0c9d2a0d1ffc6b22205c32e18963af44e0809733c, retained under symbolic root shadow-trains
• Comparison oracle: the current physical runbook in docs/release.md and docs/signed-validation-operator-flow.md
• Runtime scope: exactly the unmodified requiredSurfaces.actual-runtime emitted by the authoritative full comparison

This is the routine next TestFlight beta for the accumulated shipping changes after 1.0.61, not a manufactured qualification-only fleet ceremony. Direct local App Store Connect API checks confirmed 1.0.61 is the latest marketing version on iOS, macOS, tvOS, and visionOS.

Pre-execution evidence at the nominated commit:

• scripts/commit-gate.sh: passed, including 920 Swift tests
• Replay inventory offline check: complete-with-reference-only, 3 retained trains, 0 missing inputs
• Signed-train replay Tier A: sources-unverified, expected for retained reference-only receipt bodies
• Physical defect corpus: OK, 4 positive incidents and 4 negative near-misses
• Companion build cache preflight: preflight=OK
• Fresh Production CloudKit schema receipt: sealed to the exact source commit
• Canonical installed runtime: Production/TestFlight 1.0.61; runtime baseline is intentionally not green for the nominated source because the installed fingerprint predates this train

Next: build and distribute the exact nominated identity for every shipping archive layout, collect the sealed expected-build manifests, run the full comparison without filtering requiredSurfaces, and then open the signed coordinator only for the resulting actual-runtime set. Every runbook-versus-ledger disagreement will be recorded with public-safe evidence; unresolved or runbook-correct blocks qualification.

[cbusillo]

Train 1 release review and first dispatch result — September 1, 2026

The nominated identity remains 1.0.62 (202608311348) at a8b37d624e8a10167a476669219aa47a6357d170, but the first dispatch did not produce a signed artifact or App Store Connect build.

Four lower-level upload workflows were dispatched on August 31. The protected release jobs require explicit deployment review. Mac and iOS remained waiting and were canceled on September 1. Vision Pro and Apple TV were approved only after the six-hour Production CloudKit schema receipt expired, then failed at receipt verification before archive/upload. Direct App Store Connect evidence is being rechecked; no partial build is expected because both failures occurred before the archive step.

Opus pre-release review verdict: conditional go at the same version/build/commit, with no product-code blocker. Required corrections before retry:

• Use the documented normal Ship path rather than lower-level upload workflows.
• Split the all-platform beta into four coordinated Ship dispatches because one Ship run accepts only one companion platform and one TestFlight source.
• Mint one fresh receipt immediately before dispatch, using the allowed 24-hour TTL.
• Attend and approve every expected release environment deployment promptly; GitHub reviews each secret-bearing job separately.
• Treat the new user-scoped companion-cache upgrade path as required physical evidence, including first launch without network/iCloud and recovery on iPhone/iPad, Vision Pro, Watch/complication, Apple TV/Top Shelf, and Mac publisher ordering.
• Collect all four sealed expected-build manifests before comparison and run only the unmodified requiredSurfaces.actual-runtime set.

Gemini was invoked for the independent review but returned no textual result, matching the unavailable Gemini behavior already recorded on PR #651. It remains required for the final qualification review and will be retried when the model channel returns output.

[cbusillo]

Train 1 signed archive completion — September 1, 2026

The attended retry succeeded through the documented Ship path for every shipping archive layout, all at the exact nominated identity 1.0.62 (202608311348) / a8b37d624e8a10167a476669219aa47a6357d170:

• Mac Ship run 33491311712: GitHub release, Mac App Store Connect upload, and Mac TestFlight distribution succeeded.
• iOS Ship run 33493210820: iPhone/iPad app, widget, Watch app, and complication archive/upload plus TestFlight distribution succeeded.
• visionOS Ship run 33514783418: native Vision Pro app/widget archive/upload plus TestFlight distribution succeeded.
• tvOS Ship run 33516347919: Apple TV app/Top Shelf archive/upload plus TestFlight distribution succeeded.

Direct local App Store Connect checks now report 1.0.62 as the latest TestFlight pre-release version on iOS, macOS, visionOS, and tvOS. GitHub Release v1.0.62 is published from the exact nominated commit.

All four sealed schema-v2 expected-build manifests bind source manifest eda8469bafc62b76dc9ab0690a9022a4e4437327edb59a93d26856c098fdb451 and contract fingerprint f52608050588c2e6d2c22ac0c5a36a839e321dd23ff080854ddfee0197e1ba0c:

• macOS expected build 33ffe7552654f5f1bf5349060dd1d30d6ccc3087fe7bc6a36ce2475d0e04c1e5
• iOS expected build 87f26195db81cf0cb50cbae274ba4358606a2d892c1643ac30e9869822e17277
• visionOS expected build 01aedca0deeacaa659b130c1d8b4c47131cf36f38c093792e0ce5683ec0d64a6
• tvOS expected build fe39b8eab03d1d1ad2e0142ed31ac87ab9df4e7bff57a7127d828a146274f2a5

Next gate: verify the retained private replay roots, compare the full authoritative 1.0.60 predecessor manifest and all four predecessor expected-build manifests against this exact source/artifact set, do not filter requiredSurfaces, and use only the emitted requiredSurfaces.actual-runtime set for the signed coordinator and physical runbook.

[cbusillo]

Train 1 scope challenge resolution — September 1, 2026

The full 13-surface runtime scope was challenged against completed issues #609–#611 before continuing physical work. The authoritative comparison is correct; the scope is not an accidental return to blanket validation.

Public-safe counterfactual from the exact 1.0.60 → 1.0.62 manifests:

Comparison	shared-view	actual-runtime	placement
Actual schema-v5 comparison	12	13	6
Contract fingerprint held equal	12	13	6
Contract and exact-build identity held equal	12	13	6
Current manifest self-compare	12	0	0

Therefore contractChanged=true and the retained schema-v1 artifact-evidence-unknown diagnostic are not load-bearing for Train 1's physical scope. Runtime fingerprints changed independently on all 13 surfaces, render fingerprints changed on all 12 shared-view surfaces, and placement fingerprints changed on all six placement-capable surfaces. The natural delta includes shared core/CloudKit user-scope behavior and host/runtime changes that genuinely reach every shipping surface.

This matches #610's explicit beta exception for actual runtime-affecting source changes and #616's requirement to use the unmodified requiredSurfaces.actual-runtime set. It also means Train 1 demonstrates the fail-closed/full-change path rather than burden reduction. Scope disagreement with the legacy physical runbook is zero because both request every shipping surface for this delta.

Train 2 should be nominated only on a narrower natural delta with 1.0.62 as the schema-v2 predecessor. It must demonstrate scoped-down device actions and will be the first live exercise of complete semantic artifact comparison rather than the retained legacy-incomplete branch.

Opus review: GO to continue the exact 13-surface runtime and six-placement pass. Gemini was invoked again and returned no textual output; its final-review requirement remains open.