release: promote develop to main (8debf013) — the runtime images stop shipping their build tree - #626

…at moved (#621)

auditClientIngestion read `rulesets/schema`, a path that has not existed since rulesets/
moved under src/ (ADR-0048). exists() turned the moved directory into a silent zero, so
the audit reported ZERO client schemas over a directory holding 50.

Measured before and after on the same tree: Schemas 0 -> 50, the dimension's verdict
PARCIAL -> SÓLIDO, and the global score 8/9 -> 9/9 dimensiones SÓLIDO. The score was
wrong in the pessimistic direction.

Salvaged from a commit that lived only in a stale local main and was about to be
discarded. The narrative rewrite that travelled with it is deliberately not included —
that is a claim about the product, not a defect fix.

…oubled segment (#622)

auditSdlc read `reference/core/sdlc/sdlc` — a doubled segment. That path has never
existed; the SDLC surface is at reference/core/sdlc. exists() turned it into a silent
zero, so the dimension was scored over no files at all.

Measured before and after: Archivos SDLC 0 -> 174, datos estructurados 5 -> 7,
playbooks 0 -> 22.

Unlike #621 this moves no verdict: the dimension was already SÓLIDO on Fases 5/5 and
Gates 5/5, computed elsewhere. That is why it survived — the zero never hurt the score,
so an evidence line reading 'Archivos SDLC: 0' sat next to a green verdict. A wrong
number that costs nothing is the one nobody reports.

Left out on purpose, same function: '0 markdown fases' is still 0, because the filter
matches phase-0[1-5] while the files are phase-1, phase-1.1, phase-2, phase-3, phase-4.
Whether phase-1.1 counts as a phase is a question about the model, not about a regex.

… the Core (#623)

Advances GT-708 — the Tracker half is beyondnetcode/evolith_tracker#153.

Two things travelled under three letters and neither was ever built: Phase 1.1
(an optional subphase with its own readiness gate and seven artifact templates) and
KDD = Knowledge-Driven Development (an optional section INSIDE the PRD, per-tenant,
from the 2026-07-04 owner session). Owner decision: neither survives, in either repo.

Measured before deleting anything: five gates for phases 1..5; none of the seven KDD
artifacts among the 33 registered; zero TypeScript files; 31 CLI commands with zero
mentions (--phase discovery maps to phase 1 ENTIRE); zero in MCP; no Tracker screen or
entity; no KDD section in prd.schema.json.

The prose was load-bearing anyway: phase-1-business-signoff made 'Phase 1.1 adoption
level has been declared' a PRECONDITION for opening Gate 1, with 'a FAIL result blocks
this gate'. A gate nothing implements was blocking a gate everything implements.

16 files deleted, the Gate 1 precondition and its three KDD clauses removed, the
Subphase 01.1 tables and index rows removed, D-004/L-009 rewritten to what survives
them. ADR-0127 carries the retirement and AMENDS ADR-0103 rather than editing it.
CHANGELOG.md and ADR-0103 keep their KDD text on purpose.

Three pinned corpus counts move by one because the ADR itself owes a generated
conformance ruleset — the corpus grows by one rule nothing can run, to record the
removal of a concept nothing could run either.

…624)

The row was left IN-PROGRESS when the Core half merged, because one of its criteria was
the Tracker's REQ-DIS-12/REQ-DIS-13. That criterion is met by evolith_tracker#153
(97e1bc8e), so the row closes.

Both repositories had the same shape of teeth in different words: the Core made 'Phase
1.1 adoption level has been declared' a precondition for opening Gate 1, and the Tracker
gave REQ-DIS-13 the acceptance criterion 'a FAIL result blocks opening the Business
Sign-Off gate'. One non-existent gate, described twice, blocking on paper the only gate
every initiative must pass — while no ruleset, schema, CLI command, MCP tool, screen or
entity implemented it anywhere.

Board: 677 / 706 done, 0 pending.

…ted it on the way out (#625)

Advances GT-692 (DEFERRED -> IN-PROGRESS).

The Tracker's Deploy (kind + Helm + smoke) died importing evolith-core-api with
'no space left on device' on /repo/node_modules/get-intrinsic/CHANGELOG.md — the same
shape this row registered in July, still biting in another repository.

Two causes, and the second was not in the original evidence:

1. The runner received the build tree, compiler included. Fixed with
   'npm prune --omit=dev' at the end of every builder stage.
2. Found by reading docker history rather than the Dockerfile: 'RUN … chown -R' is a
   586 MB layer on core-api alone, a byte-for-byte duplicate of everything copied
   above it, because a recursive chown rewrites every file into a new layer.
   Ownership now travels on COPY --chown.

Measured before and after, same tree and same day: core-api 1.96 GB -> 862 MB,
agent-runtime-api 2.49 GB -> 1.13 GB, mcp-server 1.89 GB -> 825 MB, cli 2.00 GB ->
890 MB. Total 8.34 GB -> 3.71 GB.

Every image was BOOTED, not merely built — and that is what earned the second
finding: mcp-server first died with 'Cannot find module keyv', a runtime dependency
of @nestjs/cache-manager it never declared, surviving only because eslint hoisted a
copy. The prune exposed the defect; it did not create it.

70-validate-runtime-image-shape.mjs keeps both causes fixed and was observed red
against the previous Dockerfile, naming line 87.

Merged with the non-required 'Governance guards' job stuck ~26 min on an npm install
step — the same flakiness seen twice today. All 8 required checks are green.