Align development deployment validation with the reviewed Relay runtime contract

[alexeygrigorev]

Goal

Make the supported DTC development deployment accept and preserve the reviewed Relay runtime configuration from aws-infra #58 while retaining exact target boundaries. Restore development through the ordinary deployment path after the separately owned infrastructure prerequisites are satisfied. Preserve every course feature and UI.

Evidence and current state

• Exact source audited: 19e7393489b7158c30bae39f93915a1219f2c757.
• Authorized reset run 36601136596 completed schema migration, then failed relay_schedule_sync with exit 22. Both website services are stopped. No second database reset is part of this issue.
• The failed migration:53 definition lacks the Relay URL and secret references. aws-infra #58 already has accepted source providing them; live activation was not performed. Do not duplicate its Terraform implementation.
• deploy/update_task_definition_image.py:98-99 invokes validate_source_workload(). That calls _secrets() in deploy/task_definitions.py:194-218, which currently permits exactly DATABASE_URL and DJANGO_SECRET_KEY. Correct four-secret definitions from Preserve graduates, certificates, and historical Wrapped records #58 therefore fail before registration.
• The active updater preserves unrelated environment entries and existing secret references. It does not fetch or synthesize missing runtime credentials.
• deploy/deploy_website.sh:155-177 reads web/worker source definitions from the services' selected task-definition ARNs; only migration uses the latest family revision. Registering new web/worker family revisions alone does not repair those sources.

Read first and normative ownership

• _docs/PROCESS.md: separate engineer, tester, PM and on-call gates; no pull requests.
• _docs/specs/08-aws-development-terraform.md: Relay client boundary, secret confidentiality and separate application/infrastructure permissions. Its opening sandbox physical identifiers are historical; do not revive or widen that retired target.
• _docs/runbooks/release-deployments.md: supported controller, current targets, exact service-source selection and release gates.
• deploy/deployment_targets.py: single closed target-definition owner. Current target is website-development, URL https://dev.datatalks.club, namespace website-dev, region eu-west-1, account 387546586013. Production remains independently scoped.
• _docs/ci/change-selective-ci.md: frozen verification plan and evidence classification.
• Current coding-standard.md, including the reviewed local version in the shared checkout if it has not landed on main. Read that checkout only; do not copy unrelated work.
• aws-infra main/dev/README.md, Website Relay runtime contract, main/dev/website_service.tf shared task locals and main/dev/iam.tf execution policy: operator activation ownership.

Scope

• Give the supported active development promotion gate one authoritative, target-scoped secret-reference contract matching aws-infra Preserve graduates, certificates, and historical Wrapped records #58.
• Require exactly one each of DATABASE_URL, DJANGO_SECRET_KEY, RELAY_API_KEY, and RELAY_WEBHOOK_SECRET for active development source tasks.
• Keep existing database/Django reference checks. Relay references must be the development integrations secret in the selected region/account/namespace, with the exact corresponding JSON selector:
  • arn:aws:secretsmanager:eu-west-1:387546586013:secret:website-dev/integrations-<six-character AWS suffix>:RELAY_API_KEY::
  • arn:aws:secretsmanager:eu-west-1:387546586013:secret:website-dev/integrations-<six-character AWS suffix>:RELAY_WEBHOOK_SECRET::
• Both Relay entries must identify the same integrations secret container. Derive target identifiers through the existing target owner; do not create a second target registry or shell literals.
• Preserve source RELAY_BASE_URL and both selectors through image promotion for web, worker and migration. Do not guess a private endpoint or rewrite a configured URL. Live URL/configuration correctness remains the infrastructure/runtime prerequisite below.
• Preserve production's existing exact secret contract and every existing role, family, account, architecture, command, single-container and immutable-image guard.
• Add a concise recovery handoff to the supported release runbook. No workflow permission expansion is needed.

Non-goals

• No UI, template, route, feature, notification-policy, package-pin, database-model or schema change.
• No second reset, migration/Relay bypass, ad hoc secret injection, credential retrieval/logging, Terraform apply, or production mutation under this source issue.
• No new main/dev apply workflow and no widening of the sandbox Terraform workflow.
• No broad rewrite or deletion of the retained manual normalizer/release machinery. If a shared helper is extracted, preserve existing callers' distinct contracts; expand changes only for a demonstrated dependency and report it before broadening scope.
• No progress on frozen answer-check consolidation Investigate shared homework scoring consolidation without behavior changes #439 until development recovery is green.

