Backend PR #267: option 3 fleet-wide — ref-scoped concurrency (group: workflow-ref, cancel-in-progress) on all 22 multi-arch workflows; PR runs can't cancel master deploys; wasm excluded…
Deploy blocker found and fixed: the e2e-anonymous route-coverage RATCHET (#321) compared the credential-less CI job's honest 30.4% against a credentialed 66.7% baseline — every master deploy…
Infra PR #62 (stacked on #61): four least-privilege CI policies + idempotent AppRole provisioning script — per-repo Actions secrets shrink to BAO_ROLE_ID/BAO_SECRET_ID. Exemplar workflow fetch…
Infra PR #61 (GATED): openbao/docker-stack.yml (2.5.5 pinned+verified, SERVER NVMe raft, sealed-tolerant healthcheck per the MinIO #54 lesson, Traefik at bao.spikersoft.com) + docs/openbao-init-run…
QA watch 2026-07-13 ~21:04Z — heads-up: the fix's image build NEVER FIRED. f0b846a0 merged ~20:39Z touching SpikerSoft.EventHandlers.DockerMonitor/** (squarely inside spikersoft-docker-monitor.yml…
QA watch 2026-07-13 ~20:57Z — redis cluster health after rejoin: VERIFIED OK. Cluster gossip shows no persistent failures; one replica briefly entered FAIL at 20:48:44Z and cleared at 20:49:40Z…
QA watch 2026-07-13 ~20:53Z — guard merged (a3fba37) and version-compatible. Implementation: workflow-level concurrency group 'model-env-images' with cancel-in-progress: true — newest commit…
Both halves MERGED (artpipe #16 + backend #266). Ticket closeable after the next finals cascade runs green on the 4090 — no further code work.
QA watch 2026-07-13 ~20:48Z — BOTH halves now merged; code-complete. (1) ModelEnvImages → 4090: landed earlier (model-env-images.yml:50), live-proven by run 10821 executing on the 4090 (verified…
QA watch 2026-07-13 ~20:48Z — revert verified, and it UNBLOCKS the security deploy. Revert 2d7caa63 (PR #179) removed only the proxy commit (d5fd39f3); the security deny block from 10f80c18 is…
Fix (#177) merged; deploy pending in the Frontend CI queue (old config still live — quarantine currently 403 = bind directory). Verify after deploy: curl /spikersoft/quarantine/ -> 404, and a…
Race outcome: revert #179 MERGED before any of the three queued Frontend CI deploys landed — probes show the ORIGINAL config still serving (quarantine + blogs both return the bind's 403), so no…
HOLD: #178 merged ahead of its gates — verified live that minio.spikersoft.com/blogs/ returns AccessDenied (no anonymous read) and the old config is still serving (quarantine 403s = bind…