fix(kits): release four kits with an open compute substrate

[doublewhy]

Summary

This PR publishes 1.1.0 of application-api-service, postgresql-database, reverse-proxy-api-gateway and smtp-imap-mail-service, cut from 1.0.0. The only change is an open compute substrate (#413). Each compute-substrate constraint goes from posture: exact with domain: {kind: exact, value: virtual-machine} to posture: open with no domain, so the backend chooses the substrate. #434 makes the same change for the other 39 Linux kits.

Acceptance is judged by the RAES 6.0.1 validator and planner. Each 1.1.0 release composes with both of its parameter sets, and planning it no longer reports a compute-substrate diagnostic (see "Planning results").

The releases are 1.1.0, not 2.0.0, because removing the allowed_values bounds removed the only breaking change, and #434 ships the same substrate change as 1.1.0.

Changes

• kits/infrastructure.<kit>/1.1.0/** for the four kits. diff -r kits/<kit>/1.0.0 kits/<kit>/1.1.0 shows only these edits:
  • module.sdl.yaml: version and module.version are 1.1.0, and posture: open replaces the exact virtual-machine block.
  • kit.yaml: version and released_at: '2026-10-09T00:00:00Z'.
  • associated-artifacts.json: these fields change: manifest_version, each artifact's created_at and source, the checksums of kit.yaml and module.sdl.yaml, the size of module.sdl.yaml, parent_ref.ref_digest and set_digest. They are recomputed from the release bytes with canonical_sdl_digest and associated_artifact_set_digest, the functions load_kit_release() verifies them with. Every release loads with load_kit_release().
  • README.md, assets/integration.md, assets/seed.yaml and tests/composition.yaml are byte-identical to 1.0.0.
• tests/test_kit_compute_substrate.py (new), two tests on the newest release of each of the four kits:
  • every compute node declares an open compute-substrate constraint with no domain;
  • planning the release with its default and variation parameter sets reports no realization.compute-substrate-* diagnostic. The tests' manifest is the RAES stub manifest with its in-process realization envelope, which offers no virtual machine. It also declares exact and constrained support, with an observation capability, for every RAES realization concern, the way RAES's own planner tests do. It claims no backend behavior. RAES 6.0.1 still reports realization.authority-bound-unavailable for each kit's runtime-collection parameter (fix(planner): preserve configurable parameters in runtime collection authority rae#1481). The test therefore asserts that the plan is not valid and that this code is its only diagnostic.
• tests/test_published_kits.py: EXPECTED_KIT_COUNT = 46 becomes EXPECTED_RELEASE_COUNT = 50 (46 kits, 50 releases), and the composition test imports each module at its own version.
• tests_integration/kit_author_walkthrough.py: the manual harness's discovery check expects 50 entries.

Commits: one, 9db0f22, whose message describes the change above. It replaces the earlier commits 1a55132, b024f7f and 0959271. The Changes list above is its diff against dev.

Planning results

Harness: raes==6.0.1, the env-packs pin. Each kit is composed alone with both parameter sets from its tests/composition.yaml and parsed with parse_sdl_file, then planned with compile_scenario_runtime_model and raes_processor.planner.plan. Both parameter sets give the same result for every release. All codes are realization.*.

release (each of the four kits)	tests' manifest	RAES reference backend, OCI-container mode	create_stub_manifest()
1.0.0	authority-bound-unavailable, compute-substrate-not-admitted	authority-bound-unavailable, compute-substrate-not-admitted, unsupported-constraint-requirement	authority-bound-unavailable, compute-substrate-envelope-required, unsupported-constraint-requirement
1.1.0	authority-bound-unavailable	authority-bound-unavailable, unsupported-constraint-requirement	authority-bound-unavailable, unsupported-constraint-requirement

• None of the three manifests reports a compute-substrate code for 1.1.0. The OCI-container mode is create_reference_backend_manifest(driver_mode="oci-container"), whose realization envelope offers operating-system-container.
• authority-bound-unavailable remains on all three manifests. RAES 6.0.1 cannot retain typed authority for a configurable string parameter inside a runtime collection (fix(planner): preserve configurable parameters in runtime collection authority rae#1481).
• unsupported-constraint-requirement names each kit's runtime concern: runtime-applications, runtime-database-services or runtime-mail-services. The stub and the OCI reference backend declare no constrained support for these concerns, and the tests' manifest does. This is a declared limit of those two manifests, not a kit defect.

