promote: staging → main (2026-10-18) — 576cbf189

[fedcourtsai-dev]

Drafted by the promotion train at 2026-10-18T13:31Z for promote/2026-10-18 at 576cbf189 over main 06c9aaf26. The branch was cut from staging and never moves, so the integration evidence and an approval of this head stay valid while staging carries on. The train regenerates the block between the markers while this PR is open; write anything else outside it.

Gate status (promote/2026-10-18 at 576cbf189):

• not read this run

Train: cut promote/2026-10-18 at staging 576cbf1 and opened its draft promotion PR

Next (maintainer): read the batch and approve this PR at 576cbf189. The train then merges it with a merge commit once the integration gate run, the required checks and the registry gate hold at this head and no predict/evaluate/back-test round is in flight. Merging it yourself instead is fine. To stop it, request changes or close it: a closed candidate is not re-cut at the same staging tip, and the next one is cut once staging moves.

The batch

• fix(security): bind the production read-write role's jobs to a corpus-write environment #2522: fix(security): bind the production read-write role's jobs to a corpus-write environment
• Sync: chore: sync main into staging #2529

Effect checks

#2522: fix(security): bind the production read-write role's jobs to a corpus-write environment

Once promoted, and with step 1 done:

• A writer run's jobs show environment corpus-write. The run page shows a corpus-write deployment per writer job, and this lists fresh deployments dated after the promotion:

  gh api 'repos/ModelMirrorAI/fedcourtsai/deployments?environment=corpus-write&per_page=5' \
    --jq '.[] | [.created_at, .ref, .sha] | @tsv'
  

  The matching query for environment=prod no longer gains entries from run-pull pull/live windows.

• The window succeeds: its pointer commit lands on main.

• scripts/promotion-gate.sh contexts (maintainer's admin token, from main once promoted) passes, including the new "the corpus-write environment admits main alone and holds only the writers' names" line.

• After step 4, an executed check: a prod-bound job that tries the RW role is refused. Nothing in the repo can show this, so it is the maintainer's IAM reading of the RW trust (sub names only environment:corpus-write).

After the merge

1. Tag promotion/<YYYY-MM-DD> on the merge commit (-2 for a same-day second batch).
2. Run the effect checks above and record what they printed.