Validate Nexus Collection candidates by role impact and promote exact artifacts to Galaxy

[litroc]

Target process

Consume the exact immutable Collection candidate from Nexus on the Wonderbox, verify SHA-256, run only affected Heavy/Application role families, and publish the same bytes without rebuilding to galaxy.ansible.com when green. Failed candidates remain outside public Galaxy.

Temporary transition

Provide the initial Supplementary workflow_dispatch adapter as explicit transition-noop. It receives repository, commit, version, artifact name and digest after the source release has already published to Galaxy. It must execute no Heavy/Application tests, never publish, only echo the future promotion command, and emit validated=false and release_eligible=false.

Deliverables

• Route keycloak*, satellite*, and other role families independently.
• Cancel superseded work per Collection/family without cancelling unrelated families.
• Fetch and verify the exact Nexus candidate in the target implementation.
• Promote exact bytes on green; never rebuild.

Superseding current contract — 2026-08-09 UTC

This section is the binding implementation contract for replacing the non-release-capable transition adapter.

• Implement the production path immutable Nexus candidate → impact-based ModuLix validation → identical bytes to galaxy.ansible.com for every onboarded Collection.
• Fetch the candidate by exact digest, verify source commit, version, signature, SBOM, provenance, scan evidence, policy identity, and the signed upstream authorization before validation.
• Run only affected Heavy/Application role families, but fail closed on missing or contradictory classification.
• Publish the exact Nexus bytes to Galaxy without rebuilding. Download the Galaxy artifact afterward and require the same digest.
• The current transition-noop remains historical compatibility only, always reports validated=false and release_eligible=false, and cannot satisfy this issue.
• A manual dispatch may run diagnostics but cannot publish a production Galaxy release.
• Repeating the same version and same digest is idempotent only after complete readback. The same version with another digest fails. Published versions are not overwritten or deleted; correction uses a new version and revocation evidence.
• Normal releases use the normal promotion gate and small-team rule. Security releases use the reviewer-free Security gate and complete with humanActions=0.
• Add negative fixtures for digest mismatch, missing or invalid signature, invalid authorization, mutable tag, replay, manual start, incomplete scans, stale evidence, and version conflict.
• Apply explicit policy-compliant timeouts and retain the signed final receipt and correlated evidence immutably for seven years.

Definition of done

• The no-op has been replaced in the release-capable path by executed Heavy/Application validation and exact-byte Galaxy promotion.
• Nexus and post-publication Galaxy digests are identical and bound to the same source commit and version.
• Manual start, replay, stale evidence, digest mismatch, and version conflict cannot publish.
• A fresh current-head normal fixture and a fresh real Security fixture demonstrate their respective authorization paths; the Security run records humanActions=0.
• The signed receipt links Nexus candidate, Galaxy release, commit, workflow identities, validations, actor identities, and all evidence for seven-year retention.

[litroc]

Implementation progress — local Terra contract/shadow stage

The first fail-closed contract stage is complete locally:

• Branch: issue-134-evidence-shadow
• Commit: 537d2a9 feat: add fail-closed validation evidence contract
• No push, pull request, live schedule, branch-protection change, or Heavy/Application execution has been performed.

Implemented:

• strict versioned v1 JSON Schema and semantic verifier;
• exact independent binding to repository, source SHA, Git tree and/or artifact digest;
• independently supplied policy, matrix, validation-workflow and canonical BOM identities;
• complete profile/cell/result, lifecycle, cleanup, run and provenance structure;
• default 36-hour freshness ceiling;
• fail-closed rejection of mismatches, expiry, revocation, skipped/partial results, failed cleanup, future completion and inconsistent BOM identity;
• read-only GitHub-hosted shadow workflow on the default branch, with no PR trigger, self-hosted runner, protected environment or secrets;
• shadow artifacts are explicitly release_eligible: false / outcome: not_executed and are rejected by the semantic verifier.

The workflow is deliberately named not a release check. It verifies only semantic structure. Cryptographic attestation trust, the real Heavy/Application controller, trusted evidence lookup and revocation lookup remain part of the next adapter and must exist before branch protection can consume this contract.

Independent verification:

• contract tests: 16/16 pass;
• Python compilation: pass;
• workflow YAML and JSON Schema parsing: pass;
• git diff --check: pass.

[litroc]

Cross-repository governance tracking: LI-118 – ModuLix CI check names and status contexts with MLX-70 align: https://lit.atlassian.net/browse/LI-118

Concrete UX finding from ansible-collection-supplementary PR #569: the real Heavy matrix was skipped, while three-second no-op/compatibility adapters named Collection / Heavy and Keycloak / Heavy appeared as successful checks. This makes a source PR look as if Heavy validation ran synchronously.

LI-118 tracks the ADR/testing-matrix clarification and the coordinated migration to Collection / Fast and Collection / Release Evidence, with actual Heavy/Application execution named and owned centrally in modulix-validation.

[litroc]

LI-118 rollout blocker — full evidence contract required

The source-repository migration is now on develop via supplementary #571 and #577. The new Collection / Release Evidence gate correctly fails closed on main promotion #575.

The current central workflow still publishes only supplementary-validation-summary-<sha> with release_eligible: false. It does not yet produce the complete v1 evidence required by this issue and MLX-70. A proposed shortcut to rename the summary and set the boolean to true was explicitly rejected as unsafe and was not pushed.

Still required before #575 can merge:

• generate the complete executed v1 manifest after successful Heavy and Application Acceptance;
• bind candidate tree/artifact digest, canonical BOM, policy/matrix/workflow identities;
• include cells/results, lifecycle/expiry, cleanup, revocation lookup, run identity and provenance/attestation;
• expose a trusted lookup/verifier consumed by Supplementary;
• run central protected validation for the exact Supplementary develop SHA;
• apply/verify authoritative github-management policy after both branches contain the workflow.

AI task profile: LI-118/#134, high risk, balanced capability with fail-closed verification; escalate on any proposed relaxation of evidence identity or attestation.