Dependencies and ownership

Source implementation is ready: aws-infra #58 already supplies the accepted reference schema. Live activation is an external dependency, not a reason to block local implementation or claim recovery from local tests.

• Engineer: isolated worktree, source/tests/runbook only, frozen uncommitted handoff.
• Independent tester: verification plan, contract/security boundary and regression evidence.
• PM: source acceptance after tester pass; independently record outstanding live criteria.
• Authorized infrastructure operator: existing Preserve graduates, certificates, and historical Wrapped records #58 activation and stopped-service source reconciliation.
• Orchestrator/on-call: ordinary exact-main deployment after accepted source and operator prerequisites; one CI/deploy observer.

Source acceptance criteria

• A valid development definition with the four exact references passes the real active module CLI for web, worker and migration; the resulting registration document retains the URL and exact secret entries while updating only the existing owned release fields/command normalization.
• Missing, duplicate or unexpected secret names; wrong region/account/namespace/container; malformed references; missing, swapped or incorrect JSON selectors; added stage/version selectors; and mismatched Relay container ARNs are refused. No source credential value is printed. Failure occurs before registration of the offending definition, task launch or service promotion; an earlier successfully validated family need not be retrospectively unregistered.
• Valid production definitions still pass unchanged. Production rejects development Relay references and additional secret names. Existing target, role, family, architecture, container, command and image rejection tests remain effective.
• The real deploy shell integration fixture models all three corrected development definitions, proves preserved Relay configuration at registration, uses service-selected web/worker revisions, and runs the ordinary migration/schedule/template sequence with reset absent. A rejected source cannot launch migration or promote services. No database reset command is introduced.
• New tests run in the applicable repository/deployment verification selection. Existing oversized test files are not simply expanded to hide new coverage outside the runner.
• New handwritten functions are at most 30 lines and files at most 300 lines. Existing oversized modules/functions do not grow; any necessary extraction follows one cohesive validation responsibility and preserves callers. No ternaries or filtered/nested comprehensions are added. Any unavoidable exception is justified explicitly.
• Engineer and independent tester record exact base/head/worktree state, plan and graph digests, commands/counts and evidence dispositions. Follow the generated verification plan, blocking lint and applicable advisory report; do not narrow a required full gate. PM accepts only after tester pass.
• The release runbook records the operational handoff below, with source acceptance clearly distinguished from live recovery.

Verification scenarios

1. Extend coverage at the existing owners: TaskDefinitionImageUpdateTests in core/tests/test_cmp_style_deployment.py provides production and real dev module-CLI examples; ci/tests/test_deploy_release_verification.py provides the real shell/fake-AWS transport harness and service-source selection coverage. Prefer cohesive separate test modules/helpers where size limits require them; update discovery if necessary.
2. Use inert synthetic ARNs and fake AWS only for local contract tests. At least one authoritative test must fail on the old two-secret validator and pass on the fix. Reuse existing negative guards where they already prove unchanged behavior.
3. Browser/screenshots: this is deployment control-plane code with no render impact. Product-page screenshot evidence is not_applicable, with that reason in the plan/report. Run the repository-required backend Playwright smoke tier and any additional graph-selected gates; do not invent course visual changes to justify screenshots.
4. No cloud access, infrastructure mutation or secret-value read is required to complete source acceptance.

Separately owned live recovery prerequisites and evidence

These criteria remain unchecked until their named owner supplies actual evidence. Source acceptance may proceed first; use Refs #442 and leave the issue open while live criteria remain outstanding.

