Execute 3-OS immutable Registry consumer proof and rollback outcome

[StatPan]

Goal

Produce the CLI-owned, independently reviewable public consumer-proof matrix for one exact immutable published StatPan/datapan-registry Hugging Face revision: public installer install, datapan doctor, Registry journey on Linux, macOS, and Windows; plus an actual incompatible-result rollback or manual_hold outcome.

Parent: #165. Supersedes neither the historical single-host compatible receipt in #168 nor the offline receipt contract in #166.

Scope

• Start only after Registry #592 records an explicit publication and anonymous pointer/payload verification for the exact immutable Dataset revision, Registry digest, manifest digest, and safe prior-pointer candidate.
• On all three public installer platforms, bind the same immutable CLI revision and exact published Dataset revision; retain redacted observed install, doctor, and journey outcomes for each platform.
• Execute one real incompatible-result path against that admitted public release boundary. Record either an observed prior-pointer rollback followed by observed CLI install/doctor result, or manual_hold with no_safe_target; never call either state successful without its actual observed result.
• Schema/admission-validate each observed receipt using caller-owned time. Preserve only allowed redacted receipt fields.

Boundaries

• Do not publish or release Registry, mutate Registry branches/manifests, issue/rotate/store credentials, call public-data providers, or treat fixtures, source CI, Registry Journey regression CI, or Execute an admitted post-publication Registry consumer smoke #168 as evidence for this matrix.
• CLI does not make Registry pre-publication admission depend on CLI execution. Registry never checks out, builds, or executes CLI.
• Do not remove checkout guards or progress Registry #593 from this task; #593 remains separately blocked until it can consume the real cross-repository rollback/manual-hold evidence.

Dependencies

• Registry #592: exact immutable producer receipts admitted, explicit public release recorded, and anonymous pointer/payload verification complete.
• Registry #593: consumes this task's actual rollback/manual-hold evidence; it is not unblocked by a compatible smoke alone.
• A prior public immutable pointer that is safe to attempt for the required failure path, or an explicit no-safe-target decision that permits manual_hold.

Acceptance Criteria

• Three retained evidence_class:"observed" receipts bind one immutable CLI revision and one exact published Dataset revision, Registry/manifest digests, public installer outcome, doctor outcome, journey outcome, platform, and observation time for Linux, macOS, and Windows.
• The receipts are schema-valid, redacted, fresh at their caller-owned admission time, and independently reviewable; no fixture or CI-only vector is counted as an observed platform result.
• A real incompatible result produces either observed prior-pointer rollback plus observed post-rollback CLI install/doctor proof, or manual_hold with rollback.state:"no_safe_target" and the actual reason.
• Registry #592 publication/anonymous-verification receipt and Registry #593 dependency are linked in the execution evidence; no Registry pre-publication gate, publish action, or checkout-control change is made here.
• Completion note distinguishes compatible matrix proof, rollback success, and manual_hold; it does not claim a new Registry publication without its exact observed Registry receipt.

Doctor Impact

No doctor semantic change is in scope. This task observes the existing CLI installer and doctor contract only.

Stop Conditions

• Stop before any public install or failure-path execution when the exact published revision, public pointer/payload/manifest/Registry digests, or rollback/manual-hold authority is absent.
• Stop and record the concrete missing upstream receipt rather than infer it from a fixture, source CI, or a stale public payload.

[StatPan]

Blocker

Preflight contract — public installer 3-OS smoke and rollback/manual_hold

This is a no-execution preflight record. It authorizes no release, publication, credential use, provider call, installer download, init/doctor/journey execution, pointer change, or rollback.

Registry #592 handoff required before any future invocation:

• #592 explicit-publication and anonymous payload/pointer verification receipt, with its timestamp and immutable published Dataset revision (40/64 lowercase hex).
• Dataset ID StatPan/datapan-registry; registry_sha256 and manifest_sha256; public pointer revision; and a safe prior immutable pointer revision plus matching digests. Do not substitute the historical Execute an admitted post-publication Registry consumer smoke #168 payload.
• Public CLI release tag, immutable CLI revision, and one public installer artifact plus SHA-256 for each linux, macos, and windows run. The installed executable must be the downloaded release artifact, never source-built dist/datapan or go run.
• Explicit reversible failure-path authority: either an approved public incompatible subject and the prior safe pointer, or authority to stop as manual_hold when no safe target exists. No synthetic/unpublished bad revision is allowed.

