aios/docs/C5_RELEASE_AUTOMATION_IMPLEMENTATION_PLAN.md

C5 release automation implementation and rollout

The engineering task implements a repeatable orchestration path and isolated executable proof. It does not treat local artifacts as an activated production capability. V2R2C6 is frozen.

Parallel implementation ownership

1. Epoch compatibility: admission bootstrap and signed-epoch provider; v1 regression, original-byte v2 verification, tamper/schema/revocation tests.
2. Exact policy lifecycle: existing structured Owner issuer plus an exact source-publication guard; TTL, current trust, revocation, scope and configured-risk checks.
3. Thin runner: generated immutable intake, admission/reconciliation, publication proof gate, existing trusted candidate service and signed approval/deployment entry points.
4. Integration: isolated executable demo, targeted contract tests, architecture/gap reports and immutable local commit/archive evidence.

Each implementation lane uses a separate Git branch/worktree. Integration uses ordinary local commits without force-push, main mutation, TaskDB mutation or production writes.

Minimum executable closure

Run the simulation CLI with a Git repository, committed source/base and a new output directory. It must derive the file list, tree and source archive from Git objects; run the selected checks; issue a fresh test-only Owner policy/epoch using ephemeral keys; verify them with the actual registry verifier and dual-schema provider; submit an envelope through the actual admission service against an isolated Task transport; and write an existing-model RC artifact with all evidence hashes.

The output must say SIMULATION, official_release=false, and retain authority_source_commit=null. It must not invent live provider receipts or set READY_FOR_APPROVAL without the existing acceptance path. Ephemeral private keys are confined to a temporary directory and excluded from exported evidence. A signed test receipt authenticates only its stated isolated environment.

From this implementation checkout on Linux/POSIX, with Git, OpenSSH, pytest and cryptography available:

python3 scripts/simulate_c5_unattended_release.py \
  --repository /path/to/local/candidate/repository \
  --source 536a2af0f07962495c88526061ce43fb27994c15 \
  --base e5f8209f57b43fc39e55c4555776e6362ce326eb \
  --output /path/to/new/isolated/evidence-directory

The command creates its own isolated Task store and ephemeral signing domain. It has no live transport or deployment adapter. No manually assembled JSON, existing Owner credential, service restart or production endpoint is needed.

Required checks

• v1/v2 consumer compatibility, original bytes, issuer/key/namespace/digest, unknown schema, invalid fields, expiry and revocation.
• Existing medium policy still denies engineering; exact source policy denies any changed branch/base/source/tree/files/caps/execution binding.
• Missing verifier and missing/failing revocation lookup deny; admission replay rechecks authorization.
• Stable intake identity, bounded retry, no retry for policy rejection, unknown side-effect reconciliation and conflicting receipt rejection.
• Missing TaskLease/principal/WriterLease/commit/readback cannot produce a live RC.
• Existing signed approval, provider evidence, saga integrity, deployment verification, rollback and post-tag reconciliation contracts.
• C5 capability negatives N01/N02/N03 and affected regression tests only; historical full-suite counts are not reused as evidence for new changes.

Governed rollout after local verification

1. Publish the support commit through the existing Task -> TaskLease -> TaskPrincipal -> WriterLease -> Governed Commit chain. Read back its OID/tree/receipt.
2. Governed-install the dual-schema consumer and exact source-only policy guard on the existing control-plane service, preserving the old artifact for rollback.
3. Activate the exact policy and dedicated machine caller using the existing Owner authority. Record signed activation, policy digest, issuer and revocation source. This is a provisioning step, not an implicit authority granted by the runner.
4. Request a fresh epoch and execute C5 admission/publication. Rebind evidence to the authority-readback OID; it may differ from the local candidate.
5. Run actual build/test/security/canary/rollback providers and their authenticated resolver. Invoke create_release_intent against the authority source; read back candidate, acceptance, plan and saga.
6. Have the pre-authorized Owner broker sign the exact release plan, and submit it through submit_owner_approval. Source-only authorization is insufficient here.
7. Call the existing deployment controller with approved durable state. Canary/pre-switch, health, promotion, registry/baseline finalization and rollback follow the existing saga. Verify runtime identity and final consistency.

Missing live authority or provider composition is a durable blocker, never a reason to lower risk, bypass G0, mint signatures in the client or call production restart directly.