• [OPERATOR] Complete Preserve graduates, certificates, and historical Wrapped records #58's non-printing secret-shape preflight and review a fresh saved plan from the accepted main/dev revision, using its existing approved operator path. No authorized main/dev apply workflow currently exists; the sandbox workflow must remain scoped to sandbox.
• [OPERATOR] Reconcile the README restriction limiting activation to task-definition/IAM changes with the necessary web/worker service-pointer updates. The current Terraform resources point those services at its task definitions, but DTC deploy reads their selected revisions. Explicitly review the pointer changes, safe image references and live drift; do not silently bypass the README restriction. Keep both desired counts at zero during preparation. Stop for unrelated state, IAM, networking, database, replacement or service-count changes.
• [OPERATOR] Provide redacted evidence that all three selected deployment sources have the reviewed Relay URL/selectors and required execution access. Secret content and remote state must not enter issue comments/artifacts. Registering family revisions without fixing stopped service pointers is insufficient.
• [ON-CALL] After accepted DTC source is merged and exact-SHA CI passes and operator prerequisites are complete, run the ordinary deploy-dev.yml path with confirm_dev_schema_reset EMPTY. Never dispatch another schema reset for this recovery. A push-triggered attempt before operator readiness is not recovery success and must remain failed/blocked.
• [ON-CALL] Record exact successful run/SHA/image, migration/schedule/template completion, service/runtime health and readiness at https://dev.datatalks.club, then the Preserve graduates, certificates, and historical Wrapped records #58-required deployed sync_relay_schedules --dry-run no-diff and jobs_ingress_selftest OK evidence, without secrets. Failure keeps recovery open; no success record or resumed Investigate shared homework scoring consolidation without behavior changes #439 on partial evidence.

Related: #438, #440, aws-infra #58. #439 remains held.

[alexeygrigorev]

Grooming Complete

Ready for engineering in an isolated worktree. The issue now specifies the exact development Relay secret/JSON-selector contract, unchanged production and negative guards, active CLI coverage for all three workloads, real shell integration coverage, and current coding limits.

Source acceptance is independent of outstanding aws-infra #58 activation. Live recovery remains open until the operator resolves the stopped-service pointer handoff under a reviewed plan and on-call observes an ordinary successful Deploy Dev with empty reset confirmation. No second reset, secret reads, workflow widening, UI changes, or #439 resumption is authorized by this grooming.

Evidence reviewed: DTC source 19e7393; active updater/validator, target registry, shell/workflow and existing tests; current coding standard, process/specification/runbook; existing aws-infra #58 and main/dev runtime contract. No source edits, tests, cloud calls, commits or pushes performed.

[alexeygrigorev]

Software Engineer Report

Source implementation is complete and frozen, uncommitted, for independent tester review. No cloud calls, secret-value reads, infrastructure activation, reset, deployment, UI or feature changes were performed. Live recovery remains outstanding under the separately owned prerequisites in this issue.

Candidate and ownership

• Worktree: /data/agents/dtc-website/worktrees/dev-relay-contract-442.
• Branch: fix/dev-relay-contract-442.
• Exact base and HEAD: 19e7393489b7158c30bae39f93915a1219f2c757.
• Nine changed paths: .github/workflows/deploy-dev.yml, _docs/runbooks/release-deployments.md, ci/tests/test_deploy_relay_contract.py, ci/tests/test_deploy_release_verification.py, core/tests/deployment_fixtures.py, core/tests/test_cmp_style_deployment.py, core/tests/test_deploy_relay_secrets.py, deploy/task_definitions.py, deploy/task_secrets.py.
• Frozen source manifest SHA-256: eaf03f42670185d4eb7821644b318693ba323924c35214ba6088afc92d34b0ee.
• Complete tracked plus new-file patch: .tmp/442/candidate.patch; SHA-256 db3e47341999cacc5b1fdf6efa908b730fe1f5a446526d10b9a1500cc94abc54.

Behavior and scope

• One cohesive secret-reference owner parses and validates names and references. Active development promotion requires the four reviewed references, exact target-derived ARN boundaries and matching integrations container with exact JSON selectors.
• The retained manual normalizer uses the same parsing/boundary owner with its existing two-secret contract. Production remains two-secret. The existing active promotion source-role, family, architecture, container, command and immutable-image guards remain in place.
• The active updater continues preserving source RELAY_BASE_URL and exact secret entries for web, worker and migration. It does not invent a runtime endpoint or inject credentials.
• Real CLI coverage moved out of the oversized deployment test module into a separate module that the development deployment test job explicitly runs. A cohesive synthetic source fixture is shared with the real shell/fake-AWS tests; the old oversized fixture and CLI test shrink.
• New shell coverage proves all three registrations preserve Relay configuration, ordinary migration/schedule/template order, no reset command, and invalid web/worker/migration sources rejected before their registration, task launch or service promotion. Existing tests continue proving service-selected web/worker revisions rather than poisoned family-latest revisions.
• Runbook records source acceptance versus operator activation, stopped service-pointer reconciliation, empty reset confirmation, and required live recovery evidence. No broad normalizer rewrite or workflow permission expansion.

