[jondricek]

Summary

Merge beta into alpha while retaining alpha's canonical validation, configurable retirement exemptions and optional reporting. The only textual conflict was app/services/release-tracks/reviewed-state-service.js; its resolved content is identical to alpha. Existing enabled retirement defaults and administrator overrides remain unchanged. Changing defaults is a separate policy decision.

release admission / preview / publication
  capture canonical policy
  evaluate exact stored revision
    matching enabled exemption -> exempt + rule evidence
    otherwise -> ADM validation + configured error bypasses
  reject invalid batch before changing workflow or membership

Source beta: 401a3719eed71852a04b7872ede5cb8137fcb506
Destination alpha: 3fc457683a4bd3cd366e0731314d775e19b6ae06
Resolution merge: 50a4388b2874a7d885a52e1afed00c4898332911

The dedicated branch is authorized for this file-conflict resolution and starts from alpha with beta as the second merge parent. Merge this PR with a merge commit, preserving source ancestry; do not squash or rebase.

The merge also brings beta's workflow-reference cleanup on deletion, authoring provenance preservation, UUIDv4 draft bundle IDs, ICS platform defaults and development configuration. Git reports 24 source commits absent by ancestry and 16 unmatched non-merge patches; the history includes reapplication and revisions, not 24 independent new features.

Added four admission cases for revoked/deprecated revisions with disabled or nonmatching exemptions, matching-scope retries, batch atomicity and stored-content preservation. Added overlapping-rule report coverage and publication rejection after both exemptions are disabled. Reconciled the provenance test with alpha's explicit organization-identity propagation: ordinary authoring preserves the latest stored creator while historical revisions remain unchanged. Updated user/admin/developer contracts accordingly. No new API fields or endpoints were introduced by the resolution.

Evidence

• Before: beta -> alpha conflicts in reviewed-state-service.js; beta's unconditional retirement shortcut would bypass alpha's policy and report collection.
• After: conflict resolved using alpha's service, with both release tips retained as merge parents. Re-fetched tips remain unchanged before publication.
• Node 22.23.4; npm ci, lint, lockfile checks, whitespace checks and commitlint pass. Dependency verification: 1,093 signatures and 144 attestations.
• Focused policy/admission/report/runtime specs: 107 passing. Provenance spec: 9 passing. Broader affected-spec run initially found a provenance expectation mismatch (fixed and isolated spec passes) and a content-manifest 404 (isolation 10 passing).
• Full npm test: OpenAPI 4 passing, config 22 passing, API 1,263 passing / 2 failing. Failures: groups query setup ECONNRESET; virtual-determinism source-promotion composition expected 201 but returned 404. Both affected specs pass in isolation (10 and 11 tests). No Mongo port/startup error found. Middleware/scheduler were short-circuited by API failures.
• Full-suite retry: OpenAPI 4 passing, config 22 passing, API 1,273 passing / 1 failing. The failure moved to virtual-scheduled-materialization.spec.js, client-supplied explicit creation value: expected 200, returned 404. That spec passes in isolation (5 passing). Separately, middleware 29 passing and scheduler 15 passing. Full local validation has not passed. No tests were skipped, weakened or given higher timeouts.
• Current-head CI passes: GitHub Actions completed commitlint, static checks, and the full npm test via coverage: OpenAPI 4, configuration 22, API 1,274, middleware 29, scheduler 15, all passing. Registry signatures 1,093 and attestations 144 verified. Fresh fetch confirms source/destination tips are unchanged. The PR is ready for review; the local intermittent failures above remain recorded.

Merge Danger

Door: Two-way for code; published release manifests retain their established immutability contracts.

Blast Radius: API

This integrates the beta changes into alpha only. The primary review points are canonical admission policy/report preservation, deletion cleanup integration, and identity propagation versus ordinary authoring. Default-exemption changes are explicitly deferred. No release branch was pushed directly and no PR was merged.

[jondricek]

Implemented the approved conflict resolution in 50a4388b2874a7d885a52e1afed00c4898332911: alpha's canonical validation/reporting service and current exemption defaults are preserved. Added admission/report regressions and reconciled the provenance test with alpha's explicit identity propagation. Both source beta and destination alpha are direct parents of this merge commit.

Current-head CI passes: commitlint, lint, full npm test (4 OpenAPI + 22 config + 1,274 API + 29 middleware + 15 scheduler), and dependency signatures/attestations. Release is correctly skipped on this PR event. Re-fetched beta/alpha remain at the SHAs in the description.

Two local full-suite attempts had changing failures: groups setup ECONNRESET, virtual composition 404, then explicit virtual materialization 404. All affected specs pass in isolation; details are retained in the description. CI provides the complete passing validation of this exact head.

Ready for review. Merge with a merge commit to preserve beta ancestry; exemption-default changes remain a separate policy decision. No PR has been merged by this task.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 90.50000% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.41%. Comparing base (3fc4576) to head (50a4388).

Files with missing lines	Patch %	Lines
...services/release-tracks/object-deletion-service.js	89.87%	8 Missing ⚠️
app/repository/_base.repository.js	82.35%	3 Missing ⚠️
...release-tracks/release-track-dynamic.repository.js	91.89%	3 Missing ⚠️
...elease-tracks/release-track-registry.repository.js	78.57%	3 Missing ⚠️
app/services/meta-classes/base.service.js	95.91%	1 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha     #521      +/-   ##
==========================================
+ Coverage   83.36%   83.41%   +0.05%     
==========================================
  Files         277      278       +1     
  Lines       43679    43847     +168     
  Branches     6146     6195      +49     
==========================================
+ Hits        36411    36576     +165     
+ Misses       7150     7149       -1     
- Partials      118      122       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎉 This PR is included in version 4.26.0-alpha.1 🎉

The release is available on:

• v4.26.0-alpha.1
• GitHub release

Your semantic-release bot 📦🚀