[devantler]

🤖 Generated by the Agentic Engineer

Why

Before retiring the catalogue's older singleton guard, prove that its replacement rejects invalid deployment configuration even when the candidate replaces its own validator with an unconditional success.

What

This disposable negative control deliberately includes a missing deployment resource and a dishonest candidate validator. The required check must execute the reviewed base implementation and fail; ordinary CI protections remain unchanged. Record that evidence on #693, then close this PR without merge or promotion.

Refs #693

⚠️ Merge order: never merge or promote this intentional-failure control. No production release or deployment is requested.

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main 0f39032	codex/admission-dotg... 3b7527a	+/-
50%	50%	0%

C# / code-coverage/dotnet

main 0f39032	codex/admission-dotg... 3b7527a	+/-
100%	100%	0%

Go / code-coverage/go

main 0f39032	codex/admission-dotg... 3b7527a	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 22, 2026 07:46 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Native catalogue admission is verified, not just configured:

• Enrollment PR fix(ci): enroll catalogue reviewed admission #706 merged as 0f390329b590404c02565b27a263ee841fa02bce. v10.0.3 points directly to it; release, signed configuration CD and post-merge main CI all succeeded. The merged tree exactly matches the reviewed tree.
• GitHub and the reconciler report shared workflow rule 25612421 active for monorepo and this catalogue, plus catalogue result rule 25620522 active on the default branch, without bypasses, bound to Run reviewed product admission from GitHub Actions (15368). The ordinary source-only skipped job cannot satisfy it.
• Positive: real product PR fix(ci)!: retire catalogue-only .NET workflow #708 at a06e13e0f9cb99bfd5a51adc1024a831f0d7eebd received an actual executed required admission pass, not a skip.
• Negative: disposable PR fix(ci): exercise immutable deploy admission refusal #709 at 3b7527ad80674525b13d4c683de0041c0fd3fca3 replaces its candidate validator with unconditional success and supplies deliberately invalid deployment data. The actual injected required job failed on that invalid render. Its resolver bound the canonical workflow to reviewed source 0f390329b590404c02565b27a263ee841fa02bce, checked out the product implementation from that same base, and examined immutable candidate integration 2787b0d6efe8e335819d024f4866944e1a1e7649; the candidate bypass was not executed. Release-subject validation passed first, so this is the intended rejection, not an unrelated metadata failure.

The negative PR remained draft and BLOCKED, with GitHub explicitly listing the new required check as failing. Close it without merge or promotion. Both older singleton organization rules remain active during this proof. Their declarative retirement is the next stage; #693 remains open, including the separate World at Ruin performance prerequisite. PR #708 still needs its own corrected-head complete CI and review before delivery.