docs: Sprint Q.3 plan — consume sc-publish develop update

[randlee]

Adds the Sprint Q.3 plan doc, scoped as a pure consume-and-verify sprint.

Boundary this plan enforces: sc-compose is a consumer of sc-publish, not its owner. Q.3 re-vendors plugins/sc-publish from sc-publish develop (ce85b4d, includes PR #38's fixes) and verifies sc-compose's own install/test/CI surface — it does not modify sc-publish's internal probe/workflow logic.

The three residual defects found in PR #38's independent review (pypi build_system branching, GH Release/winget probe fail-open on transient errors) are sc-publish's own bugs and have been filed there:

• pypi-publish.yml unconditionally runs maturin upload regardless of declared build_system sc-publish#39
• GH Release idempotency probe fails open on transient API errors (violates fail-closed requirement) sc-publish#40
• winget idempotency probe fails open on transient API errors (same failure class as #34) sc-publish#41

Docs-only, no code changes. Per team-lead/quality-mgr's plan_gate process, this should go through plan review before Q.3 implementation is dispatched to comp.

🤖 Generated with Claude Code

[randlee]

QA Findings Update

Generated: 2026-08-19T00:00:00Z
QA Pass: 1
Sprint/Task: Q.3 / PHASE-Q3-PLAN-GATE
Branch: sprint/q-3-sc-publish-consume-update
Commit: 402af1e
PR: #526
Verdict: FAIL

Machine Status (JSON)

{
  "sprint": "Q.3",
  "task": "PHASE-Q3-PLAN-GATE",
  "branch": "sprint/q-3-sc-publish-consume-update",
  "commit": "402af1e",
  "pr": 526,
  "verdict": "FAIL",
  "deliverables": {
    "complete": 3,
    "total": 6,
    "percent": 50
  },
  "findings": {
    "blocking": 1,
    "important": 2,
    "minor": 2
  },
  "blocking_ids": ["ATM-QA-001"],
  "merge_readiness": "blocked",
  "merge_reason": "req-qa FAIL with 1 Blocking finding: docs/project-plan.md (the repo's self-declared authoritative release/sprint baseline) has no Sprint Q.3 entry and still states Phase Q is complete via Q.1/Q.2 alone. This reproduces the exact process gap this plan_gate was convened to close. arch-qa PASS (0 blocking/important) on architectural boundary conformance.",
  "next_action": "team-lead/sprint author updates docs/project-plan.md and docs/phase-Q/phase-Q-plan.md per ATM-QA-001/002 (and optionally ATM-QA-003/004/005) on this branch, then resubmit for a plan_gate recheck.",
  "owner": "team-lead"
}

Findings Summary

• Deliverables: 3/6 (50%)
• Blocking: 1
• Important: 2
• Minor: 2

Blocking Findings

• ATM-QA-001 (req-qa, Blocking): docs/project-plan.md (self-declared authoritative release/sprint-sequencing baseline) has no entry for Sprint Q.3 anywhere in its Phase Q section; that section lists only Q.1/Q.2 and states Phase Q status as 'complete' via Q.1/Q.2 alone, even though Q.3's sprint doc, worktree, and branch already exist. Required correction: update docs/project-plan.md's Phase Q section to add a Sprint Q.3 entry, correct the Status line so it no longer implies Phase Q closed at Q.2, and state Q.3's dependency (Q.2 merged; sc-publish develop ce85b4d) consistent with the sprint doc's own front matter.

