Reference · v0.0.1

Source build & independent validation

Reproduce the repository-owned validation gates without confusing maintainer workflows with the supported customer installation path.

AudienceMaintainers, independent validators, security reviewersReading time20 minCommands in context12 guided stepsReviewed sourcefcc5871 · 30 July 2026

Exact release scope. This page documents the reviewed v0.0.1 source at fcc5871. Check release status before enabling a gated capability.

Validate the application source

✓
Check out the exact reviewed commit with a clean worktree.
✓
Use the repository-pinned SDK, Node.js, pnpm, package, and tool versions.
✓
Keep test credentials synthetic and isolated from customer environments.
✓
Treat every failing gate as a release blocker until its owning evidence explains an approved exception.
✓
Do not sign or publish artifacts from a developer workstation.

Commands for this step

Validate backend, frontend, and targeted regressions

These commands are for maintainers and independent source reviewers. They are not customer installation commands.

Protected workflowRun only on an approved maintainer, security, or release system.

01
Read-onlyCross-platform
Build and test the backend solution
Reproduce the release build and complete backend test evidence.
Before you run it
- .NET SDK pinned by the repository
- PostgreSQL/Testcontainers dependencies required by the selected suite
Cross-platform · maintainer-backend
```
dotnet restore backend/ClusterPilot.sln --locked-mode
dotnet build backend/ClusterPilot.sln --configuration Release --no-restore -warnaserror --verbosity minimal
dotnet test backend/ClusterPilot.sln --configuration Release --no-build --no-restore --logger "console;verbosity=minimal"
```
Expected result
Restore, warnings-as-errors build and solution tests pass at the exact commit.
Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md
02
Read-onlyCross-platform
Validate the frontend
Reproduce frozen dependencies, strict type checking, lint, configured tests and production build.
Before you run it
- Repository-pinned Node.js and pnpm versions
Cross-platform · maintainer-frontend
```
CI=true pnpm --dir frontend install --frozen-lockfile
pnpm --dir frontend exec tsc --noEmit
pnpm --dir frontend lint
CI=true pnpm --dir frontend test
CI=true pnpm --dir frontend test:gui-regression-gates
CI=true pnpm --dir frontend build
```
Expected result
TypeScript, lint, tests and the production build pass; existing warnings remain visible.
Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md

Read-onlyCross-platform

Run release-readiness targeted regressions

Reproduce the focused conformance, distribution, Kubernetes safety and settings suites named by release traceability.

Before you run it

Locked restore completed
Repository-pinned .NET, Node.js and pnpm toolchains

Cross-platform · maintainer-targeted-regressions

dotnet test backend/tests/ClusterPilot.Application.Tests/ClusterPilot.Application.Tests.csproj --configuration Release --no-restore --filter "FullyQualifiedName~ClusterConformanceResultArtifactTests"
dotnet test backend/tests/ClusterPilot.Api.Tests/ClusterPilot.Api.Tests.csproj --configuration Release --no-restore --filter "FullyQualifiedName~ClusterConformanceEndpointsTests|FullyQualifiedName~ClusterConformanceOpenApiContractTests|FullyQualifiedName~ApiRouteSecurityContractTests"
dotnet test backend/tests/ClusterPilot.Api.Tests/ClusterPilot.Api.Tests.csproj --configuration Release --no-restore --filter "FullyQualifiedName~AdminDistributionDiagnosticsEndpointsTests"
dotnet test backend/tests/ClusterPilot.Api.Tests/ClusterPilot.Api.Tests.csproj --configuration Release --filter "FullyQualifiedName~KubernetesOperationsSafetyStartupValidatorTests|FullyQualifiedName~PreprodEnvironmentTemplateSafetyTests" --nologo
pnpm --dir frontend test:cluster-conformance
pnpm --dir frontend test:settings-profiles-model

Expected result

Every named regression suite passes at the exact candidate commit.

Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md

04
Changes statePowerShell
Start the local development stack
Start the repository-owned development dependencies and application using the local-only profile.
Before you run it
- Developer workstation
- Docker
- .NET and frontend toolchains
- No production configuration in the current environment
PowerShell · maintainer-dev-up
```
pwsh -NoProfile -File ./scripts/dev-up.ps1
```
Expected result
The local development stack starts on development-only endpoints.
Stop conditions and operator notes
- Use -PostgresOnly to start only PostgreSQL.
- -ResetDatabase removes and recreates local development database state; treat it as destructive and never use it outside the dev profile.
Reviewed sourcescripts/dev-up.ps1
05
Changes statePowerShell
Run the isolated legacy push integration test
Start temporary loopback API/repository servers and exercise legacy repository, settings, inventory and run contracts.
Before you run it
- Isolated developer environment
- Python
- .NET SDK
- Disposable local database configuration
PowerShell · maintainer-push-test
```
pwsh -NoProfile -File ./scripts/push-test.ps1
```
Expected result
The script prints PUSH TEST: OK and cleans up its temporary servers and directory.
Stop conditions and operator notes
- This is a source-level compatibility test, not a customer smoke test.
Reviewed sourcescripts/push-test.ps1

Validate provider behavior safely

Provider live-smoke validation creates real infrastructure and can incur cost. Run it only in a disposable, quota-bounded project with a named owner, short-lived credential, cleanup evidence, and an explicit maximum duration.

