CORE Production-Readiness: the last mile

[DariuszNewecki]

The consolidated map from where CORE is now to the Beta → Production/Stable flip (#795). Replaces the scattered .specs/planning/ trackers (now archived) with a single tracked surface.

The stance

Production/Stable is a one-way reputational claim, distinct from the software being ready. CORE's own NorthStar ranks defensibility > productivity — so the bar for the label is higher than the bar for the code. This epic is the disciplined last mile: earn the claim, don't rush it.

Evidence already green (2026-07-14)

• ✅ Full test suite: 3454 passed / 0 failed
• ✅ Complete constitutional audit: PASS, 100% self-coverage, 0 blocking (ADR-149 removed adoptable packs from the self-governance denominator)
• ✅ Zero known dependency vulnerabilities (click/setuptools patched)
• ✅ Autonomous test-gen throughput measured: 44% on the hardest previously-failed subset (build.test_for_symbol append path emits mid-file 'from __future__' → SyntaxError at collection #792 validated)
• ✅ Fresh-VM install / BYOR proven end-to-end

The last-mile work

• Promote PyPI classifier Beta → Production/Stable — gated on green suite + measured autonomous throughput #795 — the flip: promote pyproject.toml Development Status :: 4 - Beta → 5 - Production/Stable. Gated on the below, not on evidence (evidence is green).
• Wire pytest-in-the-loop test-gen repair: ADR-135 D6 was accepted but the acceptance-condition machinery drifted unwired #791 — CORE writes its own tests better: wire pytest-in-the-loop repair (ADR-135 D6). The lever that raises the 44% throughput — residual is async/mock-contract failures, exactly its target. (closed — pytest-in-the-loop wired; ADR-135 D6 acceptance machinery re-connected.)
• Test hardening: suite modes + failure-semantics fault injection + per-symbol linkage #773 — test hardening: suite modes + failure-semantics fault injection + per-symbol linkage.
• CI & security-hygiene polish (last-mile): install-core.sh CI · Action self-test · Bandit · demo-creds #796 — CI & security-hygiene polish: install-core.sh CI · Action self-test · Bandit · demo-creds dev-only.
• Product observability: operability + diagnostics for core-runtime + core-cli (OSS scope) #797 — product observability: operability/diagnostics for core-runtime + core-cli (OSS floor).
• Proof-Index → CI-enforced regression checks (scoping + mechanization) #798 — Proof-Index → CI: mechanize proof rows into standing regression checks. (closed — all mechanizable claims have CI tests; live claims signed; missing/stale attestations blocking; 4 drifted claims corrected; taxonomy debt → core.action_results is a polymorphic evidence ledger — taxonomy / possible duplicate rows (from #798 claim-4 attestation) #819)

What "green board" means here

Not zero issues — zero open defects. Every issue above is tracked forward-work, not a bug. That honest backlog is a stronger signal to a skeptic than an empty tracker.

Also open (governance-debt, not last-mile blockers)

Tracked here for visibility; not gating #795. Checked off only once actually resolved:

• Abandoned findings have no reconciliation path — stale entries accumulate forever, inflate the 'cannot self-heal' headline #788 — abandoned-finding reconciliation (ADR-127 D7 addendum + AuditViolationSensor drain, 53bb182b)
• Reaper-recovered proposal consequences silently lose pre_sha/post_sha/changed_files evidence #790 — reaper-recovered proposals lose pre_sha/post_sha/changed_files evidence, silently (ADR-148 D7 addendum: consequence_source marker + governance.consequence_evidence_degraded reporting check, 42ba4846)
• Worker-import rule: remove the 6 whole-file excludes (extract co-located helpers) — the #723 follow-up #793 — worker-import rule: remove the 6 whole-file excludes (5 mechanical extractions + ADR-153 ceremony extraction for violation_executor.py; 48f93bdb, adc2c179 — zero excludes remain)
• Wire ADR-049 D3 enforcement: exclusion metadata + deadline audit (decided 2026-05, never built) #794 — wire ADR-049 D3 enforcement (ADR-152: generalized ADR-042's governed_exclusions register with a closure_type discriminator, not a new construct; 789359f4)
• Governor-adjudication backlog: 39 indeterminate blackboard findings need triage #808 — governor-adjudication backlog: 39 indeterminate blackboard findings, oldest from 07-06, not previously tracked outside the blackboard itself