Detailed Findings

• ATM-QA-002 (req-qa, Important, cross-doc-conflict): docs/phase-Q/phase-Q-plan.md's 'Sprint sequence and parallelism' table (lines 32-41) and 'Phase acceptance criteria' checklist (lines 89-108) were not updated to include Q.3's scope/dependency/parallelism contract; only a trailing bullet was added (line 142). Phase front matter still reads status: in_qa without reflecting reopened Q.3 work. Correction: add a Q.3 row to the sequencing table, extend the acceptance criteria checklist, update phase status.
• ATM-QA-003 (req-qa, Important, acceptance-gap): sprint doc's Release Preflight acceptance criterion ('...clean, or records an explicit, expected external-service stop') has an undefined escape clause, unlike the phase-level criterion it maps to (no escape clause) and unlike Q.2's own closeout evidence (named specific stop point). Not independently verifiable as written. Correction: name the specific expected stop condition(s) up front, or remove the escape clause and require a clean rehearsal run with a recorded workflow URL as the sole pass condition.
• ATM-QA-004 (req-qa, Minor, deliverable-missing): Deliverable 4 ('full test suite') lacks exact command, inconsistent with the doc's own command-precise convention elsewhere. Correction: name the exact command(s) (e.g. cargo test --workspace plus the pinned bootstrap-venv test invocation).
• ATM-QA-005 (req-qa, Minor, cross-doc-conflict, pre-existing): Sprint Q.2's own front matter still reads status: in_progress while phase-Q-plan.md describes Q.2 as complete, undermining Q.3's declared dependency ('Q.2 merged') being unambiguously true from docs alone. Correction: update Q.2 front matter status to match phase-Q-plan.md.

arch-qa: PASS, 0 blocking/important. Confirmed: consumer/owner boundary respected (no sc-publish internal logic modification proposed), known upstream defects (#39/#40/#41) correctly routed out-of-tree, exact-target list is a non-expanded subset of the phase plan's consumer-owned-files contract, verification requirements are evidence-based (byte-for-byte diff, real workflow-run URL) not self-certifying, no RULE-012 boundary implications, no ATM_HOME coupling. arch-qa also flagged (non-blocking) that the assignment JSON used review_type/carry_forward_findings_json field names rather than its documented review_mode/carry_forward_findings contract — dispatch-template naming drift, not a plan defect; noted for the dispatch template maintainer.

Resolved Since Last Pass

• none

Merge Readiness

• Status: blocked
• Reason: req-qa FAIL with 1 Blocking finding: docs/project-plan.md (the repo's self-declared authoritative release/sprint baseline) has no Sprint Q.3 entry and still states Phase Q is complete via Q.1/Q.2 alone. This reproduces the exact process gap this plan_gate was convened to close. arch-qa PASS (0 blocking/important) on architectural boundary conformance.

Next Action

• Action: team-lead/sprint author updates docs/project-plan.md and docs/phase-Q/phase-Q-plan.md per ATM-QA-001/002 (and optionally ATM-QA-003/004/005) on this branch, then resubmit for a plan_gate recheck.
• Owner: team-lead

[randlee]

Final Quality Report

Generated: 2026-08-19T23:40:00Z
QA Pass: 2
Sprint/Task: Q.3 / PHASE-Q3-PLAN-GATE-R2
Branch: sprint/q-3-sc-publish-consume-update
Commit: e8397d6
PR: #526
Final Verdict: PASS

Machine Status (JSON)

{
  "sprint": "Q.3",
  "task": "PHASE-Q3-PLAN-GATE-R2",
  "branch": "sprint/q-3-sc-publish-consume-update",
  "commit": "e8397d6",
  "pr": 526,
  "verdict": "PASS",
  "findings": {
    "blocking": 0,
    "important": 0,
    "minor": 0
  },
  "blocking_ids": [],
  "merge_readiness": "ready",
  "merge_reason": "Both required reviewers (req-qa, arch-qa) PASS with 0 blocking/important findings; all 5 round-1 findings independently reverified as closed; deliverable completion 6/6 (100%); PR #526 CI fully green (14/14 SUCCESS, mergeStateStatus CLEAN).",
  "next_action": "none",
  "owner": "none",
  "recommendation": "Sprint Q.3's plan is gated PASS. Team-lead may proceed to dispatch Q.3 implementation (the actual plugins/sc-publish re-vendor). Quality-mgr will run a standard implementation QA-1 pass (req-qa, arch-qa, rust-qa-agent, rust-best-practices-agent, rust-service-hardening-agent) once the re-vendor diff lands, and will specifically verify the Required Validation section's commands were actually executed with evidence recorded (byte-for-byte diff, double dry-run exit codes, validate-manifest, Release Preflight run URL or recorded expected stop, pinned-venv pytest run)."
}

