# K8 Release Closure

This is the K8 release evidence package for context `linuxcnc-2.10.0-pre0-wasm-m1-py-c1`. K8-REL-01 records compatibility blockers, K8-REL-02 records migration/rollback/offline recovery, and K8-REL-03 records scoped license/source evidence. It is not a release-candidate declaration. Regenerate it with:

```bash
python3 scripts/generate_release_closure.py
```

The generated artifacts are:

| Artifact | Purpose |
|---|---|
| `coverage/release-closure.report.json` | Aggregate release decision and blocker summary |
| `coverage/release-candidate-gate.report.json` | Final release-candidate gate, blocker reasons, evidence hashes and executable stop/allow action |
| `coverage/compatibility-matrix.report.json` | ABI, protocol, schema, runtime, browser and oracle compatibility matrix |
| `coverage/license-closure.report.json` | Source, upstream license declarations, download metadata and explicit `REAL-EXCLUDED` summary |
| `coverage/license-source-index.jsonl` | Deterministic per-entry source hash, owner, scoped license evidence and closure status |
| `docs/linuxcnc-web-wasm-license-decision.md` | Explicit blocked decision for unassigned Web/WASM SPDX/NOTICE metadata |
| `coverage/workspace-migration.report.json` | Versioned package migration, rollback failure injection and offline cache exercise |
| `coverage/workspace-rollback.package.json` | Hash-addressed rollback target for the nearest committed package |
| `coverage/offline-cache.package.json` | Deterministic offline resource manifest and workspace package reference |
| `coverage/release-evidence-index.json` | Hash-addressed evidence index and affected-manifest audit |

The locked context and the existing source, manifest, Python runtime and configuration report hashes match. ABI/protocol/snapshot/event/workspace/manifest versions are all `1`, and the observed Worker schemas agree with the lock. Native/WASM and Worker evidence remains repeat-stable for the implemented slices.

The release conclusion is explicitly `blocked_not_release_candidate`:

The final gate in `coverage/release-candidate-gate.report.json` independently verifies context consistency, locked schema contracts, evidence integrity, license-source completeness and migration/rollback/offline readiness. It records `candidate_eligible: false`, `release_action: STOP_RELEASE`, and six hard blockers. This is an explicit stop decision, not a release-candidate declaration.

- 6,249 of 8,053 manifest seed entries remain `needs_owner`; none is `accepted`.
- 1,804 affected entries have derived owners from their non-unassigned manifest domain and retain inputs, outputs, test IDs, difference state and oracle status in the evidence index. Their oracle state is `blocked`, never accepted.
- The configuration audit retains 997 missing-resource rows across 445 paths and 194 resource-blocked startup entries. Graph orphans, resource orphans and unowned templates remain zero.
- The locked source has no `linuxcnc/unit_tests/kinematics` official oracle root. Derived configuration and recovery results are therefore not official goldens.
- The browser matrix is still planned with Chromium, Firefox and Safari versions marked `TBD`.
- `coverage/license-source-index.jsonl` contains all 8,053 manifest entries: all source hashes and license-audit owners are present, 7,996 LinuxCNC entries match the most-specific scoped declaration in `linuxcnc/debian/copyright`, and 57 Web/WASM entries remain `blocked_unassigned`. These audit owners do not replace manifest feature owners or promote `needs_owner` entries. The manifest v1 itself remains unchanged and has no license field; the external index is the auditable closure artifact rather than an inferred license assignment.
- The Web/WASM implementation has no repository license/NOTICE/SPDX assignment. `docs/linuxcnc-web-wasm-license-decision.md` records the owner decision required; this remains a K8-REL-03 blocker and no upstream LinuxCNC license is inherited.
- K8-REL-02 is implementation-verified: `workspace-package.v1` supports deterministic v1↔v2 envelope migration without changing locked event/snapshot/checkpoint/journal schemas; tampering and unsupported versions fail closed. A rollback package references the current hash and nearest committed package, never overwrites the old package, and recovers to the committed endpoint after an injected pre-commit failure. The offline bundle has deterministic resource hashes, starts with a complete cache, blocks missing/corrupt resources while offline, and reports `network_required` when online fallback is allowed. The official migration/browser/OPFS oracle is still absent and remains blocked.

`REAL-EXCLUDED` is reserved for physical hardware, hard real-time kernel scheduling and host device/path access. These exclusions are listed in the compatibility and license reports and are not used to hide simulated spindle, tool, probe, HAL or recovery behavior.

The audit and migration exercise do not change ABI, protocol, locked event/snapshot/workspace schema versions, source lock, or simulation behavior. They do not create official golden data or clear the remaining compatibility, resource, browser or license blockers.