Approve the v8.0.0 application publisher before consumers move to it #5214

🤖 Generated by the Agentic Engineer

Delivered on: 2026-10-22

Blocker: none — the registered-consumer native acceptance was verified on 2026-10-28.

Evidence

• The shared automation repository released v8.0.0 of its application publisher (devantler-tech/.github commit 467f07582436a26b62cf4aa756423512f85ba0c0). Platform's approved publisher list still names only the v7.23.0 revision (0c7b6c35…) for application consumers, and the KRO Tenant source, image admission and node-pull rules accept only that maintained revision.
• ci(deps): bump the devantler-tech-actions group with 5 updates platform-tenant-template#251 moved the starter to the v8.0.0 publisher and merged at 2026-10-21T20:57Z with its "Platform Admissibility" job failing ("Platform KRO Tenant does not accept the starter's exact pinned publisher"). The starter's main is now red on that job, so every tenant created from it today would publish releases that Platform refuses.
• The other application consumers (wedding-app, ascoachingogvaner) will receive the same version update.

Audience / problem

Tenant owners and the application consumers cannot move to the maintained v8 publisher until Platform reviews and approves that exact revision.

Hypothesis

Reviewing the v7.23.0 → v8.0.0 publisher range and approving the v8.0.0 revision through the existing approval path (approval list, generated consumer matchers, generic tenant/admission/node-pull rules) turns the starter's admissibility check green without accepting any other commit.

Review notes for the approval

The range changes the publisher by +78/−5 lines plus a new helper. It adds an opt-in "prebuilt WebApp" mode that skips the image build and signs a manifest artifact pointing at an image produced by the caller's main CI. The approval must decide how admission and node-pull verification treat images produced that way, rather than only adding the new revision to the subject rules.

Success signal

The starter's scheduled "Platform Admissibility" run passes on main, and the approval tests accept v8.0.0 while still rejecting unapproved, tag and branch identities.

Acceptance criteria

• Publisher range reviewed and the decision recorded on this issue.
• v8.0.0 revision recorded in the approval list for the application consumers, keeping v7.23.0 valid for already-published releases.
• Consumer matchers regenerated with the supported generator; generic tenant, admission and node-pull rules accept exactly the approved maintained revisions.
• Deployment verified before any consumer moves its pin.

Size: M

Remaining native acceptance

• A newly published v8.0.0 artifact is reconciled and signature-verified by one of the three registered application Flux sources, at its current generation.

Verification — 24 October 2026

The approval delivery in #5215 and #5236 remains deployed. Fresh read-only checks find all three registered consumer predicates accepting the exact v7.23.0 and v8.0.0 publisher identities, with Ready and SourceVerified true at their current generations. The earlier deployed readback remains recorded here.

KHoist v6.0.6 publication run 40078544818, attempt 1 at fdfea6cbb7646ffb5a67e042604e7ec5c2409274, used the exact v8.0.0 publisher 467f07582436a26b62cf4aa756423512f85ba0c0. Its publication and independent smoke jobs succeeded. Fresh independent Cosign verification passed for both immutable artifacts, binding the publisher identity, issuer, repository, release tag and tagged source:

• Image: ghcr.io/devantler-tech/khoist@sha256:1500cff8f7fc77d3b0ce3c469ea7efb7ddc93ce33a2ab2bbe7385e96860fe536
• Manifests: ghcr.io/devantler-tech/khoist/manifests@sha256:9dfae1d5a42a34c0daad2c324bab337a99536180b4678d77f3cdad9763662b3b

This publication is the controller release, while the registered documentation source remains on its earlier pinned artifact. The wedding and coaching sources also remain on their earlier releases. Their current Ready/SourceVerified status therefore does not prove the new artifact reconciled through a registered consumer. Keep this issue open and return the post-merge check to Ready until that event can be observed. Preserve its original start and waiting clocks. No production resource, approval, release pin or activation changed during this verification.

Verification — 28 October 2026

The remaining native acceptance is complete. AS Coaching v1.15.0, source 83ef1e66348837ed2e4de0b8bc60bb9821dd6f8e, was published by successful CD run 40412610520. The tagged caller and the run's referenced-workflow metadata both bind to the approved v8.0.0 publisher 467f07582436a26b62cf4aa756423512f85ba0c0.

Fresh read-only native checks bind its reconciled manifest artifact to that same v1.15.0 source commit and report Ready, ArtifactInStorage and SourceVerified true at the source's current generation. The source's verification policy includes the exact approved v8 publisher. This is the newly published registered-consumer proof that was missing from the earlier readbacks; the older status of the other two consumers is no longer an obstacle to this acceptance criterion.

The signature-verification evidence is the native Flux SourceVerified condition, not a standalone Cosign CLI result. No production mutation or additional publisher approval was needed. All acceptance criteria are now complete.