fix: close release validation gaps

[HardcoreMonk]

변경 내용

• OpenAI·Google non-leak test sentinel의 runtime 값은 유지하면서 source spelling을 분할해 strict tracked-tree secret scan을 복구했습니다.
• MCP flock smoke가 hard-coded orchestrator 대신 spawn response의 실제 roster member ID를 사용하도록 교정했습니다.
• 2026-08-13 프로젝트 공정 분석 보고서, lifecycle spec/grill/plan, pre-release handoff를 추가하고 분석 색인을 현재 upstream v0.7.0 baseline으로 갱신했습니다.

원인

Secret scanner는 의도된 credential-shaped test fixture와 실제 secret을 구분할 수 없었고, flock smoke는 roster authorship guard 도입 전의 author ID를 계속 사용하고 있었습니다. Scanner나 daemon guard를 완화하지 않고 fixture/caller만 수정했습니다.

영향

Runtime API, MCP schema, daemon security policy에는 변화가 없습니다. 이 PR은 release gate와 검증 코드·증적을 정합화합니다. 정식 tag/release publish는 포함하지 않습니다.

검증

• go test ./... -count=1
• go test -race ./... -count=1
• go build ./...
• go vet ./...
• go mod verify
• govulncheck ./... — reachable vulnerability 0
• bash scripts/secret-scan.sh — tracked tree PASS
• npm run check — 0 errors, existing warnings 10
• npm run build
• sudo ... bash e2e_test.sh — All test steps passed
• MCP lifecycle/semantic/flock smoke — 통과
• Markdown relative-link scan, bash syntax, git diff --check — 통과

남은 release blocker

• next version/upstream alignment 결정
• allow_hosts removal contract 이행
• deployment host security operations
• npm audit disposition

상세 증적은 docs/operations/2026-08-13-release-gate-closure-handoff.md에 있습니다.

Summary by CodeRabbit

• Bug Fixes

  • Improved security-test handling without changing runtime leak-detection behavior.
  • Made MCP smoke checks identify the active orchestrator automatically, improving compatibility across environments.

• Documentation

  • Added comprehensive release-gate reviews, execution plans, design notes, and handoff guidance.
  • Updated the documentation index with current runtime status, upstream reviews, release criteria, risks, and follow-up actions.
  • Documented validation results, known blockers, operational constraints, and lifecycle status.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: abc1c7f7-3ba7-40a1-825f-c3ef535d8a08

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR documents release-gate closure, updates project-status indexing, hardens credential-shaped test fixtures, and changes MCP flock smoke to use the orchestrator ID returned by the spawned roster.

Changes

Release gate closure

Layer / File(s)	Summary
Release-gate design and decisions docs/superpowers/specs/..., docs/superpowers/grill-me/...	Defines release scope, scanner-preserving fixture handling, roster-ID selection, validation boundaries, version policy, and publish exclusions.
Execution plan and runtime validation docs/superpowers/plans/..., cmd/goose-daemon/config_api_anvil_test.go, scripts/anvil-mcp-smoke.go	Splits credential-shaped test literals while preserving runtime values and updates flock smoke to discover and validate the actual orchestrator ID.
Project status analysis and index docs/analysis/12-anvil-project-process-status-review-2026-08-13.md, docs/analysis/README.md	Records repository state, validation evidence, lifecycle classification, release blockers, parity coverage, and follow-up actions.
Release-gate evidence handoff docs/operations/2026-08-13-release-gate-closure-handoff.md	Records local and remote verification, KVM and MCP results, blockers, warnings, residual risks, lifecycle status, and next actions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• HardcoreMonk/anvil#14: Related to orchestrator roster and Town Wall behavior.
• HardcoreMonk/anvil#92: Related to Town Wall authorship and roster enforcement.
• HardcoreMonk/anvil#19: Related to the hardened authentication test fixtures.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the pull request's main purpose: closing release validation gaps through fixture, smoke-test, and release-gate documentation updates.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/release-gate-closure

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[HardcoreMonk]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/analysis/12-anvil-project-process-status-review-2026-08-13.md`:
- Around line 55-57: 복구된 lifecycle contract 문서와 일치하도록 참조 경로를 수정하세요. 먼저
docs/governance/codex-lifecycle-control-plane.md 문서와 디렉터리를 복구하고, 문서의 공정 단계 설명에서
codex-lifecycle-control-plane.md 링크를
../governance/codex-lifecycle-control-plane.md로 변경해 깨진 상대 링크를 제거하세요.

In `@docs/superpowers/plans/2026-08-13-release-gate-closure.md`:
- Around line 181-186: Update the “완료 조건” section to require evidence for
acceptance criteria 1–11, including criterion 11 covering the roster-author
post/history/delete MCP authorship path. Preserve the existing requirements for
reviewing diffs, classifying CI/KVM results, and avoiding tag or release
creation.
- Around line 127-135: Update Task 3 in
docs/superpowers/plans/2026-08-13-release-gate-closure.md (lines 127-135) to
list the three named Go builds: go build -o anvil-daemon ./cmd/goose-daemon/, go
build ./cmd/anvil-mcp, and go build ./cmd/anvil-scheduler; retain the aggregate
checks, but do not treat go build ./... or syntax checks as substitutes. Update
docs/operations/2026-08-13-release-gate-closure-handoff.md (lines 52-60) to
record each named build result and the sudo bash e2e_test.sh result.
- Around line 149-162: The Task 5 plan at
docs/superpowers/plans/2026-08-13-release-gate-closure.md:149-162 must add a
forced VM-deletion-failure probe, verify the full cleanup sequence including
TAP/IP resources, bind mounts, loop devices, dm-snapshots, and sparse .cow
exception-store files, and account for TeardownDMSnapshot continuing cleanup
after dmsetup remove --retry fails; update
docs/operations/2026-08-13-release-gate-closure-handoff.md:131-136 to record the
result of every resource check, and keep the release gate open whenever any
resource remains.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b33d0675-1fee-4264-9caa-fce140bc1c35

📥 Commits

Reviewing files that changed from the base of the PR and between 3033cdd and c394f7d.

📒 Files selected for processing (8)

• cmd/goose-daemon/config_api_anvil_test.go
• docs/analysis/12-anvil-project-process-status-review-2026-08-13.md
• docs/analysis/README.md
• docs/operations/2026-08-13-release-gate-closure-handoff.md
• docs/superpowers/grill-me/2026-08-13-release-gate-closure.md
• docs/superpowers/plans/2026-08-13-release-gate-closure.md
• docs/superpowers/specs/2026-08-13-release-gate-closure-design.md
• scripts/anvil-mcp-smoke.go