Release Qualification

Software tests do not certify a production laboratory or a physical effect. RIGOR therefore provides two explicit, claim-specific evidence profiles in addition to CI. The production profile is required before making a production deployment claim. The physical profile is deferred and is required only when a future release claims a qualified physical device or effect; it does not block the current software/simulated release scope.

python3 scripts/collect-qualification-draft.py production
python3 scripts/collect-qualification-draft.py physical
uv run --with jsonschema python scripts/qualify-release.py production /path/to/production-evidence.json
uv run --with jsonschema python scripts/qualify-release.py physical /path/to/physical-evidence.json

The collectors are read-only and deliberately emit a failing draft. They may record service health, process RSS/age, configured object-store state and an explicitly marked physical-device candidate, but never infer recovery, Object Lock, identity enforcement, physical effect or safe-stop success. The evidence structures are versioned by contracts/production-qualification-v1.schema.json and contracts/physical-device-qualification-v1.schema.json; fail-closed templates live under qualification/examples/.

The command exits non-zero and lists every missing gate. Evidence records are deployment artifacts and must not contain credentials; local run output is not committed as architecture fact.

The live Agent profile gate exercises the versioned Scientist, Planner, and Analyst profiles against the configured model. It requires all cases to pass, permits no tool errors or unnecessary Attention, verifies deterministic package validation, and checks that a no-data analysis does not invent measurements:

python3 scripts/qualify-agent-profiles.py \
  --analysis-archive /path/to/a/known-no-measurement-pace-delivery.tar.gz \
  --expect-no-measurements \
  --evidence /path/to/agent-profile-evidence.json

The evidence file contains profile, prompt, context, output, and Skill-policy versions plus stable run IDs and hashes; it deliberately excludes prompts, model responses, credentials, and hidden reasoning.

Qualification first enforces the versioned JSON Schema and then evaluates the fail-closed semantic gates. A structurally invalid document exits with status 2; a well-formed document with missing operational proof exits with status 1.

The production profile requires supervised kill/restart recovery, PostgreSQL as the durable system of record with the supported migration version and restore evidence, immutable redundant S3/MinIO storage with Object Lock and positive approved retention, an independent backup restore with checksum verification, external identity with viewer/operator/admin enforcement, and a declared workload running for at least one hour inside a stated RSS limit.

The repository-level identity gate verifies trusted-header/service-token boundaries and viewer/operator mutation enforcement without requiring an institution provider:

scripts/test-identity-boundary.sh

Passing this internal gate is necessary but does not satisfy the production identity check. The target proxy must still authenticate against a non-local provider, strip client-supplied identity headers, inject the verified user and roles, and provide deployment evidence for viewer, operator, and admin users.

The bounded software soak polls every deployed domain, records per-service latency and aggregate process RSS, and periodically executes the low-risk balance0/tare semantic capability through LabBridge. That device is required to remain explicitly SimFleet/simulated; this workload is not physical evidence.

python3 scripts/run-software-soak.py \
  --duration-seconds 3600 \
  --rss-limit-mib 4096 \
  --evidence /path/to/software-soak-evidence.json

If LabBridge trusted-header mode is enabled, provide its internal credential as SDLX_SOAK_LABBRIDGE_SERVICE_TOKEN. The token is used only in request headers and is never written to the evidence JSON.

Runs shorter than one hour may be useful while developing the harness, but they fail the qualification threshold by default.

The deterministic Agent failure-injection gate proves bounded provider retry, tool/token budget stops, sanitized Planner transport failure, bounded Analyst timeout replay and escalation, and Scientist/execution-read fail-closed behavior without repeating an action:

scripts/test-agent-failure-injection.sh

Process and object-store outage/recovery are exercised separately by scripts/test-live-process-recovery.sh and scripts/test-object-storage-minio.sh; the latter stops and restarts the isolated MinIO container and verifies deterministic replay after recovery.

When physical qualification is resumed, the physical profile requires a stable non-simulated device, semantic capability and idempotent operation, independently observed physical state, safe-stop with a verified safe state, immutable non-dummy evidence, downstream analysis, restart reconciliation without blind command replay, and the same upstream Agent/Execution contract used by simulation.

The 2026-07-18 development snapshot did not pass either profile because it lacked configured immutable storage, institution-backed identity, bounded soak evidence, independent backup restoration, and a qualified physical device path. That dated result illustrates fail-closed behavior; it is not a live status report. Use Current Progress for maintained release gates and run the commands above against the target deployment for a current qualification result.