Move real KVM proof out of hosted latest gate

Author: moradology

.github/workflows/release-artifacts.yml

@@ -846,7 +846,6 @@ jobs:
             --receipt "release-bundle-integrity=$UPLOAD_DIR/m80-readiness-release-bundle-integrity.json" \
             --receipt "docs-command=$UPLOAD_DIR/m80-readiness-docs-command.json" \
             --receipt "hostless-quickstart=$UPLOAD_DIR/m80-readiness-hostless-quickstart.json" \
-            --receipt "real-kvm-quickstart=$UPLOAD_DIR/m80-readiness-real-kvm-quickstart.json" \
             --out "$UPLOAD_DIR/m80-release-readiness-pre-latest-decision.json" \
             --write
           gh release list \

Cargo.lock

@@ -4,7 +4,7 @@ members = ["crates/*"]
 exclude = ["support/m80-close-range"]
 
 [workspace.package]
-version = "0.2.16"
+version = "0.2.17"
 edition = "2021"
 license = "Apache-2.0 OR MIT"
 repository = "https://github.com/nathanp/m80"

Cargo.toml

@@ -28,16 +28,16 @@ fn current_latest_version_cutover_names_real_repair_tag() {
             .expect("read installer layout fixture");
 
     assert!(
-        cargo_toml.contains("version = \"0.2.16\""),
+        cargo_toml.contains("version = \"0.2.17\""),
         "workspace package version must match the current repair tag"
     );
     assert!(
-        runbook.contains("workspace package version `0.2.16`")
-            && runbook.contains("expected release tag is `v0.2.16`"),
+        runbook.contains("workspace package version `0.2.17`")
+            && runbook.contains("expected release tag is `v0.2.17`"),
         "release runbook must document the real current repair version"
     );
     assert!(
-        behavior.contains("matching stable tag is `v0.2.16`")
+        behavior.contains("matching stable tag is `v0.2.17`")
             && behavior.contains("`v0.2.7` installer handoff"),
         "behavior doc must name the repaired tag and the superseded latest state"
     );

crates/m80-cli/tests/release/current_latest_version_cutover.rs

@@ -24,19 +24,23 @@ branch-protection endpoint. `v0.2.15` accepts an active branch ruleset with
 required status checks as the workflow-readable proof for `main`, then failed
 before release mutation because the publish-authority check required the
 release to already exist. `v0.2.16` treats a "release not found" metadata probe
-as the expected pre-create state while still failing on unreadable API errors.
+as the expected pre-create state while still failing on unreadable API errors,
+then published validated release assets but failed latest promotion because the
+hosted workflow still required an external real-KVM receipt. `v0.2.17` moves
+that real-KVM proof to the closeout/freshness evidence path instead of the
+GitHub-hosted latest-promotion gate.
 
-The current repair source therefore uses workspace package version `0.2.16`.
-The matching stable tag is `v0.2.16`; tags at or before the existing public
+The current repair source therefore uses workspace package version `0.2.17`.
+The matching stable tag is `v0.2.17`; tags at or before the existing public
 latest `v0.2.11` are intentionally rejected as old-release backfill candidates
 by `scripts/current_latest_repair_preflight.py`.
 
 The release runbook documents this as the real source-state expectation rather
 than a fixture-only value. Dev builds still render as `<package-version>-dev`,
-so an unreleased local build now reports `0.2.16-dev` and remains barred from
+so an unreleased local build now reports `0.2.17-dev` and remains barred from
 using mutable `releases/latest` implicitly.
 
