ci(cloud-vm-image): remove production anchor setup

Merged
TE
7d ago
+171-58

Changelog

Production image workflows no longer read FREESTYLE_PROD_ANCHOR. They require a trusted production snapshot already recorded in repository channel data: a key must resolve its name to the recorded id, and a key that resolves the dev snapshot is refused. No production record means refusal, including a third-account key returning 404 and a dev key whose recorded snapshot has been deleted. There is no trust-on-first-use bootstrap.

Production promotion checks repository identity before recording the downloaded candidate, so that candidate cannot provide its own account anchor. Bake checks identity before creating resources. Malformed production pointers fail closed; normal previous: null, team-only records, and dev rollback pointers remain supported.

The protected environment gate is unchanged: dispatch from refs/heads/feat-cmux-next, existing cmux-next-vm-image-prod, custom branch policies enabled, protected branches disabled, exactly branch:feat-cmux-next. No new secrets or permissions, no production signup, and no provider calls were made for this PR.

Setup and remaining work

Create the environment with that branch policy and supply FREESTYLE_API_KEY. Production remains inert until the team independently verifies and records a production snapshot through review. Removing the manual environment anchor does not remove this bootstrap prerequisite.

Item 2 remains blocked on a team-owned production Stack test account requiring the existing CMUX_UITEST_STACK_EMAIL and CMUX_UITEST_STACK_PASSWORD secrets. Their handling is unchanged. The staging cloud-capture path does not create a runtime account and cannot supply the production profile.

Validation

  • Account-identity regression red: 40927834660, broker job 453ceae63c6047c3bb7d12b17f5f4007, at dc3a2c8f5c81adbe54cee391baa247ccfd002cee (new tests with old implementation). Exactly the third-account and deleted-dev-snapshot cases fail; 123 pass, 2 fail.
  • Final focused suites and supply-chain security: SUCCESS, 127 tests passed, 0 failed, 504 assertions; supply-chain security passed. Run 40928134202, broker job 07c85e1a1b3c48cf8e07e6912531600e, at f5f926d6459246c0e5e5ad74dcb924e5f9260d11.
  • Promote-ordering replay setup failed before tests (exit 128: old commit unavailable in CI snapshot checkout); not regression or base-red evidence. Run 40928476295, broker job 7cef3441afd742bdae16ecb634d2eb8c.
  • Replacement ordering replay supplies the exact old workflow bytes directly, without relying on CI history: expected RED (exit 1): exactly requires repository identity before importing candidate identity and a refused account stops the step and removes its key file fail because the old workflow lacks the check step. Both pass in the final green run. 40929090050, broker job ebfacc8bf95d414b9ada2ef2d349e855.
  • Fresh independent Astra high/fast review: SHIP at f5f926d6459246c0e5e5ad74dcb924e5f9260d11; recognized receipt posted on this PR. This supersedes the previous head's no-anchor P1 BLOCK.

Risk: production bootstrap is deliberately blocked without independently trusted channel identity. Production operation was not exercised.

Agent session: agent session