FEATURE-ci-v3-integration: Mark local task complete

Author: etr

specs/tasks/FEATURE-ci-v3-integration.md

@@ -1,7 +1,8 @@
 # FEATURE-ci-v3-integration
 
-Status: locally implemented and tested; local verification recorded in the task evidence;
-actual GitHub PR verification and final validation remain root-owned.
+Status: Complete (local implementation, validation and finalization).
+Current-source GitHub platform and full release receipts remain CI / v3 PR owned;
+completion does not claim release readiness.
 
 Scope: native CI/replay, installed platform prerequisites, bounded fuzz campaigns,
 selected-archive release acceptance and publication enforcement. No production
@@ -41,3 +42,12 @@ focused public TLS run using the existing isolated network path passed all four
 shared/static and managed/external cells (82 checks each). This proves the
 affected prerequisite correction; it does not turn the failed whole matrix into
 a passing receipt. The fresh complete 18-gate release run remains pending CI.
+
+Final local validation (2026-10-23): six Groundwork iterations closed 18 blocking
+findings. The final real symlink-root and real ps regression passed 22 focused
+and 55 affected-module tests. Earlier source-bound native TLS, sanitizer replay,
+workflow and release-contract evidence is retained in the durable validation
+record. Current source c794aaac is pushed to PR #381; Verify Build and ChangeLog
+pass, while native/fuzz, CodeQL and platform/archive workflows remain pending.
+Prior failed receipts remain unsuccessful. Two approved unworked observations
+are persisted under specs/unworked_review_issues/. No tags or releases created.

specs/unworked_review_issues/feature-ci-v3-integration_validation_76fa36c5f482041c76a83b09d97a158e.md

@@ -0,0 +1,17 @@
+# Unworked Review Issues
+
+**Run:** 2026-10-23 03:13:10
+**Task:** FEATURE-ci-v3-integration
+**Total:** 2 (0 critical, 1 major, 1 minor)
+
+## Major
+
+1. [ ] **cloud-infrastructure-reviewer** | `.github/workflows/v3-native.yml:77` | iac-anti-pattern
+   [Reliability — Failure propagation] New tee pipelines at lines 77 and 86 mask bootstrap/Configure failures because the step has neither shell: bash nor set -o pipefail. GitHub implicit Linux shell is bash -e. A bounded execution of this exact script with bootstrap exit17 and Configure exit23 returned 0 and continued after bootstrap failed. New tests at scripts/test-v3-ci-workflows.py:92 and genuine evidence manually supply pipefail, masking the mismatch.
+   *Recommendation:* Declare shell: bash on the step or enable pipefail in its script. Derive behavioral test shell flags from the workflow; verify bootstrap failure stops before Configure and Configure retains its nonzero status with logs uploaded. See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsshell
+
+## Minor
+
+2. [ ] **code-simplifier** | `.github/workflows/v3-release-acceptance.yml:486` | code-structure
+   The publisher constructs its complete expected authorization binding in four densely packed lines, including an embedded producer-artifact comprehension. This makes individual environment-to-binding assignments harder to audit alongside the subsequent identity checks.
+   *Recommendation:* Optionally format this dictionary with one binding field per line and construct the producer_artifacts mapping in a clearly named local variable before assembling expected. Preserve every field, comparison and environment lookup, and keep the publisher code inline so its no-downloaded-code boundary remains unchanged.