test(conformance): bind current Chat producer manifest

[BunsDev]

Summary

The prior dispatch preflight stopped correctly because concurrent OpenCoven/chat#160 advanced main to 523b49f4e7e512c467483fc4373844dea6c2d077 after SDK #171. No stale run was dispatched.

Update exact producer/tree/signer/source identities and the package.json SHA-256 for the reviewed Vitest patch. Historical executable harness, protected workflow, compressed fixtures, repaired canary Cave pin, and all frozen SDK package bytes remain unchanged.

Evidence

124 targeted conformance tests passed, one existing skip; contract verification and diff check passed. Exact producer tree, package/harness/workflow bytes and compressed workflow fixture authenticated against Git. Hosted CI required before merge.

Coordination

Sole rebind/dispatch lane. Freeze Chat main until the protected cycle finishes. After merge, align both validator variables and dispatch only if current Chat main exactly matches the lock and no run is active. Publication remains disabled; progresses #38.

[BunsDev]

Reviewed bfe0728. Current Chat main is 523b49f4 and its actual package.json Git bytes match the new 4044-byte/7c111a42 manifest identity. Diff is limited to producer/tree/source/signer IDs, this manifest hash and corresponding documentation/expectations. The repaired consumer Cave pin and frozen source/artifact identities remain intact; no workflow or authority acceptance logic is relaxed. No blocking findings. Normal CI and fresh two-scope/active-run preflight are still required.

[Copilot]

🟢 Approval recommended

The changes are consistent identity-only updates across the lock, tests, and docs with no remaining references to the prior pinned commit.

Pull request overview

This PR updates the pinned OpenCoven/chat evidence-producer identity used by the SDK’s cross-repository conformance validator, rebinding the frozen lock/tests/docs to the current Chat main commit referenced in the PR description.

Changes:

• Rebind the frozen cross-repository conformance lock’s Chat producer commit, tree, and package.json sha256 to 523b49f4e7e512c467483fc4373844dea6c2d077.
• Update conformance tests to assert the new locked identity values.
• Update operator/release documentation to reference the new pinned producer commit.

File summaries

File	Description
tests/conformance-gaps.spec.ts	Updates expected frozen lock values (Chat commit/tree/manifest digest) and signer/source digests.
tests/conformance-contract.spec.ts	Updates the doc contract assertion to require the new pinned Chat commit in the workflow documentation.
RELEASING.md	Updates the referenced “compatible schema-v2 producer” commit hash to the newly pinned Chat revision.
docs/workflows/client-v1-cross-repository-conformance.md	Updates pinned Chat producer commit references in the workflow/contract documentation.
conformance/client-v1-cross-repository-lock.json	Rebases the frozen evidence-producer identity (commit/tree/manifest sha256 and related digests) to the new Chat main revision.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

Merged validator 711ee26 equals the fully passing final-head CI tree. Both Chat validator variables aligned and read back. Exact current Chat main 523b49f4 and absence of active runs confirmed before one dispatch: https://github.com/OpenCoven/chat/actions/runs/34345365355 . This includes the fixed canary Cave pin. Waiting for environment approval. Please freeze all producer/validator mutations and duplicate dispatches while it executes.

[BunsDev]

Run 34345365355 advanced past frozen-consumer authority and packaging, confirming the shared lock fix. Darwin now failed with bounded diagnostic phase1.packaging.cave-build.phase.next-build.compile.plugin (job 102446252660); Linux and Windows still running. I am investigating this build-stage failure without weakening checks or dispatching another run. No evidence accepted.

[BunsDev]

Exact frozen Cave d20d83c built successfully locally in a fresh session-owned clone and isolated HOME using Node 24.18.1, pnpm 10.34.0, NODE_OPTIONS=--max-old-space-size=6144, CIRCLE_NODE_TOTAL=3, and compatibility control enabled. Full Turbopack/TypeScript/server/postbuild completed. Thus the hosted Darwin plugin failure is not locally reproduced; no speculative code fix applied. Linux and Windows remain running. Retaining bounded diagnostic evidence and waiting for their conclusions before selecting the next experiment.

[BunsDev]

A separate continuation has now rotated BOTH validator variables to 6526b56 and started protected run 34347190840. My preflight blocked a diagnostic-only Darwin rerun before any mutation; I did NOT reset variables or launch it. Leaving the active run with its owner and switching to read-only coordination. Previous run 34345365355 remains rejected despite the Linux pass. Local frozen Cave build log is retained; Windows original failure was the 12 GiB bootstrap aggregate directory quota, not a process-memory limit.