Control	Required evidence
Isolation	Dedicated provider project/account and test-only network ranges.
Credential	Scoped, short-lived secret supplied through the approved secret boundary.
Cost	Budget/limit, maximum topology, timeout, and named cleanup owner.
Determinism	Pinned fixture revision and reviewed difference when fixtures change.
Cleanup	Successful deletion or a tracked residual-resource incident.

Commands for this step

Run controlled provider validation

Live smoke tests require an approved disposable project, bounded credentials, cost controls, and retained evidence. Fixture refresh is reviewed separately.

Protected workflowRun only on an approved maintainer, security, or release system.

01
Changes statePowerShell
Run a controlled cloud-provider live smoke
Exercise the provider contract in read-only or lifecycle mode against a controlled account.
Before you run it
- Provider-specific scoped credential environment
- Controlled test account
- Release build already available when -NoBuild is used
PowerShell · maintainer-cloud-provider-smoke
```
pwsh -NoProfile -File ./scripts/cloud-provider-live-smoke.ps1 `
  -Provider hetzner `
  -Mode read-only `
  -Configuration Release `
  -NoBuild
```
Expected result
Read-only provider discovery and contract checks pass with secret-safe evidence.
Stop conditions and operator notes
- Provider accepts aws, azure, ionos or hetzner, but v0.0.1 support status still governs what may count as release evidence.
- lifecycle mode can create billable infrastructure and requires separate approval.
Reviewed sourcescripts/cloud-provider-live-smoke.ps1
02
Changes statePowerShell
Refresh controlled cloud response fixtures
Capture provider fixtures from an approved mock or controlled endpoint for deterministic contract tests.
Before you run it
- Approved fixture endpoint
- No real credentials or customer identifiers in responses
- Review owner for resulting diff
PowerShell · maintainer-refresh-cloud-fixtures
```
$token = Read-Host "Fixture endpoint token (optional)" -MaskInput
& ./scripts/refresh-cloud-fixtures.ps1 `
  -Provider hetzner `
  -BaseUrl https://<controlled-fixture-endpoint> `
  -Token $token `
  -OutDir ./backend/tests/fixtures/cloud
Remove-Variable token
```
Expected result
Provider fixture files are updated and can be reviewed for redaction and deterministic content.
Stop conditions and operator notes
- The shell form is: scripts/refresh-cloud-fixtures.sh <aws|azure|ionos|hetzner> <base-url> [token].
Reviewed sourcescripts/refresh-cloud-fixtures.ps1; scripts/refresh-cloud-fixtures.sh

Validate deployable components

Chart, lifecycle-agent, and conformance validation have separate ownership because each crosses a different trust boundary. A successful application build does not substitute for these gates.

✓
Helm rendering is deterministic and contains only approved image references, storage, ingress, RBAC, and Secret references.
✓
Agent validation covers configuration, permissions, bootstrap, heartbeat, smoke, bounded logs, and update compatibility.
✓
Conformance validation covers the catalog, tool images, CVE policy, signed evidence, bundles, and cleanup contracts.

Commands for this step

Validate charts, agent runtime, and conformance assets

Run each repository-owned validation suite from the exact candidate commit before packaging.

Protected workflowRun only on an approved maintainer, security, or release system.

01
Read-onlyPowerShell
Run deterministic Helm chart validation
Validate positive topology renders and negative image-digest safety cases.
Before you run it
- PowerShell 7
- Helm
- Repository test fixtures
PowerShell · maintainer-helm
```
pwsh -NoProfile -File tests/helm/Invoke-HelmChartValidation.ps1
```
Expected result
All chart lint, render, package and negative contracts pass.
Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md
02
Read-onlyPowerShell
Run agent runtime validation
Validate bootstrap parsing, lifecycle execution, signals, tool materialization and image hardening.
Before you run it
- PowerShell 7
- Bash
- Docker for image validation
PowerShell · maintainer-agent
```
pwsh -NoProfile -File tests/agent/Invoke-AgentBootstrapValidation.ps1
pwsh -NoProfile -File tests/agent/Invoke-AgentLifecycleWorkExecutorValidation.ps1
pwsh -NoProfile -File tests/agent/Invoke-AgentLoopSignalValidation.ps1
pwsh -NoProfile -File tests/agent/Invoke-AgentConformanceToolMaterializationValidation.ps1
pwsh -NoProfile -File tests/agent/Invoke-AgentImageBuildValidation.ps1
```
Expected result
Strict parsing, work execution, shutdown, signed tools and non-root/read-only image checks pass.
Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md

Read-onlyPowerShell

Run conformance release gates

Validate the pinned Sonobuoy CLI, signed catalog, image evidence, adoption and release bundle contracts.