---

2026-07-16 external review — verified follow-ups

Second external architecture review (against main @ af5d7549; full history, 2,382 commits). Every claim below survived an in-session adversarial verification pass (4 parallel agents + direct AST/grep checks); refuted claims are recorded so nothing masquerades as work. Same flow as the 2026-07-12 review: findings → issues → this epic; no new planning doc.

Last-mile relevant:

• Finalizing roll-forward is unbounded — ADR-148 D4's cap is declared but not implemented; D6 terminal deferred #802 — finalizing roll-forward is unbounded: ADR-148 D4's cap is declared but not implemented; D6 terminal deferred. Governor authors the ADR-148 successor first. (The review's single highest-value production-readiness item.)
• Decide the ungated consumer-surface mutations: secrets set/delete/rotate (+ plaintext GET), vectors /rebuild #803 — decide the ungated consumer-surface mutations: secrets set/delete/rotate + plaintext ?show=true GET, vectors /rebuild. Structural today (require_governor is a no-op in OSS), live in Console mode.

Governance-debt tail (joins #788/#790/#793/#794):

• Retire 6 dead legacy aliases/shims (zero callers, verified incl. dynamic dispatch) #804 — retire 6 dead legacy shims/aliases (zero callers, verified incl. dynamic dispatch)
• Migrate dev_sync_workflow off legacy WorkflowResult onto PhaseWorkflowResult #805 — migrate dev_sync off legacy WorkflowResult
• Split body/atomic/fix_actions.py — 1,022 lines, 64 commits (highest churn in src/), 14 atomic actions #806 — split fix_actions.py (1,022 lines / 64 commits / 14 actions; ADR-095 judgment call, see issue)
• Rule candidate: deprecated symbol with zero live callers should escalate (dead-shim reaper) #807 — rule candidate: dead-shim reaper (deprecated + zero live callers should escalate)
• CLAUDE.md digest drift corrected 2026-07-16: the "8 excludes: pending closure ADRs" claim on architecture.shared.no_layer_imports was stale — on-disk mapping carries only 2 test globs (last non-test exclude removed c968b6d9, ADR-126 Stage 3); src/shared/ verified zero live layer imports (13 hits, all TYPE_CHECKING).

Folded, flagged, refuted:

• Mock-heavy-test spot-audit → folded into Test hardening: suite modes + failure-semantics fault injection + per-symbol linkage #773 (comment there).
• Flagged, deliberately not filed (each reopens a prior decision): variable-receiver no_direct_writes gap (pathlib replace/rename fully detection-inert in no_direct_writes (collision-avoidance cost from #489) #506 chose sanctuary-marking over AST expansion); unix_philosophy advisory→reporting for body/atomic/** (collides with ADR-095). Both recorded in Rule candidate: deprecated symbol with zero live callers should escalate (dead-shim reaper) #807 for the governor's call.
• Refuted review claims (for the accounting): operations.resource_name "stalled migration" — call sites read LLMResourceConfig.resource_name, ORM property is simply dead (→ Retire 6 dead legacy aliases/shims (zero callers, verified incl. dynamic dispatch) #804); "36 of 37 @atomic_action, executor sole exception" — real split is 51/37/14 (0 register-only; blocking rule holds); "zero except Exception: pass in mind/will" — 8 exist (5 mind, 3 will), zero bare except:; "exactly 6 direct-write sites" — 10 sites in 8 files, all sanctioned; "8 excludes are infra exemptions" — no such excludes exist (see digest correction above).
• Verified strengths worth keeping on record: 100% symbol-ID coverage (3,160 public symbols, AST-verified); proposal state machine is clean CAS throughout; zero run_loop overrides (sleep-after-run structurally prevented); router-level require_governor placement clean across all 23 route modules.