Define OpenShell v0.0.101 qualification receipts and gates

[apurvvkumaria]

Important

This child is reserved for #8590 integration-owner dispatch.
Do not start implementation without an explicit assignment from that owner.

Problem Statement

Parent epic: #8590.

The selector and final release need machine-readable qualification evidence.

Comments and unchecked lists cannot prove that evidence matches the current candidate.

Proposed Design

Scope

• Define one versioned qualification receipt schema for [Epic] Qualify and pin OpenShell v0.0.101 #8590.
• Record the exact candidate SHA and current base SHA.
• Record NemoClaw baselines, the OpenShell target, test identifiers, results, and run links.
• Define receipt producers and consumers before implementation changes shared files.
• Add a selector gate for applicable OpenShell identity changes.
• Add a final release-candidate gate before tag creation.
• Reject missing, canceled, skipped, stale, failed, or unknown-schema evidence.
• Reject receipts with mismatched versions, SHAs, baselines, or test sets.
• Keep this qualification system limited to [Epic] Qualify and pin OpenShell v0.0.101 #8590.

Owned boundaries

• Own receipt contracts, receipt validation, and [Epic] Qualify and pin OpenShell v0.0.101 #8590 gate integration.
• Do not change runtime behavior, selectors, policies, or migration logic.

Dependencies

• Coordinate baseline fields with Record OpenShell v0.0.101 baselines and release trust #8598.
• Coordinate required test identifiers with the other [Epic] Qualify and pin OpenShell v0.0.101 #8590 child issues.

Required evidence

• Test every receipt producer and consumer together.
• Test missing, stale, mismatched, skipped, canceled, failed, and unknown-schema receipts.
• Show that a valid exact-head receipt opens each applicable gate.
• Show that an invalid receipt keeps each applicable gate closed.

Acceptance criteria

• Version the receipt schema.
• Bind each receipt to exact candidate and base SHAs.
• Bind each receipt to the required baselines and tests.
• Add fail-closed selector and final-candidate gates.
• Test every receipt producer and consumer.
• Link the gate design and evidence to [Epic] Qualify and pin OpenShell v0.0.101 #8590.

Handoff

• Report changed files, tests, risks, and unresolved questions.
• List every receipt producer and consumer.
• Link the implementation pull request and evidence to [Epic] Qualify and pin OpenShell v0.0.101 #8590.

Implementation starts in a separate Codex thread.

Alternatives Considered

Use prose comments as evidence. This approach cannot detect stale or mismatched results.

Category

Testing

Checklist

• I searched existing issues and this is not a duplicate.
• This is a design proposal, not a "please build this" request.

[apurvvkumaria]

Draft PR #8635 is published from the frozen signed head 6d30e49481d3e7c502f231be9b5cde49f4978e50 (local base 36db1f4acaae5e26a835582fc2a544c9f6be1014): #8635

State: implementation complete and independently reviewed, but not accepted or activated. The focused post-rebase suite passed 296/296, builds and npm run validate:pr passed, and the PR records the exact local broad-shard platform limitation. Fresh GitHub CI is now authoritative for all eight CLI shards against current main.

The contract intentionally remains bootstrap / draft, with pending mappings, empty artifacts/matrices, and requiredWorkflowGate: null. Acceptance still requires audited inventory freeze, authenticated organization required-workflow authority, strict repository enforcement with no bypass, and the required successful trusted receipts.

No trusted E2E was dispatched. #8616 and #8617 remain frozen and unaccepted; no dependent child is unlocked, no candidate is assembled, and no tag or merge action is authorized.

[apurvvkumaria]

Closing this proposal as superseded by the focused #8590 execution plan.

The OpenShell v0.0.101 upgrade will not introduce or revive the receipt/bootstrap/selector/final/retirement framework attempted in #8635 or #8656; both PRs were closed without merge. Qualification will reuse the existing live E2E implementation and scripts/checks/verify-openshell-e2e-qualification.mts, with the existing stable required check bound to the exact final PR head. A later relevant push invalidates the result and requires a fresh run; missing, skipped, canceled, stale, or failed results do not qualify.

Implementation and targeted regression work remains in #8601–#8608 under #8590. Any small exact-head enforcement gap should be addressed minimally in that existing path, not by recreating this issue qualification lifecycle or receipt protocol.