Admit business-site publication for source-only staging #5307

🤖 Generated by the Agentic Engineer

Summary

Admit the business site's verified source-owned publisher and register its immutable source-only staging Tenant. Part of #5247. This is the concrete first adoption increment; it does not enable application reconciliation or the private portal.

Motivation

The signed application/image pair is published, but current admission assumes legacy publication history that this consumer never had. Binding verification and source-conservation checks also cannot recognize its maintained publisher and the actual typed Tenant source. Without completing that chain, a valid application release cannot be admitted for staging.

Proposed Solution

Extend the existing qualified approval/binding generator, writer, guard, report and bootstrap schema to support a canonical-only consumer while preserving legacy consumers. Join the complete consumer, artifact, source/tag/caller and immutable publisher identity; verification-only receipts continue to grant no deployment authority. Attribute only the already reviewed exact Tenant source constructor in conservation, retaining all unknown/altered/foreign constructor refusals. Regenerate governed matchers/tables using their reviewed tools.

Use an independently reverified published business-site manifest and declare exactly its production-provider source with reconcileApplication:false. Observe the signed source through the normal protected deployment/readback path. Keep application activation, staging hostname admission and its same-namespace private input as later acceptance under #5247.

Acceptance Criteria

• Test-first controls prove a canonical-only full-identity approval/binding works without fabricated legacy history. Missing, substituted, duplicate and mismatched consumer/artifact/source/tag/caller/publisher inputs refuse. Existing legacy and legacy-plus-canonical consumers retain their behavior.
• The exact reviewed Tenant source constructor is attributed to the one registered consumer; unknown/modified/cloned constructors, foreign GVK, ambiguous, missing or extra consumers still refuse through the real conservation path.
• Reverify the actual immutable business-site manifest/image publication and source/caller provenance before recording approval. Regenerate approved source tables/matchers through their tools, never by hand or with a bare SHA substitute.
• Register only the source-only typed staging Tenant through existing provider wiring. No WebApp reconciliation, route, disclosure value, customer database, identity deployment, social provider, payment or portal activation is enabled.
• Actual registration renders, affected script/policy/graph checks, substantive current-head review, normal protected merge/deployment and fixed read-only signed-source/controller proof pass. Keep Register the public-only business-site staging tenant #5247 open for workload/private-input/HTTPS staging acceptance and its business-site parents open for full identity/customer acceptance.

Alternatives Considered

Invented legacy history or a bare publisher SHA would weaken the identity binding. A manually copied OCIRepository would evade the typed tenant contract. Another generic lifecycle abstraction is unnecessary because source-only reconciliation already exists. Enabling the application alongside the source would mix admission with private-input and route acceptance.

Planning

Feature; High priority, High effort, Standard service class. This removes the concrete staging admission blocker for the unified business application. Effort includes maintained generator propagation, refusal controls, protected deployment and independent readback. The session's WIP waiver leaves ownership, signing, security, review and merge gates unchanged. No new service enrollment, paid resource or secret-value operation.