Regression and focused checks

• Before source change: uv run --frozen python -m unittest core.tests.test_deploy_relay_secrets failed exactly the three valid development workload subcases with the old two-secret refusal. Production subcases passed. Retained .tmp/442/before.log (SHA-256 180a8c6335797056555bc97971a1859845a80faef3a161306f383ef92fc6d1a8).
• After source change: uv run --frozen python -m unittest core.tests.test_cmp_style_deployment core.tests.test_deploy_relay_secrets: 26 tests passed; .tmp/442/cli.log.
• uv run --frozen pytest ci/tests/test_deploy_relay_contract.py ci/tests/test_deploy_release_verification.py ci/tests/test_deploy_recovery_receipt.py ci/tests/test_dev_reset_controller.py -q: 35 passed; .tmp/442/shell.log.
• Blocking lint passes via this revision's maintained uv run --frozen python scripts/ci.py lint; format check passes, mypy passes 653 source files, migration drift and Django/deployment checks pass in the quality gate.
• Advisory uses the current read-only shared coding-standard config: uv run --frozen ruff check --config /home/alexey/git/dtc-website/ruff-advisory.toml --statistics --exit-zero .. Repository report: 1019 advisory findings in .tmp/442/advisory.log; new modules independently have zero advisory findings. No unrelated remediation included. This revision does not yet have the newer Make lint/advisory targets, so the corresponding explicit commands were used.
• New file/function maxima: task_secrets.py 63/26 lines; deployment_fixtures.py 58/21; test_deploy_relay_secrets.py 131/22; test_deploy_relay_contract.py 53/19. No new ternaries or filtered/nested comprehensions; existing oversized source/test files shrink. git diff --check passes.

Versioned verification

Final plan and artifacts are under .tmp/verification-final/; this directory alone is the accepted engineer evidence. An earlier attempt found a missing heterogeneous test-list type annotation; it was fixed and that attempt stopped. A first custom-directory runner invocation correctly refused the old default plan before executing; the successful invocation explicitly bound plan, evidence and report paths. No failed or interrupted evidence was reused.

• Plan generated with VERIFY_ISSUE=442 VERIFY_OUTPUT_DIR=.tmp/verification-final uv run --frozen python scripts/ci.py verification-plan.
• Executed with VERIFY_ISSUE=442 VERIFY_PLAN=.tmp/verification-final/verification-plan.json VERIFY_EVIDENCE_DIR=.tmp/verification-final/evidence VERIFY_REPORT=.tmp/verification-final/verification-report.json uv run --frozen python scripts/ci.py verification-run.
• verification-evidence-check and verification-report-check both pass with those exact plan/evidence/report path variables.
• Policy 5; full profile; reason test_infrastructure; browser profile smoke; direct nodes shared.core, surface.ci, surface.deploy, surface.documentation, surface.github; no downstream nodes. Risk flags: deployment_runtime, shared_runtime, test_infrastructure.
• Graph SHA-256: 557fbababfd8ff983fa88aa29cdef88833c52667878ee72ff3493ae9c66d0ed1.
• Canonical plan digest recorded by the validated report: 2c1a98699e6a50cb3b6995047d0a7879d0a02fadb61062929354341d3f7b887d.
• Plan file SHA-256: 83f379437f99af5ac2b0029f688dd83a66e52ab5b499fb1584aa64a4e4801367.
• Verification-state digest: 89f8d3bffd485bed7bb099afaeb3d63ed6568c67aaa92b10380930154b44e3a4.
• Report file SHA-256: c1c99379ea90ed2ac1930463f82b890a5d81cb6b9fad2b42b114167186d1d09a; verdict success, no invalid evidence.

