fix(acceptance): reject unsupported closure evidence

[BunsDev]

Outcome

Follow up on PR #381's two review findings that were resolved before the corresponding fixes were implemented. Refs #239, #196, #199. This is validator remediation, not runtime-acceptance closure.

• Reject completed manifests containing failed observations, even after transfer. Canonical acceptance docs define failed as the expected terminal state not reached; transfer alone is not remediation or re-observation.
• Preserve expectation-matched recovery_required outcomes with evidence, work preservation, and safe next actions.
• Normalize arm64/aarch64 and x64/x86_64, reject unknown observed architectures, and require the selected DMG to match the observed source-smoke host.
• Validate explicit observation-to-Harden Psyche Build operations, diagnostics, and recovery #199-comment transfers and document that remote comment content still requires operator verification.
• Keep the pinned incomplete template and published artifact identities unchanged.

Proof

The added regression cases reproduced 15 failures before the validator changes.
After the changes:

• pnpm exec vitest run __tests__/operatorAcceptanceManifest.test.ts __tests__/postReleaseExecutionDocs.test.ts: 39 passed.
• pnpm acceptance:validate -- docs/templates/operator-acceptance-v0.0.1.json: valid and incomplete.
• pnpm run docs:focus:check: passed.
• bash ./scripts/agent-check fast: passed.
• Independent read-only review of the complete diff: no significant issues.

Updated exact-head proof: 9dce637a2c43af920b2aef40c92582e778ac6d95 on base f4fe80660e6338684b265e3eab9f1b7c87163bcc. Focused checks (39 passed), incomplete-template validation, and bash ./scripts/agent-check full passed. Independent review of this exact diff found no significant issues. Local iOS opt-in was not run or asserted. Hosted exact-head required checks passed in run 34411856490. Merged through the ordinary protected path as fdb38b5f0c3ec09f8d0b5839930b76183a44623a, without an admin override. The late diagnostic-only review comment was independently reproduced, triaged as non-blocking, and resolved with a recorded rationale; no implementation fix is claimed for that comment. See the proof and merge comments for commands and limitations. The separate v0.0.1 exact-source smoke observation is retained under #239 and is not evidence of the packaged GUI matrix.

Compatibility and rollback

Intentional fail-closed change: manifests with failed observations, mismatched/unknown observed host architecture, or malformed transfer records are rejected for closure. Incomplete templates remain valid. Revert this PR to restore the prior validator behavior; no product persistence, release artifact, or published tag is modified.

Do not close #196 or #239 from this PR. Packaged-runtime operator observations and human sanitization verification remain outstanding.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
psyche-build-docs	Ready	Preview	Sep 9, 2026 10:22pm UTC

[BunsDev]

Exact-head remediation proof: 9dce637a2c43af920b2aef40c92582e778ac6d95, rebased on f4fe80660e6338684b265e3eab9f1b7c87163bcc without conflicts. The acceptance worktree remains clean.

Executed successfully at this head: pnpm exec vitest run __tests__/operatorAcceptanceManifest.test.ts __tests__/postReleaseExecutionDocs.test.ts (39 passed); pnpm acceptance:validate -- docs/templates/operator-acceptance-v0.0.1.json (structurally valid and incomplete); bash ./scripts/agent-check full (passed, including source/package smoke, documentation, TypeScript, deterministic web bundles, Rust formatting/tests/check). iOS opt-in was not run and is not asserted.

Independent read-only review of the entire base-to-head diff found no significant issues. Review explicitly applies to this rebased SHA, not the previous remote head. No review threads currently exist on this PR. Hosted exact-head required checks remain a separate merge gate; no bypass is authorized or used.

Correction/claim boundary: these validators reject unsupported closure records; they do not prove operator GUI observations, evidence authenticity, human sanitization, or remote transfer-comment existence/content. No new packaged-runtime observations were collected. #196 and #239 must remain open. Release identities and the incomplete template are unchanged. Rollback is a revert of this PR; no release publication, credentials, or product persistence changes.

[Copilot]

🟡 Changes recommended

The new DMG/host-architecture mismatch check can emit a misleading extra error when the host architecture is missing/unsupported, and should be gated on successful normalization.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens the operator acceptance manifest validator to fail closed on unsupported closure evidence (notably: completed manifests that still contain failed observations), and aligns the validation rules with the bounded single-host acceptance runbook for the v0.0.1 macOS artifacts.

Changes:

• Add host-architecture normalization/validation and require the selected DMG architecture to match the observed source-smoke host.
• Validate transfers.issue199 entries to ensure they reference concrete #199 issue comments for required observations.
• Extend regression coverage to lock in the new failure/mismatch/transfer rules and preserve recovery_required completion when expectation-matched.

File summaries

File	Description
scripts/validate-operator-acceptance.mjs	Adds architecture normalization + stricter completion/transfer validation rules for acceptance manifest closure.
docs/OPERATOR-ACCEPTANCE-SLICE.md	Documents the single-host architecture requirement, failure semantics, and #199 transfer record shape/limits.
tests/operatorAcceptanceManifest.test.ts	Adds helper + new regression cases for architecture matching, failed-observation closure rejection, and transfer validation.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Merged through the ordinary protected squash path as fdb38b5f0c3ec09f8d0b5839930b76183a44623a from exact reviewed head 9dce637a2c43af920b2aef40c92582e778ac6d95. Required TypeScript and Rust + iOS contexts passed in https://github.com/OpenCoven/psyche-build/actions/runs/34411856490 (head SHA confirmed). Quality also passed. Native/iOS child jobs were path-filtered/skipped; the green iOS aggregate does not represent simulator execution. Full local source gate passed separately; local iOS was not asserted.

All review threads were resolved before merge. The late redundant architecture diagnostic was reproduced and independently classified as a non-blocking diagnostic improvement; the thread records the reason, not a fabricated fix. No admin override or protection change was used. Rollback: revert merge fdb38b5f0c3ec09f8d0b5839930b76183a44623a through a protected PR.

#196/#239 remain open. This merge supplies validator remediation only, not missing packaged GUI observations or human evidence/sanitization verification.