-Fixture and release-script coverage uses `v0.2.16` as the packageable release
+Fixture and release-script coverage uses `v0.2.17` as the packageable release
 tag. Rust installer-layout fixtures derive their release tag from
 `CARGO_PKG_VERSION`, so the bundled layout tests also follow the same cutover.
 Tests may still use other tags only when they are explicitly testing mismatch,

docs/behaviors/release/current-latest-version-cutover.md

@@ -16,10 +16,12 @@ Stages keep the release order honest:
 - `pre-upload` requires workflow-policy, release-bundle-integrity,
   docs-command, and hostless-quickstart receipts before publish authority or
   upload can run.
-- `pre-latest` additionally requires the real-KVM quickstart receipt before
-  the workflow can move the release to latest.
+- `pre-latest` repeats those hosted receipts after the uploaded draft has been
+  validated and before the workflow can move the release to latest.
 - `post-latest-public` adds the unauthenticated public latest receipt after the
-  latest pointer has moved.
+  latest pointer has moved. The external real-KVM quickstart proof is required
+  for verified close and freshness evidence, not inside GitHub-hosted latest
+  promotion.
 
 Required stage lanes must be present and current. The command fails closed for
 missing lanes, stale tag or commit, unknown lane state, blocking statuses,

docs/behaviors/release/release-readiness-decision.md

@@ -61,10 +61,9 @@
         "workflow-policy",
         "release-bundle-integrity",
         "docs-command",
-        "hostless-quickstart",
-        "real-kvm-quickstart"
+        "hostless-quickstart"
       ],
-      "policy_text": "Latest promotion additionally requires the privileged real-KVM quickstart proof. The hostless fixture never substitutes for this lane."
+      "policy_text": "Latest promotion repeats the hosted publish gates after the uploaded draft has been validated. The external real-KVM quickstart proof is required for verified close and freshness evidence, not inside GitHub-hosted latest promotion."
     },
     {
       "id": "post-latest-public",

docs/behaviors/release/release-readiness-lanes.json

@@ -27,9 +27,11 @@ artifacts.
 
 `scripts/release_readiness_decision.py` consumes a stage plus explicit
 `lane_id=path` inputs and writes the aggregate decision. `pre-upload` gates
-publish authority and upload. `pre-latest` adds real-KVM quickstart proof before
-latest promotion. `post-latest-public` includes the unauthenticated public
-latest proof after the latest pointer moves. Missing stage lanes, stale tag or
-commit, authenticated public-access proof, blocking statuses, and fixture
-substitution for real-substrate lanes fail before a publish hook can consume
-the decision.
+publish authority and upload. `pre-latest` repeats those hosted gates after
+draft validation and before latest promotion. `post-latest-public` includes the
+unauthenticated public latest proof after the latest pointer moves. The
+real-KVM quickstart lane remains a required external proof for verified close
+and freshness evidence, not a GitHub-hosted latest-promotion input. Missing
+stage lanes, stale tag or commit, authenticated public-access proof, blocking
+statuses, and fixture substitution for real-substrate lanes fail before a
+publish hook can consume the decision.

docs/behaviors/release/release-readiness-lanes.md

@@ -16,7 +16,7 @@ M80_RELEASE_TAG=vX.Y.Z \
 ```
 
 The injected tag must be the exact `v<workspace package version>` tag. For the
-workspace package version `0.2.16`, the expected release tag is `v0.2.16`.
+workspace package version `0.2.17`, the expected release tag is `v0.2.17`.
 The injected source commit must be the exact commit used by the release build
 manifest and signed release integrity material.
 The injected Rust target triple must be one of the target triples recorded in

docs/runbook/release.md

@@ -794,7 +794,7 @@ def lint_release_artifact_origin(path: Path, text: str, lines: list[str]) -> lis
         "--dist-dir \"$UPLOAD_DIR\"": "publish manifest check must inspect the downloaded release artifact set",
         "scripts/release_readiness_decision.py": "publish job must run the aggregate readiness decision before release mutation",
         "--stage pre-upload": "publish job must write the pre-upload readiness decision",
-        "--stage pre-latest": "publish job must require the real-KVM readiness stage before latest promotion",
+        "--stage pre-latest": "publish job must recheck hosted readiness before latest promotion",
         "--out \"$UPLOAD_DIR/m80-release-readiness-decision.json\"": "publish job must preserve the pre-upload readiness decision",
         "--readiness-decision \"$UPLOAD_DIR/m80-release-readiness-decision.json\"": "publish decision must bind the readiness decision",
         "name: m80-release-readiness-decision-${{ github.run_id }}": "publish job must upload the readiness decision artifact",