Validated Scope

Round 2 plan_gate recheck of Sprint Q.3's docs-only plan (re-vendor plugins/sc-publish from sc-publish develop ce85b4d; verify sc-compose's own install/test/CI surface; no sc-publish internal logic modified). req-qa and arch-qa re-reviewed the round-1 fix commit e8397d6 (4 changed files: docs/project-plan.md, docs/phase-Q/phase-Q-plan.md, docs/phase-Q/sprint-q-3-sc-publish-consume-update.md, docs/phase-Q/sprint-q-2-sc-compose-publish-cutover.md) and independently re-verified all 5 round-1 findings (ATM-QA-001..005) against current file content rather than accepting the fix claims at face value. req-qa: PASS, deliverables 6/6 (100%), all 5 findings confirmed closed with file:line evidence. arch-qa: PASS, 0 blocking/important, confirmed no architectural boundary drift introduced by the fix (consumer/owner boundary intact, no sc-publish-internal-logic modification implied, exact-target list unchanged in scope). PR #526 CI: 14/14 checks SUCCESS, mergeStateStatus CLEAN.

Findings Summary (Final)

• Blocking: 0
• Important: 0
• Minor: 0

Residual Risks

• None blocking. Plan-gate scope is docs-only; the sprint's own Required Validation section (byte-for-byte diff, double dry-run, validate-manifest, Release Preflight rehearsal, pinned-venv pytest run) still gates the actual Q.3 implementation round and was not itself executed here (nothing to execute yet — no plugins/sc-publish/ re-vendor has happened). Q.3 execution QA should independently verify those validation commands were actually run and their evidence recorded, not just that the plan specifies them.

Merge Readiness

• Status: ready
• Reason: Both required reviewers (req-qa, arch-qa) PASS with 0 blocking/important findings; all 5 round-1 findings independently reverified as closed; deliverable completion 6/6 (100%); PR docs: Sprint Q.3 plan — consume sc-publish develop update #526 CI fully green (14/14 SUCCESS, mergeStateStatus CLEAN).

Recommendation

Sprint Q.3's plan is gated PASS. Team-lead may proceed to dispatch Q.3 implementation (the actual plugins/sc-publish re-vendor). Quality-mgr will run a standard implementation QA-1 pass (req-qa, arch-qa, rust-qa-agent, rust-best-practices-agent, rust-service-hardening-agent) once the re-vendor diff lands, and will specifically verify the Required Validation section's commands were actually executed with evidence recorded (byte-for-byte diff, double dry-run exit codes, validate-manifest, Release Preflight run URL or recorded expected stop, pinned-venv pytest run).

[randlee]

QA Findings Update

Generated: 2026-08-20T02:01:00Z
QA Pass: 1
Sprint/Task: Q.3 / SPRINT-Q3-QA-REVIEW
Branch: sprint/q-3-sc-publish-consume-update
Commit: 559fbbe
PR: #526
Verdict: FAIL

Machine Status (JSON)

{
  "sprint": "Q.3",
  "task": "SPRINT-Q3-QA-REVIEW",
  "branch": "sprint/q-3-sc-publish-consume-update",
  "commit": "559fbbe",
  "pr": 526,
  "verdict": "FAIL",
  "deliverables": {
    "complete": 1,
    "total": 6,
    "percent": 16.7
  },
  "findings": {
    "blocking": 3,
    "important": 4,
    "minor": 1
  },
  "blocking_ids": ["Q3-QA-001","Q3-QA-002","Q3-QA-003"],
  "merge_readiness": "blocked",
  "merge_reason": "req-qa FAIL with 3 Blocking findings against the sprint's own 6 acceptance criteria. Only AC1 (plugins/sc-publish/ parity) is closed with fresh evidence; AC2 (clean second dry-run), AC3 (revalidated manifest/order/version/package checks), AC4 (clean/expected-stop Release Preflight rehearsal), AC5 (pinned-venv pytest re-run), and AC6 (no sc-publish internal-logic modification) are open, unverifiable, or contradicted by direct file evidence. arch-qa and simplification-reviewer both PASS on their narrower scopes (architectural boundary conformance, scope-creep/dead-path). rust-qa-agent confirms fmt/clippy PASS; cargo test --workspace fails on 5 pre-existing sc-lint fixture test binaries reproduced identically on develop HEAD (environment gap, not a sprint regression) — CI's own hosted 'test' jobs (ubuntu/macos/windows) are green at this commit since CI runs the setup-sc-lint action this local run lacked.",
  "next_action": "comp resolves Q3-QA-001 (file upstream issue + revert local patch, or land fix upstream and re-vendor), re-runs the Release Preflight rehearsal (Q3-QA-002) and cargo test --workspace + pinned-venv pytest (Q3-QA-003/005) post-fix, records all evidence in the sprint doc, and reconciles the AC checklist (Q3-QA-004/ARCH-001) before resubmitting for a QA-2 recheck.",
  "owner": "team-lead"
}

