Public-service remediation status

The public-service remediation is incomplete. The current deployment still uses API tokens by default and the Docker production runner. Opt-in anonymous verification now provides Turnstile sessions in Redis, browser prompts, public build DTOs, and verified API downloads. These changes do not establish the public-service launch boundary described in the remediation plan.

Implemented foundations

• Shared Redis request enforcement applies IP and IPv6 /64 buckets before authentication, plus rolling download request limits.

• The download gateway provides an independent process, publication/session checks, S3 byte ranges, two shared transfer leases per IP, bounded streaming, periodic Redis ban-marker checks, and a deployment template.

• Sanitized public progress uses a closed event vocabulary, PostgreSQL persistence and resumable SSE, with four shared Redis stream leases per IP. Raw historical/preparation diagnostics remain administrative.

• CreateIfRoom serializes capacity checks and insertion with a PostgreSQL transaction-scoped admission lock. The insertion runs with a fresh READ COMMITTED snapshot after acquiring the lock. This bounds concurrent calls to this method. Anonymous admission additionally serializes the three-per-day quota, one outstanding build per IP, twenty waiting jobs and browser-scoped idempotency in the same transaction. Ownership cookies authorize cancellation with same-origin validation; admission status is available to the form.

• Expired executions with cancellation recorded become terminal canceled jobs, with a finish timestamp, even when the attempt limit is exhausted. They are neither requeued nor counted as failures.

• SCons explicitly enables selected modules. Docker compilation derives its effective module list from resolved workspace destinations, including dependencies. Unsupported destinations and flags disabling a resolved module are rejected before container creation. Submitted historical specs are not rewritten.

• Duplicate expert SCons settings and settings disabling selected modules are rejected. Local expert arguments otherwise remain supported.

• A configured quota provider failing to answer now causes a retryable HTTP 503.

• A Kubernetes phase execution adapter now creates and reattaches to sequential phase Jobs, verifies resource identities, isolates the compiler, and waits for pod shutdown during cancellation/cleanup. It is not yet connected to the production queue or a durable controller.

• Durable abuse enforcement persists escalating strikes, revokes verified sessions, checks active streams/transfers, audits unblocking, and rebuilds an atomic Redis ban snapshot after state loss. Session issuance fails closed during ban-index rebuilds. IP-bearing application records have thirty-day maintenance; ingress access-log retention remains operational work.

• Authelia administration validates trusted ingress and group membership in anonymous deployments, retires token sessions and token-management routes there, and supplies administrative actor attribution.

• The form guards catalog loading/failure/stale responses, cancels obsolete fetches, preserves idempotency on failed retries, and shows admission capacity.

• Durable execution persistence adds immutable attempt plans, resource UIDs, unique lease generations, two database-owned slots, fenced progress logs and cleanup records. Expiry reacquires the same execution; cancellation wins until publication commits. Controller wiring is still required.

• Immutable public configuration adds version IDs, atomic catalog revisions/snapshots, explicit fork repository preparation, backend-owned typed options, strict public input validation, and frontend configuration summaries. Idempotent response retries survive catalog removal. Expanded dependency conflicts are rejected before admission. Exact engine and module commits are recorded before compilation and reused by queue retries; generation-fenced controller pin writes are also available.

Verification

• The complete Go suite passed (external-service tests skip unless configured).
• Frontend checking and tests must be rerun after each frontend change; the earlier production build passed. Current validation is recorded below.
• The complete store suite passed against a temporary PostgreSQL 16 container, including 24 concurrent admissions competing for two positions and canceled execution recovery both before and at the attempt limit.
• Argument-generation tests cover LimboAI, a dependency with a different module directory name, defaults disabled, and contradictory flags. This is not the real Godot binary-content acceptance test.

Remaining implementation and acceptance work

1. Digest-pinned effective toolchain manifests and controller integration of source pin reporting. Direct store Create remains a persistence operation; legacy token admission is not the public launch contract.
2. Wire the Kubernetes adapter and durable attempt store into a controller; implement actual shared log collection, attempt-scoped storage capabilities, reconciliation, cancellation through publication, and orphan cleanup. The Docker reaper still retries on lease expiry; it does not establish that previous pods have stopped.
3. Shared diagnostic archives and Kubernetes log collection; deploy and verify the Authelia ingress boundary; retire remote CLI contracts and default token mode.
4. Verify ban/session behavior through the real ingress/provider and configure thirty-day access-log retention outside the application.
5. Gateway production cutover, read-only storage-policy verification, durable ban initialization/recovery, and through-ingress large-download testing.
6. Browser accessibility acceptance, verification/ban countdown presentation, and cancellation through publication in the production execution path.
7. Component readiness and metrics; API/controller/gateway deployments; compiler isolation policies; Cloudflare origin authentication and Traefik/Authelia controls; migration and rollout tooling.
8. Real compilation, multi-replica quota/execution tests, Kubernetes failure and isolation tests, production provider/ingress acceptance, S3 publication and download tests, public disclosure tests, and ingress end-to-end tests.

The full Go suite and go vet ./... passed. Svelte checking reported zero errors/warnings and all 118 frontend tests passed. The latest isolated PostgreSQL/Redis run passed admission, durable ban recovery, session fencing, execution slot/takeover, and publication cancellation tests. These are service integration tests, not deployment or real compilation proof.

No production data was migrated and no production rollout was performed.