Before you run it

PowerShell 7
Repository-controlled fixtures and trust inputs

PowerShell · maintainer-conformance

pwsh -NoProfile -File tests/conformance/Invoke-SonobuoyCliContractValidation.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceImageVerificationEvidenceContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceReleaseAdoptionContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceReleaseAdoptionInputGeneratorContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceReleaseBundlePackagingContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceReleaseBundleReuseContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceReleaseProofResolutionContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceToolArtifactProducerContractTests.ps1
pwsh -NoProfile -File tests/conformance/Invoke-ConformanceQualityGateValidation.ps1

Expected result

CLI, image, catalog, adoption and quality contracts pass deterministically.

Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md

Complete maintainer validation

Packaging and hygiene gates are the final source-level checks. Protected release engineering then creates the signed release artifacts described in the release-status, security, registry, and conformance documentation.

Commands for this step

Validate packaging and source hygiene

These are the final maintainer gates before protected release engineering creates signed artifacts.

Protected workflowRun only on an approved maintainer, security, or release system.

Read-onlyPowerShell

Validate release packaging and workflows

Reproduce self-hosted packaging, candidate workflow and release workflow contracts.

Before you run it

PowerShell 7
Release fixtures and signing test inputs

PowerShell · maintainer-release

pwsh -NoProfile -File tests/release/Invoke-ReleasePackagingValidation.ps1 -SkipBuild
pwsh -NoProfile -File tests/release/Invoke-CiWorkflowContractValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-ReleaseV001ReadinessWorkflowContract.ps1
pwsh -NoProfile -File tests/release/Invoke-PreprodCandidateWorkflowContract.ps1
pwsh -NoProfile -File tests/release/Invoke-ReleaseWorkflowContractValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-PreprodReleaseValidationWorkflowContract.ps1
pwsh -NoProfile -File tests/release/Invoke-AddonImagePackValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-DotnetVulnerabilityScanValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-SupplyChainGateValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-VulnerabilityPolicyValidation.ps1
pwsh -NoProfile -File tests/install/Invoke-SelfHostedInstallEntrypointValidation.ps1
pwsh -NoProfile -File tests/install/Invoke-InstallEntrypointValidation.ps1
pwsh -NoProfile -File tests/install/Invoke-VerifiedToolInstallValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-ClusterBuildImagePackValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-ClusterInfrastructureCiGatesContractValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-DevReleaseValidationWorkflowContract.ps1
pwsh -NoProfile -File tests/release/Invoke-RegistryFoundationPromotionValidation.ps1
pwsh -NoProfile -File tests/release/Invoke-ReleaseEvidenceValidation.ps1
pwsh -NoProfile -File tests/smoke/Invoke-InstallUpgradeRollbackBackupSmokeValidation.ps1

Expected result

Packaging and every protected workflow contract pass.

Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md

02
Changes stateLinux
Run shell and worktree hygiene checks
Detect shell defects, whitespace errors and secret leakage before release review.
Before you run it
- Bash
- ShellCheck
- Gitleaks
- Clean repository context
Linux · maintainer-hygiene
```
git fetch --prune origin
git ls-files '*.sh' -z | xargs -0 -n1 bash -n
git ls-files '*.sh' -z | xargs -0 shellcheck --severity=style --external-sources
git diff --check
gitleaks git . --no-banner --redact=100 --exit-code 1
gitleaks git . --staged --no-banner --redact=100 --exit-code 1
gitleaks dir <isolated-current-diff> --no-banner --redact=100 --exit-code 1
pwsh -NoProfile -File ./scripts/assert-no-secret-leakage-fixtures.ps1
pwsh -NoProfile -File ./scripts/check-legacy-product-terms.ps1
pwsh -NoProfile -File ./scripts/validate-vulnerability-allowlist.ps1
```
Expected result
Every command exits 0 with no syntax, style, whitespace or secret finding.
Stop conditions and operator notes
- assert-no-secret-leakage-fixtures.ps1 accepts -Path and -MarkerPrefix.
- check-legacy-product-terms.ps1 accepts -SearchPaths.
- validate-vulnerability-allowlist.ps1 accepts -AllowListPath, -SchemaPath and -AsOfDate.
Reviewed sourcedocs/testing/release-v0.0.1-release-readiness-traceability.md