Findings Summary

• Deliverables: 1/6 (16.7%)
• Blocking: 3
• Important: 4
• Minor: 1

Blocking Findings

• Q3-QA-001 (req-qa, Blocking, deliverable-missing): Q3-BLOCK-03's empty-channel-JSON fix was hand-patched only into the installed .github/workflows/release-preflight.yml (lines 385-395); the vendored plugins/sc-publish/.github/workflows/release-preflight.yml retains the original unpatched ${VAR:-{}} syntax. install.py's package_files() copies every file under plugins/sc-publish/ byte-for-byte and flags any destination/source drift on --dry-run. The two copies now provably diverge, so a fresh dry-run will report drift (breaking AC2), and the next real installer run will silently overwrite the fix and reintroduce the crash. Required correction: file the bug as an sc-publish issue (as was done for fix: explicitly fetch develop branch in release_gate.sh #39/40/41/42) and either revert the local patch pending an upstream fix + re-vendor, or land the fix upstream and re-run the full re-vendor so both copies stay identical. Re-run the installer dry-run and record the result.
• Q3-QA-002 (req-qa, Blocking, acceptance-gap): AC4 requires the Release Preflight rehearsal to be clean or to record an explicit, verifiable expected-stop reason. The only recorded rehearsal run (32340747396) failed on the exact two implementation bugs (channel-results jq crash, Homebrew binaries/binary_paths mismatch) that Q3-BLOCK-02/03 were meant to fix — a real FAIL, not an expected external-service stop. No post-fix rehearsal run is recorded anywhere. Required correction: run a new Release Preflight rehearsal after Q3-QA-001 is resolved and record its run URL and outcome in the sprint doc.
• Q3-QA-003 (req-qa, Blocking, acceptance-gap): This sprint modifies a Rust integration test fixture (crates/sc-compose/tests/cli/render.rs), but the sprint doc's required-validation list never names or records a cargo test --workspace run. Independently, rust-qa-agent did run it: fmt/clippy PASS, but cargo test --workspace fails on 5 sc-lint fixture test binaries — confirmed via direct reproduction on develop HEAD (5ab6da0) to be a pre-existing local-environment gap (missing SC_LINT_SOURCE_ROOT/setup-sc-lint bootstrap), not caused by this sprint's diff; CI's hosted test jobs are green at this commit. This resolves the regression-risk question but does not close the finding: the sprint doc itself still has no recorded cargo test --workspace evidence. Required correction: record the cargo test --workspace command and outcome (with the pre-existing sc-lint caveat noted) in the sprint doc's validation evidence section.

