Promotion gates, all behind delegated auth and append-only, hash-verified records. Nothing writes to the live Automation repository: LIVE_PROMOTION_ENABLED is a literal false and the only write path accepts a marked test repository under the OS temp directory.
- Phase 23: promotion preflight (C01-C34) and disposable promotion execution in a throwaway clone.
- Phase 24: live promotion safety gate (L01-L45) and a final confirmation that can only record blocked/refused outcomes.
- Phase 25: final release gate (R01-R35), single-use 5-minute capabilities, post-promotion verifier and audit trail.
- Phase 26: production target declaration and read-only attestation.
- Schema ladder v15-v22 (v23 written and tested, not yet wired), foreign key enforcement read-back, column-repair helper.
Hardening:
- Shared forbidden-body-fields policy on every write route, enforced by a route-inventory test; investigations now refuse path-bearing fields.
- AUTOMATION_DIR syntax validated before resolution (path-policy).
- Git reads ignore user and system git configuration.
Diagnosis without a provider:
- diagnosis.service classifies failures by known error signatures and explains them in plain language; Failures view and client added.
Frontend: panels for phases 23-26 and the failure explorer. Probe scripts used for manual migration and boundary checks included.
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com