Cluster context: kubernetes-admin@kubernetes. Source: clean administrator-owned instructions at revision 631116a284ead10638e7652f8a6ba23c5a76262f. The publisher generated a 33-file immutable ConfigMap, autocoder-canonical-instructions-3a495837d58a9a04e87de96d827be392c5ee27dcd3607064c28146dc95eae0c9, with aggregate SHA-256 3a495837d58a9a04e87de96d827be392c5ee27dcd3607064c28146dc95eae0c9 and dirty=false. The complete file manifest and archive, including AGENTS.md, were checked against the source bytes.
The exact ConfigMap was added and read back in namespaces autocoder-engine and autocoder-test; both are immutable and match the generated metadata, manifest, and file payload. This operation only published ConfigMaps. No Deployment, pod, secret, database, ingress, worker claim setting, or production image was changed.
The repository branch codex/instruction-bundle-publication-20260924 updates Engine, development, and test bundle-name references to this digest; these references are not yet merged or selected by running workloads. Current dev and production Engine pods remain Ready, while autocoder-test-engine remains unhealthy (0/1, init container crash-looping). No test health or worker parity is claimed. Next gate is reviewed integration of the repository references, followed by a controlled non-production rollout and exact mounted-bundle/startup/admission/task-digest verification. Preserve existing ConfigMaps and workloads until that evidence is complete.
PR #6689 merged the full-digest repository references into dev as 99da7c9043bb7966627c1029bdf45cbcf677171f. The exact dev and test overlays render with this ConfigMap, read-only /etc/codex/instructions mounts, and no hostPath instruction source. Branch-validation run #3724 completed successfully; its manifest-specific evidence is the local kubectl kustomize render. The corresponding push candidate run #3725 was skipped while normal test delivery was disabled.
After verifying there was no active pinned review and that the test-only package reader can fetch recorded backend/frontend digests, repository variables were changed to AUTOCODER_TEST_CANDIDATES_ENABLED=true and AUTOCODER_CANDIDATE_SHADOW_ENABLED=false; the test-control URL and SuperProject ID were unchanged. Normal workflow-dispatch run #3727 processed exact dev revision 99da7c9043bb7966627c1029bdf45cbcf677171f. Its retained manifest covered 141 work identities across 114 integration commits and built immutable backend/frontend digests, with the new canonical instruction digest. It did not reach test: receipt election rejected it because code compared run numbers (3727 versus legacy 8715) as chronology. The source was a verified descendant, and no review pin existed. No candidate receipt or test rollout was recorded.
PR #6691 (codex/candidate-provider-chronology-20260924) passed worker validation on head 2427fbfce0629c4436fe94fb52cf6c4454fb175b (run #3730) and merged to dev as 443602d30a61736c93ebe9593a0918dd0c4e1ae3. Run numbers/attempts remain identity evidence only. The Engine now persists provider task IDs separately, orders candidates using provider-created timestamps and task IDs, uses an ordinal fallback for legacy rows, and reads candidate timestamps from PostgreSQL as UTC RFC3339. The regression case covers newer run 3727 after older run 8715, ordering ties, history order, and timestamp/task-ID retrieval. Rust workspace, isolated candidate database, and native release checks passed on the final reviewed head.
The automatic push candidate run #3732 started for exact merge commit 443602d30a61736c93ebe9593a0918dd0c4e1ae3 at 22:32:10 UTC. It failed in Validate candidate before image build or receipt registration: isolated test server::native_feedback_tests::t_req_0136_database_supervised_verified_delivery_stays_open_and_replay_preserves_evidence hit PostgreSQL statement timeout while preparing its schema. Seventeen tests passed and one failed in that test invocation. The dev branch-validation run #3731 was simultaneously running its own Rust validation/native build, providing overlapping worker load; treat this as a candidate-validation failure, not a declared provider incident or successful delivery. Do not weaken or skip validation.
At this observation, the dev Engine still serves dev-99da7c9043bb, and test remains on backend sha256:094fc1a8dc93cce9d4fa22151e07df79eefe4375d1e2fa44736bd298b7d5de33 with frontend sha256:1dfcd9f6a7fdbb16c066e8f8e2a1de87f32b87db870872ff000a784d6bd6eef4; the test Engine is still unhealthy. No candidate artifacts from #3732, release acceptance, production promotion, or production changes are claimed. Next: allow run #3731 to finish and verify the dev Engine serves the merged chronology code, then rerun the exact current candidate validation without weakening checks and confirm receipt, test rollout, and external health.
Automatic candidate run #3737 was created at 23:44:39 UTC for exact dev revision 8b0d9e17d4d9c8a9c5dd4ffd90fdd250d032885e. Its candidate job completed at 00:06:34 UTC with unit, WASM, native, and isolated-database checks passing and immutable images recorded: backend sha256:8fb19cad82146292049d2b85f721ad8f3876d10665df7ec399c20b043214dff9, frontend sha256:d3a82996094cc3437c4426d8bc879ff59581ad3ec6f2b76a46ab532c13fbb2f7. Recorded stage timings were queue 9s, backend build 274s, frontend build 95s, unit validation 363s, database validation 332s, image build 14s, image push 3s, and runtime ABI verification under one second; stages overlap and must not be summed. The run took about 21m55s through candidate completion, far beyond the 180-second target.
The separate finalize_candidate task failed at 00:06:37 UTC. The candidate remains validating; test selection remains historical candidate ea712ae1576e087fa23d33f2738d6ee688ae7ea0-8715-1, and there is no test deployment receipt for #3737. The dev deployment was still on revision 443602d30a61736c93ebe9593a0918dd0c4e1ae3 when this finalizer ran, so the auth repair had not reached the control service. The Gitea tasks API exposes the failed task state but not its error body; do not overstate the exact response.
PR #6692 fixed the missing operator-session exemptions for the internal ci-finalize and test-failure routes and merged as 8b0d9e17d4d9c8a9c5dd4ffd90fdd250d032885e. Exact-head branch validation, dev image build, and dev rollout then succeeded. The dev pod is Ready and runs image tag dev-8b0d9e17d4d9 (observed image digest sha256:086ff4cceecbc40f5681501951906358ebba8a8e181d29c48754dc60ec3b8531); external /healthz returned HTTP 200. The dev deployment-provenance endpoint currently returns 503 because release provenance is incomplete for this development runtime; this does not establish candidate or test health.
The existing test backend is still the old digest sha256:094fc1a8dc93cce9d4fa22151e07df79eefe4375d1e2fa44736bd298b7d5de33 and its init container cannot load binaries requiring glibc 2.38/2.39. The candidate builder now assembles against the pinned Noble runtime and runs ldd -r against all three shipped binaries before publishing; no validation was weakened.
After the corrected dev image became live, an operator-dispatch reconcile run #3738 was started against the same exact dev head at 00:16:00 UTC. It runs the full candidate validation/build/finalization path and is explicitly excluded from the 180-second normal-push SLA sample. At the latest check it was running as provider task 17802; no candidate receipt or test deployment from #3738 is yet recorded. No release acceptance or production promotion has occurred.
Next: let #3738 complete; verify its receipt/finalizer, then confirm the newest candidate in test through external backend and frontend provenance, Kubernetes image digests, migration state, and public health. Keep the test candidate available for broad feature/bug/improvement review. Stop before release acceptance or production promotion unless separately requested.