Detailed Findings

• Q3-QA-004 (req-qa, Important, cross-doc-conflict): Sprint doc's acceptance-criteria checklist (lines 57-66) is entirely unchecked while the 'Q3 follow-up blocker resolutions' section beneath it (lines 89-134) asserts all three blockers are resolved — internally inconsistent about the sprint's own completion state. Independently corroborated by arch-qa's ARCH-001 (same finding, filed as Important/non-gating doc-hygiene). Correction: check off only criteria genuinely proven by fresh post-fix evidence; leave the rest unchecked with an explicit open-item note.
• Q3-QA-005 (req-qa, Important, acceptance-gap): AC5 (pinned bootstrap-venv test run) is documented only for the pre-fix pytest run (125 passed / 4 failing). No re-confirmation the post-fix pytest run used the same pinned venv rather than a stale ambient install. Correction: re-run python3 -m pytest -q through the pinned venv post-fix and record venv path + pass/fail counts.
• QA-001 (rust-qa-agent, Important, tests): cargo test --workspace fails on 5 sc-lint test binaries (9 individual failures) panicking on a missing SC_LINT_SOURCE_ROOT/setup-sc-lint prerequisite. Reproduced identically on develop HEAD, confirming this is a pre-existing local-bootstrap gap, not a sprint regression; CI's hosted test jobs (which run the setup-sc-lint action) are green. Recommendation: mark these tests #[ignore] with a clear reason when the sc-lint fixture prerequisite is absent, so a plain cargo test --workspace in a fresh checkout doesn't read as a false negative — informs but does not change the Q3-QA-003 disposition above.
• ARCH-001 (arch-qa, Important, doc-hygiene): Same underlying issue as Q3-QA-004 — sprint doc's own gate (checklist) doesn't match its prose claims. merge_ready: true per arch-qa's narrower architectural-boundary scope; not independently gating beyond req-qa's Q3-QA-004.

QA-002 (rust-qa-agent, Minor, correctness): docs/publishing-agent.md:20 still instructs retaining .github/actions/extract-published-sc-compose/, but this sprint's re-vendor removed that action entirely; upstream replaced it with extract-published-renderer (present in the vendored tree and referenced by homebrew-publish.yml/scoop-publish.yml). Correction: update the doc reference to extract-published-renderer.

Reviewer summary: req-qa=FAIL (3 Blocking, 2 Important, deliverables 1/6=16.7%); arch-qa=PASS (0 blocking, 1 Important — ARCH-001, merge_ready: true on its own scope); rust-qa-agent=findings (fmt/clippy PASS, tests fail for a confirmed pre-existing/non-regression reason, 1 Important + 1 Minor doc finding); simplification-reviewer=PASS (0 findings — confirmed no disguised workaround inside plugins/sc-publish/, all three blocker dispositions structurally sound). All 4 reviewers independently confirm Q3-BLOCK-01 (upstream-only, sc-publish#42) and Q3-BLOCK-02 (consumer-test-fixture-only) dispositions are correct. Q3-BLOCK-03's disposition claim ("consumer-side only, plugins/sc-publish/ untouched") is literally true but insufficient per req-qa: the installed file it patched is not consumer-owned, it is a byte-for-byte package-vendored copy, so the fix will not survive the next real install.

Resolved Since Last Pass

• none

Merge Readiness

• Status: blocked
• Reason: req-qa FAIL with 3 Blocking findings against the sprint's own 6 acceptance criteria. Only AC1 (plugins/sc-publish/ parity) is closed with fresh evidence; AC2 (clean second dry-run), AC3 (revalidated manifest/order/version/package checks), AC4 (clean/expected-stop Release Preflight rehearsal), AC5 (pinned-venv pytest re-run), and AC6 (no sc-publish internal-logic modification) are open, unverifiable, or contradicted by direct file evidence. arch-qa and simplification-reviewer both PASS on their narrower scopes (architectural boundary conformance, scope-creep/dead-path). rust-qa-agent confirms fmt/clippy PASS; cargo test --workspace fails on 5 pre-existing sc-lint fixture test binaries reproduced identically on develop HEAD (environment gap, not a sprint regression) — CI's own hosted 'test' jobs (ubuntu/macos/windows) are green at this commit since CI runs the setup-sc-lint action this local run lacked.

Next Action

• Action: comp resolves Q3-QA-001 (file upstream issue + revert local patch, or land fix upstream and re-vendor), re-runs the Release Preflight rehearsal (Q3-QA-002) and cargo test --workspace + pinned-venv pytest (Q3-QA-003/005) post-fix, records all evidence in the sprint doc, and reconciles the AC checklist (Q3-QA-004/ARCH-001) before resubmitting for a QA-2 recheck.
• Owner: team-lead

[randlee]

QA Findings Update

Generated: 2026-08-20T02:13:00Z
QA Pass: 2
Sprint/Task: Q.3 / SPRINT-Q3-QA-REVIEW-R2
Branch: sprint/q-3-sc-publish-consume-update
Commit: ab93be0
PR: #526
Verdict: FAIL

Machine Status (JSON)