Bucket	Components and evidence
rerun	selector: 1 assertion; evidence_validation: 711 passed, 5 skipped; quality: 711 passed, 5 skipped plus primitive checks; django: 4149 tests, 6 skipped, 1 expected failure, OK; playwright: 30 passed, 321 deselected, zero failed/rerun/quarantined; container: 13 assertions, successful fresh build/static negatives/migration/runtime checks
reused	None; all six executable components ran fresh
skipped	None; no required component lacks evidence
not_applicable	screenshots: graph reports no render impact, deployment control-plane code only, render_inputs_unchanged_without_reusable_visual

Component commands are scripts/ci.py verification-plan, scripts/ci.py test-ci, scripts/ci.py verification-quality, scripts/ci.py test-django-full, scripts/ci.py test-playwright-smoke, and scripts/ci.py verification-container, all through locked uv. Each component has its result, environment, output and digest-bound envelope under .tmp/verification-final/evidence/. Local provenance is engineer, issue 442 (the runner's worktree label defaults to local; the exact physical candidate is identified above). Independent tester must recompute the same source facts and validate evidence under the tester contract; PM acceptance remains pending.

Remaining live criteria

All operator/on-call criteria remain unchecked: infrastructure #58 activation, exact stopped service-source reconciliation, ordinary exact-main deployment with empty reset input, runtime health, deployed schedule no-diff and ingress self-test. Keep #442 open with Refs #442 after source acceptance; #439 remains held. No commit or push made.

[alexeygrigorev]

QA Review — PASS (source acceptance only)

Frozen candidate: worktree /data/agents/dtc-website/worktrees/dev-relay-contract-442, branch fix/dev-relay-contract-442, base/head 19e7393489b7158c30bae39f93915a1219f2c757, five modified and four new paths. Full candidate patch SHA-256 db3e47341999cacc5b1fdf6efa908b730fe1f5a446526d10b9a1500cc94abc54; source manifest eaf03f42670185d4eb7821644b318693ba323924c35214ba6088afc92d34b0ee, unchanged after testing. git diff --check passes. No product edit or commit was made by QA.

Independent VERIFY_ISSUE=442 VERIFY_CONSUMER=tester uv run --frozen python scripts/ci.py verification-plan produced .tmp/442/tester-independent/verification-plan.json (file SHA-256 16732fc1e3e46a93c7f66336230bcba749b2dc6d60f27aa00f11c29c5760b33b). Its complete structural comparison with the engineer's frozen plan found exactly one difference: created_at. The resulting plan digests differ (54777d9f6d82f8d9239695b126e617b13d20d38348b236d99066226059b80ec8 tester; 2c1a98699e6a50cb3b6995047d0a7879d0a02fadb61062929354341d3f7b887d engineer), with the same graph 557fbababfd8ff983fa88aa29cdef88833c52667878ee72ff3493ae9c66d0ed1, state 89f8d3bffd485bed7bb099afaeb3d63ed6568c67aaa92b10380930154b44e3a4, policy 5, full profile, selected nodes, components and dispositions. All six executable components require fresh reruns; no evidence is reused. Screenshots are not_applicable because deployment control-plane changes have no render impact.

I independently validated the engineer's frozen plan, evidence directory and report (.tmp/verification-final/; report SHA-256 c1c99379ea90ed2ac1930463f82b890a5d81cb6b9fad2b42b114167186d1d09a). The tester reran VERIFY_ISSUE=442 VERIFY_PLAN=.tmp/442/tester-independent/verification-plan.json VERIFY_EVIDENCE_DIR=.tmp/442/tester-independent/evidence VERIFY_REPORT=.tmp/442/tester-independent/verification-report.json VERIFY_PRODUCER_ROLE=tester VERIFY_PHASE=tester VERIFY_CONSUMER=tester uv run --frozen python scripts/ci.py verification-run, then separately validated its evidence directory and report. Tester report .tmp/442/tester-independent/verification-report.json has SHA-256 48b595b0b3772432f89479e4bf885a6a6ef8f8c697a949c6e1d6227ef99c9af9, verdict success, six successful reruns, zero reused/skipped components and zero invalid evidence. The validator checked origin, expiry, source manifest, relevant input/environment/policy digests, artifact hashes, latest exits and component counts.

