linuxcncWebWASM/docs/linuxcnc-web-wasm-release-closure.md

K8 Release Closure

This is the K8 release evidence package for context linuxcnc-2.10.0-pre0-wasm-m1-py-c1. K8-REL-01 records compatibility blockers, K8-REL-02 records migration/rollback/offline recovery, and K8-REL-03 records scoped license/source evidence. It is not a release-candidate declaration. Regenerate it with:

python3 scripts/generate_release_closure.py

The generated artifacts are:

Artifact	Purpose
coverage/release-closure.report.json	Aggregate release decision and blocker summary
coverage/release-candidate-gate.report.json	Final release-candidate gate, blocker reasons, evidence hashes and executable stop/allow action
coverage/compatibility-matrix.report.json	ABI, protocol, schema, runtime, browser and oracle compatibility matrix
coverage/license-closure.report.json	Source, upstream license declarations, download metadata and explicit REAL-EXCLUDED summary
coverage/license-source-index.jsonl	Deterministic per-entry source hash, owner, scoped license evidence and closure status
docs/linuxcnc-web-wasm-license-decision.md	Explicit blocked decision for unassigned Web/WASM SPDX/NOTICE metadata
coverage/workspace-migration.report.json	Versioned package migration, rollback failure injection and offline cache exercise
coverage/workspace-rollback.package.json	Hash-addressed rollback target for the nearest committed package
coverage/offline-cache.package.json	Deterministic offline resource manifest and workspace package reference
coverage/release-evidence-index.json	Hash-addressed evidence index and affected-manifest audit

The locked context and the existing source, manifest, Python runtime and configuration report hashes match. ABI/protocol/snapshot/event/workspace/manifest versions are all 1, and the observed Worker schemas agree with the lock. Native/WASM and Worker evidence remains repeat-stable for the implemented slices.

The release conclusion is explicitly blocked_not_release_candidate:

The final gate in coverage/release-candidate-gate.report.json independently verifies context consistency, locked schema contracts, evidence integrity, license-source completeness and migration/rollback/offline readiness. It records candidate_eligible: false, release_action: STOP_RELEASE, and six hard blockers. This is an explicit stop decision, not a release-candidate declaration.

• 6,249 of 8,053 manifest seed entries remain needs_owner; none is accepted.
• 1,804 affected entries have derived owners from their non-unassigned manifest domain and retain inputs, outputs, test IDs, difference state and oracle status in the evidence index. Their oracle state is blocked, never accepted.
• The configuration audit retains 997 missing-resource rows across 445 paths and 194 resource-blocked startup entries. Graph orphans, resource orphans and unowned templates remain zero.
• The locked source has no linuxcnc/unit_tests/kinematics official oracle root. Derived configuration and recovery results are therefore not official goldens.
• The browser matrix is still planned with Chromium, Firefox and Safari versions marked TBD.
• coverage/license-source-index.jsonl contains all 8,053 manifest entries: all source hashes and license-audit owners are present, 7,996 LinuxCNC entries match the most-specific scoped declaration in linuxcnc/debian/copyright, and 57 Web/WASM entries remain blocked_unassigned. These audit owners do not replace manifest feature owners or promote needs_owner entries. The manifest v1 itself remains unchanged and has no license field; the external index is the auditable closure artifact rather than an inferred license assignment.
• The Web/WASM implementation has no repository license/NOTICE/SPDX assignment. docs/linuxcnc-web-wasm-license-decision.md records the owner decision required; this remains a K8-REL-03 blocker and no upstream LinuxCNC license is inherited.
• K8-REL-02 is implementation-verified: workspace-package.v1 supports deterministic v1↔v2 envelope migration without changing locked event/snapshot/checkpoint/journal schemas; tampering and unsupported versions fail closed. A rollback package references the current hash and nearest committed package, never overwrites the old package, and recovers to the committed endpoint after an injected pre-commit failure. The offline bundle has deterministic resource hashes, starts with a complete cache, blocks missing/corrupt resources while offline, and reports network_required when online fallback is allowed. The official migration/browser/OPFS oracle is still absent and remains blocked.

REAL-EXCLUDED is reserved for physical hardware, hard real-time kernel scheduling and host device/path access. These exclusions are listed in the compatibility and license reports and are not used to hide simulated spindle, tool, probe, HAL or recovery behavior.

The audit and migration exercise do not change ABI, protocol, locked event/snapshot/workspace schema versions, source lock, or simulation behavior. They do not create official golden data or clear the remaining compatibility, resource, browser or license blockers.