{
  "sprint": "Q.3",
  "task": "SPRINT-Q3-QA-REVIEW-R2",
  "branch": "sprint/q-3-sc-publish-consume-update",
  "commit": "ab93be0",
  "pr": 526,
  "verdict": "FAIL",
  "deliverables": {
    "complete": 5,
    "total": 6,
    "percent": 83.3
  },
  "findings": {
    "blocking": 1,
    "important": 0,
    "minor": 1
  },
  "blocking_ids": ["Q3-QA2-001"],
  "merge_readiness": "blocked",
  "merge_reason": "req-qa FAIL with 1 new Blocking finding (Q3-QA2-001) on AC4. All 5 round-1 findings independently reverified as fix-holds: Q3-QA-001 (byte-identity restored between installed and vendored release-preflight.yml, sc-publish#43 filed), Q3-QA-003 (cargo test --workspace evidence recorded with exact command/env var), Q3-QA-004/ARCH-001 (AC checklist now accurate), Q3-QA-005 (pinned venv path recorded). However Q3-QA-002's underlying acceptance criterion (AC4) is not actually met: the fresh Release Preflight rehearsal (run 32351284694) stopped on an unrelated credential/permission error (PyPI/TestPyPI secret-metadata HTTP 403, rejected CARGO_REGISTRY_TOKEN HTTP 403), not the sprint doc's own defined 'expected external-service stop' (the human-authorized-publication gate). The sprint doc itself correctly leaves this AC unchecked. arch-qa and simplification-reviewer both PASS with 0 findings (byte-identity independently re-verified, clean pure-subtraction revert, no residual workaround). rust-qa-agent: fmt/clippy/tests all PASS (tests confirmed green with SC_LINT_SOURCE_ROOT set, control run without it reproduces the same pre-existing environment-only failures); 1 Minor finding still outstanding (QA-002, stale doc reference to a removed GitHub Action, not yet fixed this round).",
  "next_action": "comp resolves the GitHub Actions secret-metadata read permission and/or rotates the CARGO_REGISTRY_TOKEN so a Release Preflight rehearsal reaches the documented human-authorized-publication stop (or runs clean end-to-end), records that run's evidence in the sprint doc, and optionally fixes the still-outstanding QA-002 doc reference, before resubmitting for a QA-3 recheck.",
  "owner": "team-lead"
}

Findings Summary

• Deliverables: 5/6 (83.3%)
• Blocking: 1
• Important: 0
• Minor: 1

Blocking Findings

• Q3-QA2-001 (req-qa, Blocking, acceptance-gap, supersedes Q3-QA-002): AC4 (Release Preflight rehearsal is clean or records an explicit, expected external-service stop) remains genuinely unmet. A fresh post-fix rehearsal (run https://github.com/randlee/sc-compose/actions/runs/32351284694) was executed and closes the prior process-transparency gap (a real re-run now exists and is honestly recorded, rather than reusing the stale pre-fix run) — but the stop itself is an unrelated credential/permission failure (GitHub Actions unable to read protected PyPI/TestPyPI secret metadata, HTTP 403; a rejected CARGO_REGISTRY_TOKEN, HTTP 403), not the human-authorized-publication gate the sprint doc itself defines as the only acceptable stop. The sprint doc self-classifies this run as a failure of the criterion and correctly leaves the AC4 checkbox unchecked. Required correction: do not mark Q.3 deliverable-complete until a Release Preflight rehearsal either (a) runs clean end-to-end, or (b) halts specifically at the human-authorized-publication gate with the documented 'no publisher authorization present' stop reason — this likely requires fixing the GitHub Actions permission/environment access needed to read protected secret metadata and/or rotating the rejected CARGO_REGISTRY_TOKEN so the rehearsal reaches the intended gate rather than failing on unrelated credential plumbing.

Detailed Findings

• QA-002 (rust-qa-agent, Minor, guideline, carried forward from round 1, still outstanding): docs/publishing-agent.md:20 still instructs retaining .github/actions/extract-published-sc-compose/, but neither homebrew-publish.yml nor scoop-publish.yml reference that action anymore (both use extract-published-renderer); the referenced action directory is dead/unused and the doc is stale. Not fixed in this round. Correction: update the doc reference to extract-published-renderer, or remove the unused action reference.