Future harness contract (not invoked here):

1. On clean Linux, macOS, and Windows workers, verify the matching public CLI installer checksum, install it, and retain only redacted installer identity/version/checksum evidence.
2. With the supplied immutable Registry revision only, run init, doctor, then the existing consumer journey. Existing Registry Journey CI remains regression feedback only: source-built CLI, GitHub token context, or CI artifacts cannot be these public-installer receipts.
3. Emit one evidence_class=observed, completion_evidence=true v1 receipt per OS, schema-valid and admitted against a verifier-owned reference time/max-age. Each binds CLI revision/version and Registry revision/registry_sha256/manifest_sha256, installed outcome, doctor outcome, redaction, and rollback state. Attach a separate redacted per-OS harness manifest binding os, runner image, installer artifact name/SHA-256, journey result, receipt SHA-256, and timestamps; v1 intentionally has no platform/installer/journey fields.
4. Compatible receipts require install=succeeded, doctor=compatible, outcome=compatible, rollback=not_required. Three compatible receipts alone do not satisfy the required failure outcome.
5. For an actual incompatibility/install failure, retain the failed observed receipt. If a pre-authorized safe prior pointer exists, roll back that public pointer and independently observe reinstall plus doctor on the affected OS; attach the post-rollback receipt/manifest. Otherwise record outcome=manual_hold and rollback=no_safe_target. Never report manual_hold as rollback success.

Admission/decision gate:

• Exactly one #592 published revision must bind all three OS manifests and receipts; a moving latest pointer or a fixture is rejected.
• All receipt and manifest values must be redacted; no credentials, request URLs/query values, response rows, or generated payload values.
• No Execute 3-OS immutable Registry consumer proof and rollback outcome #173 PR, release, or execution starts until the #592 handoff and failure-path authority are present. Until then Execute 3-OS immutable Registry consumer proof and rollback outcome #173 remains blocked; this note is a reviewable preflight artifact, not observed proof.

Context:

• Ticket: Execute 3-OS immutable Registry consumer proof and rollback outcome #173
• Status: Blocked
• Linked PR: none
• Blockers: missing_linked_pr
• Next: resolve blockers, then set status:ready before starting work

[StatPan]

Handoff

Execution handoff reaffirmed for #173: start only after Registry #592 provides the explicit-publication and anonymous pointer/payload verification receipt for one exact immutable published Dataset revision, matching Registry/manifest digests, verification timestamp, and a safe prior-pointer candidate or written manual_hold authority.

On clean Linux, macOS, and Windows workers, CLI owns public-installer checksum verification, installation, init/doctor/journey observation, and one redacted evidence_class=observed receipt plus per-OS redacted harness manifest. All three bind one immutable CLI revision and the same exact published Dataset revision. Source-built CLI, fixtures, source CI, a moving latest pointer, and historical #168 cannot count.

For an incompatible result, retain the failed observed receipt. If a pre-authorized safe pointer exists, observe rollback and a new affected-OS install/doctor result; otherwise record manual_hold with rollback.state=no_safe_target and its actual reason. Never call either compatible proof or manual_hold a successful rollback. Link the result to #592 and leave Registry #593 blocked unless actual rollback proof exists.

Exact next Gira action now: gira ticket show 173 --repo StatPan/datapan-cli --json. Stop before public installation/execution if any required #592 receipt, digest, exact revision, installer checksum, or failure-path authority is absent.

Context:

• Ticket: Execute 3-OS immutable Registry consumer proof and rollback outcome #173
• Status: Blocked
• Linked PR: none
• Blockers: missing_linked_pr
• Next: resolve blockers, then set status:ready before starting work