• Quality and evidence-validation components: 711 passed, 5 skipped each; blocking lint/format/type/migration/deployment checks passed. Full Django: 4,149 tests, 6 skipped, 1 expected failure, zero unexpected failures. Browser smoke: 30 passed, 321 deselected, zero reruns/quarantines. Container: 13 assertions, zero failures. Selector: 9 changed paths, 5 direct nodes, zero downstream nodes.
• Independent issue-specific commands: uv run --frozen python -m unittest core.tests.test_cmp_style_deployment core.tests.test_deploy_relay_secrets → 26 passed; uv run --frozen pytest ci/tests/test_deploy_relay_contract.py ci/tests/test_deploy_release_verification.py ci/tests/test_deploy_recovery_receipt.py ci/tests/test_dev_reset_controller.py -q → 35 passed. The advisory command using the current shared config reports 1,019 existing repository findings and zero in the four new Python modules. This checkout predates the newer Make advisory target.
• Code/contract review: the real module CLI accepts four exact target-scoped development references for web, worker and migration, preserves the configured Relay URL and references during image promotion, and retains the production/manual two-secret contracts. CLI negatives reject missing/duplicate/extra names, malformed references, incorrect region/account/namespace/container/selectors, stage/version and differing Relay containers without printing references or secret values. The real shell/fake-AWS fixture exercises service-selected web/worker sources and latest migration source, migration → schedule sync → template import with no reset, and failure before launch/promotion for an invalid source. Existing target, role, family, architecture, command, container and immutable-image guards remain covered. Workflow discovery includes the new test module; the runbook distinguishes source acceptance from live recovery. New functions/files respect the current size/style limits.

The ordinary controller explicitly sets desired web/worker counts to the selected deployment profile after successful migration; development currently specifies 1/0, so it can restore web from zero if the required sources and schedule/template steps succeed. Its existing fixture starts at 1/0; this is an operator handoff qualification, not a source acceptance failure.

No cloud call, database reset, service promotion or credential read was made. This PASS covers the source criteria only. The separately owned #58 activation, service-pointer reconciliation, redacted runtime-source proof, exact-main CI/deploy and live readiness/Relay checks remain open; do not claim development recovery or resume #439 from this review.

[alexeygrigorev]

Product Acceptance — ACCEPT (source acceptance only)

I reviewed the groomed criteria, all nine changed paths, the engineer report, the independent QA PASS, and the tester-final verification artifact. The frozen candidate satisfies the source acceptance criteria and is ready for its focused commit with Refs #442.

Accepted candidate: /data/agents/dtc-website/worktrees/dev-relay-contract-442, branch fix/dev-relay-contract-442, base/head 19e7393489b7158c30bae39f93915a1219f2c757; patch SHA-256 db3e47341999cacc5b1fdf6efa908b730fe1f5a446526d10b9a1500cc94abc54, source manifest eaf03f42670185d4eb7821644b318693ba323924c35214ba6088afc92d34b0ee. The five modified and four new source paths remain uncommitted and unchanged through QA.

Acceptance reasons

• The active development gate accepts and preserves the four reviewed references and configured Relay URL for web, worker and migration. Exact ARN boundaries, corresponding JSON selectors and same integrations container are enforced; malformed, missing, duplicate, foreign or additional references are refused without exposing secret values.
• Production and retained manual-normalizer contracts remain unchanged. Existing family, role, architecture, command, container and immutable-image guards remain enforced. Failure prevents registration of the offending definition, task launch and service promotion.
• Real CLI and shell tests cover the supported transport and existing service-selected source behavior. The ordinary migration, schedule synchronization and template import sequence remains fail-closed; no reset or bypass was introduced. The workflow explicitly discovers the new CLI tests.
• Cohesive secret-validation and test-fixture extraction meets the current coding limits; existing oversized modules shrink. No template, route, navigation, copy, authentication flow, course feature or rendering input changed. Product-page desktop/mobile screenshots, responsive review and changed-page empty states are not applicable for this deployment-only change; backend browser smoke is complete.
• The runbook provides the necessary operator handoff and clearly separates source acceptance from live recovery. Stopped service pointers must select the corrected definitions; registering newer family revisions alone is insufficient. The ordinary controller restores its reviewed development counts, web 1 / worker 0, after successful migration. Keeping both services at zero during preparation does not require changing that controller.

Verification acceptance

Read tester-final .tmp/442/tester-independent/verification-report.json; its SHA-256 is 48b595b0b3772432f89479e4bf885a6a6ef8f8c697a949c6e1d6227ef99c9af9, matching QA. Verdict is success; phase is tester; all six executable components are classified exactly once as successful fresh reruns, with zero reused/skipped components and zero invalid evidence. Screenshots are classified once as not applicable because render inputs are unchanged. The independent plan's timestamp-only digest difference is explained by QA; source state, graph and selected components agree.