Reviewer summary: req-qa=FAIL (1 Blocking — Q3-QA2-001; deliverables 5/6=83.3%); arch-qa=PASS (0 blocking/important, both carried-forward findings confirmed resolved by independent byte-for-byte re-diff); rust-qa-agent=findings (fmt/clippy/tests all PASS with documented env var; 1 Minor carried-forward finding still open); simplification-reviewer=PASS (0 findings, clean pure-subtraction revert with no residual workaround, ab93be0 confirmed genuinely docs-only).

Resolved Since Last Pass

• Q3-QA-001 (was Blocking): fix-holds — installed and vendored release-preflight.yml are now byte-identical (474 lines, independently re-diffed by both req-qa and arch-qa); underlying defect filed upstream as sc-publish#43 instead of a local workaround.
• Q3-QA-003 (was Blocking): fix-holds — cargo test --workspace PASS recorded with exact command and SC_LINT_SOURCE_ROOT env var; independently re-run by rust-qa-agent with the same result, and a control run without the env var reproduces the same pre-existing environment-only failures (not a sprint regression).
• Q3-QA-004 / ARCH-001 (was Important): fix-holds — sprint doc AC checklist now shows 5/6 checked, consistent with the narrative; the one remaining unchecked item (AC4) is honestly left open rather than falsely claimed complete.
• Q3-QA-005 (was Important): fix-holds — pinned bootstrap venv path (/private/tmp/sc-compose-q3-venv-1.4.1/bin/python) explicitly recorded alongside post-fix pytest results (125 passed / 4 expected sc-publish#42 go_native failures).

Merge Readiness

• Status: blocked
• Reason: req-qa FAIL with 1 new Blocking finding (Q3-QA2-001) on AC4. All 5 round-1 findings independently reverified as fix-holds: Q3-QA-001 (byte-identity restored between installed and vendored release-preflight.yml, sc-publish#43 filed), Q3-QA-003 (cargo test --workspace evidence recorded with exact command/env var), Q3-QA-004/ARCH-001 (AC checklist now accurate), Q3-QA-005 (pinned venv path recorded). However Q3-QA-002's underlying acceptance criterion (AC4) is not actually met: the fresh Release Preflight rehearsal (run 32351284694) stopped on an unrelated credential/permission error (PyPI/TestPyPI secret-metadata HTTP 403, rejected CARGO_REGISTRY_TOKEN HTTP 403), not the sprint doc's own defined 'expected external-service stop' (the human-authorized-publication gate). The sprint doc itself correctly leaves this AC unchecked. arch-qa and simplification-reviewer both PASS with 0 findings (byte-identity independently re-verified, clean pure-subtraction revert, no residual workaround). rust-qa-agent: fmt/clippy/tests all PASS (tests confirmed green with SC_LINT_SOURCE_ROOT set, control run without it reproduces the same pre-existing environment-only failures); 1 Minor finding still outstanding (QA-002, stale doc reference to a removed GitHub Action, not yet fixed this round).

Next Action

• Action: comp resolves the GitHub Actions secret-metadata read permission and/or rotates the CARGO_REGISTRY_TOKEN so a Release Preflight rehearsal reaches the documented human-authorized-publication stop (or runs clean end-to-end), records that run's evidence in the sprint doc, and optionally fixes the still-outstanding QA-002 doc reference, before resubmitting for a QA-3 recheck.
• Owner: team-lead

[randlee]

Final Quality Report

Generated: 2026-08-20T16:10:00Z
QA Pass: 3
Sprint/Task: Q.3 / SPRINT-Q3-QA-REVIEW-R3
Branch: sprint/q-3-sc-publish-consume-update
Commit: d4f03d4
PR: #526
Final Verdict: PASS

Machine Status (JSON)