Related issues

Refs #413. This PR releases the open substrate for these four kits. #434 releases it for the other 39 Linux kits and documents when a kit requires a virtual machine, which completes #413.

#414 is blocked by OpenRAE/rae#1481, and this PR no longer addresses it. #435 tracks the mailbox addresses that ignore mail_domain.

Verification

• python -m unittest discover -s tests: CI run 38077468329, tests job at 9db0f22, reports Ran 951 tests in 1357.166s and OK. Locally (macOS, Python 3.12.13) only the kit modules were run: python -m unittest tests.test_kit_compute_substrate tests.test_published_kits ran 7 tests, OK.
• raes-pack-validate --repo .: ENVIRONMENT-PACK CONTENT CI: PASS.
• raes-pack-release check --all: PACK RELEASE GATE: PASS.
• raes-pack-validate --packs-root packs: ENVIRONMENT-PACK CONTENT CI: PASS.
• raes-pack-release check --packs-root packs: PACK RELEASE GATE: PASS.
• Docs changed: no docs/public/ change. The warning-strict build (python -m sphinx -W -b html docs/public <out>, sphinx 9.1.0 from requirements/docs.txt) and tools/check_docs_publication_boundary.py still pass locally.

Also run:

• python -m compileall src tests: exit 0.
• Regression proof: against an export of kits/ from unmodified dev (9ce449d), where the newest release of each kit is 1.0.0, the new test fails 12 subtests. The open-substrate check fails for the four kits. The planning check fails for 8 cases (4 kits by 2 parameter sets), each with realization.compute-substrate-not-admitted. Against the bounded 2.0.0 releases of the earlier head b024f7f, whose plans are valid, the planning check fails the same 8 cases at assertFalse(is_valid). It passes on this branch (9db0f22).
• raes-pack-kit list . --source-id openrae-env-packs --source-revision "$(git rev-parse HEAD)" --json lists 50 releases of 46 kits (46 at 1.0.0, 4 at 1.1.0). raes-pack-kit inspect succeeds for each 1.1.0 release.
• Not run locally: the full unit suite (CI's tests job runs it); pip-audit, because no dependency changed (CI's audit job runs it); and tests_integration/kit_author_walkthrough.py, because its wizard step needs Linux renameat2.

Checklist

• Keeps RAES semantics in RAES; hosted pack content stays under packs/. The releases use RAES's own posture: open form, and the test plans through RAES's own validator and planner.
• PR title is a Conventional Commit; tools/check_pr_title.py passes locally.
• Did not edit the version or CHANGELOG.md — release-please owns them.

[Brad-Edwards]

Great work, thank you. Slight misunderstanding about the relationship of this work to LilRAE. Env-packs carries no downstream dependency and is agnostic to any backend. Acceptance criteria are with respect to successful planning by the validator and runtime (upstream code from OpenRAE/rae).

[Brad-Edwards]

The fix for #414 requires a RAES change: OpenRAE/rae#1481. RAES cannot retain typed authority for configurable string parameters in runtime collections. Fixed allowed_values restrict kit configuration. The #414 changes will be removed from this PR. The #413 compute-substrate changes will be kept. The test will cover the retained scope. #414 is blocked by the upstream issue.

[doublewhy]

Done. #433 no longer carries the #414 change. The allowed_values bounds are removed, and the four kits are released as 1.1.0 with only the open compute substrate: each 1.1.0 module differs from its 1.0.0 only in the version and the substrate. They are 1.1.0 rather than 2.0.0 because no breaking change remains, and #434 releases the same change as 1.1.0 for the other 39 Linux kits.

Under raes==6.0.1, none of the four 1.1.0 releases reports a compute-substrate diagnostic. Planning still reports realization.authority-bound-unavailable (OpenRAE/rae#1481), and tests/test_kit_compute_substrate.py asserts that it is the only diagnostic left. #433 now refers to #413, and #434 is rebased onto it and closes #413 across all 43 Linux kits. Both bodies judge acceptance only by RAES planning.

sonar fails on both because of the SONAR_TOKEN 403 noted in OpenRAE/hub#46; every other check passes.