Evidence includes 4,149 Django tests (6 skipped, 1 expected failure; no unexpected failures), 30 passing browser smoke cases, 13 container assertions, 711 passing quality/evidence-validation tests with 5 reported skips per component, and successful selector/lint/type/migration/deployment checks. The issue-specific suites independently passed 26 CLI/contract tests and 35 shell/recovery/reset tests. These reported test-level skips are distinct from required verification components: no required component is skipped or pending. No additional broad rerun was needed for PM review.

Live recovery remains open

All operator and live-recovery criteria remain unchecked. This acceptance does not activate infrastructure, authorize credential access, claim development health, or release #439's hold.

The authorized operator must activate existing aws-infra #58 through its reviewed saved-plan path, explicitly reconcile its README task-definition/IAM restriction with the necessary stopped-service pointer changes, preserve zero preparation counts, and provide redacted configuration/access evidence. No sandbox workflow widening or ad hoc secret injection.

After those prerequisites and exact-main CI pass, use ordinary deploy-dev.yml with confirm_dev_schema_reset EMPTY. Never repeat the database reset for this recovery. Keep #442 open until successful deployment, readiness, schedule no-diff and ingress self-test evidence exists; keep #439 held until recovery is green.

No source edits, tests, cloud calls, credentials, commits or pushes were performed during PM acceptance. Only this report and local scratch were written.

[alexeygrigorev]

Software Engineer — Accepted candidate committed

After independent QA PASS and PM ACCEPT, committed the unchanged nine-path candidate as 0ff78c0eae4e8b887aea01d7c003125dc53e4e26 on fix/dev-relay-contract-442, with Refs #442.

• Parent: 19e7393489b7158c30bae39f93915a1219f2c757.
• Commit tree: b454a2e75c37925fbf37ca3194430f2c2a04ea72.
• Diffstat: 9 files, 355 insertions, 174 deletions.
• Verified frozen patch SHA-256 before staging: db3e47341999cacc5b1fdf6efa908b730fe1f5a446526d10b9a1500cc94abc54.
• Fresh committed Git manifest SHA-256: eaf03f42670185d4eb7821644b318693ba323924c35214ba6088afc92d34b0ee, exactly matching the engineer and tester source snapshot. No source edits or broad reruns were needed.
• Engineer evidence: .tmp/verification-final/verification-report.json, SHA-256 c1c99379ea90ed2ac1930463f82b890a5d81cb6b9fad2b42b114167186d1d09a.
• Independent tester evidence: .tmp/442/tester-independent/verification-report.json, SHA-256 48b595b0b3772432f89479e4bf885a6a6ef8f8c697a949c6e1d6227ef99c9af9.
• Worktree /data/agents/dtc-website/worktrees/dev-relay-contract-442 is clean (git status --short empty); scratch/evidence remains ignored.

No push, deployment, cloud operation or reset. Live recovery remains open and #439 remains held.

[alexeygrigorev]

Integration handoff

Independent QA passed (#issuecomment-5895606099) and PM accepted the source (#issuecomment-5895623523). Original engineer committed the frozen nine-path snapshot as 0ff78c0eae4e8b887aea01d7c003125dc53e4e26.

P18 against fetched origin/main=19e7393489b7158c30bae39f93915a1219f2c757 produced tree b454a2e75c37925fbf37ca3194430f2c2a04ea72, no conflicts. The isolated no-ff integration commit is ddb898e737f68d43bd47fc4f89d357fe32386fb6, with exactly that tree. Shared main was untouched. Diff check is clean.

Pushing 19e7393..ddb898e. The sole on-call is the independent tester session now assigned post-push observation; no concurrent watcher. The previous coding-standard peer is no longer present in the native workspace registry; its unpushed branch and dirty checkout remain untouched.

This is source integration only. Live operator criteria remain unchecked, #442 stays open and #439 stays held. The ordinary push-triggered workflow has no reset confirmation. No manual deploy or further reset is dispatched here; infrastructure activation and exact-main CI remain prerequisites for recovery.