{
  "sprint": "Q.3",
  "task": "SPRINT-Q3-QA-REVIEW-R3",
  "branch": "sprint/q-3-sc-publish-consume-update",
  "commit": "d4f03d4",
  "pr": 526,
  "verdict": "PASS",
  "findings": {
    "blocking": 0,
    "important": 0,
    "minor": 1
  },
  "blocking_ids": [],
  "merge_readiness": "ready",
  "merge_reason": "All four required reviewers PASS with 0 blocking findings; deliverable completion 8/8 (100%); PR #526 CI fully green (16/16 SUCCESS, mergeStateStatus CLEAN) at commit d4f03d4. Round-2's sole Blocking finding (Q3-QA2-001) is confirmed withdrawn per RCA issue #527 and independently reconfirmed this round with literal AC4 text citation, not reintroduced in any form.",
  "next_action": "none",
  "owner": "none",
  "recommendation": "Sprint Q.3 QA gate is closed PASS. Team-lead may merge PR #526 to develop. The one non-blocking Minor finding (Q3-QA3-001) may be addressed opportunistically in a future documentation pass and is not a merge condition."
}

Validated Scope

Round 3 recheck after comp re-vendored against sc-publish develop 0fa5b05 (including PR #45's merged fail-closed-probe and manifest-driven-upload-tool fixes) and rewrote the sprint doc's AC4 language. All four required reviewers independently re-reviewed the full 71-file sprint diff (develop...HEAD) and the sprint doc's literal AC text, per this round's explicit 'quote, don't paraphrase' instruction (issue #527). req-qa: PASS, deliverables 8/8 (100%), 0 blocking findings; independently quoted the sprint doc's literal AC4 text (lines 62-66, 164-170) and cross-referenced it against the fresh Release Preflight rehearsal run 32388936922, verifying all four named failed step-ids (environment-secrets, credential-liveness, registry-state, channel-results) exist as real steps in the installed release-preflight.yml; explicitly reconfirmed round-2 finding Q3-QA2-001 was correctly withdrawn and no unstated standard was reintroduced. arch-qa: PASS, 0 blocking/important findings, no architectural boundary drift. simplification-reviewer: PASS, 0 findings, byte-identity of the re-vendored plugins/sc-publish/ tree independently re-verified against a live sc-publish checkout at 0fa5b05. rust-qa-agent: PASS, 0 findings; fmt clean, clippy clean (0 warnings, -D warnings), cargo test --workspace green (125 passed, 4 expected sc-publish#42 go_native failures) with SC_LINT_SOURCE_ROOT set; confirmed the sole Rust diff (crates/sc-compose/tests/cli/render.rs) correctly aligns the binary_paths fixture field with release/homebrew/formula.rb.j2. PR #526 CI: 16/16 checks SUCCESS, mergeStateStatus CLEAN at commit d4f03d4.

Findings Summary (Final)

• Blocking: 0
• Important: 0
• Minor: 1

Residual Risks

• Q3-QA3-001 (req-qa, Minor, non-blocking, documentation precision): the rehearsal's sanitized failed-step list (channel-results) could more explicitly cross-reference the pre-declared upstream issue sc-publish#43 in the sprint doc's validation evidence, for reader clarity. Does not affect AC compliance or merge readiness; may be picked up opportunistically in a future doc pass, not a condition of this sprint's closure.
• No other residual risk. Q3-BLOCK-01/02/03 dispositions (upstream go_native gap tracked as sc-publish#42, consumer-only Homebrew fixture fix, upstream empty-channel-JSON fix tracked as sc-publish#43) remain independently confirmed correct across all three QA rounds.

Merge Readiness

• Status: ready
• Reason: All four required reviewers PASS with 0 blocking findings; deliverable completion 8/8 (100%); PR docs: Sprint Q.3 plan — consume sc-publish develop update #526 CI fully green (16/16 SUCCESS, mergeStateStatus CLEAN) at commit d4f03d4. Round-2's sole Blocking finding (Q3-QA2-001) is confirmed withdrawn per RCA issue RCA: QA gate blocked Sprint Q.3 on a fabricated AC4 standard, contradicting sprint doc's explicit rejected-token-is-valid-stop language #527 and independently reconfirmed this round with literal AC4 text citation, not reintroduced in any form.

Recommendation

Sprint Q.3 QA gate is closed PASS. Team-lead may merge PR #526 to develop. The one non-blocking Minor finding (Q3-QA3-001) may be addressed opportunistically in a future documentation pass and is not a merge condition.