Prune Data-Loss (four-gate isolation)

What this package supports

A promotion path reached PARTIAL_SUCCESS and cleanup (prune) then destroyed an orphaned submodule commit before it could be pushed anywhere reachable. The remedy separated close/promote/prune/deploy into four gates, made push-before-prune binding, made ambiguous reachability a HALT with fail-closed exit codes, and Caliber C112 keeps the isolation installed. (Articles: foundational four-failures table; technical companion §3 walked example + §9.)

Proves

the close/promote/prune/deploy separation is real and each is its own command boundary (four-gate-contract.md); the prune gate is fail-closed with named exit codes, orders push before any destructive operation, and HALTs on ambiguous reachability (prune-exit-codes.md); the isolation is mechanically enforced by a Critical, no-grace Caliber criterion (c112-contract.md); and the whole control traces to a concrete incident whose three structural defects were eliminated rather than patched (incident-sequence.md).

Does not prove

that the original data-loss event can be re-triggered from this package — that was a one-time close-out of the Cure v2 blind-benchmark work recorded in the owner plan's failure narrative, not reproducible here. This package evidences a discipline/enforcement outcome on internal build tooling; it makes no claim about any production customer data (the destroyed commit was an internal canary commit in an internal canary app).

↓ Download package (.zip)

8 files · 13.8 KB
Every artifact, the manifest, checksums, and the full README — one archive.

Inside the archive — 8 files, 26.0 KB

File Size
artifacts/c112-contract.md 3.1 KB
artifacts/four-gate-contract.md 3.6 KB
artifacts/incident-sequence.md 4.4 KB
artifacts/prune-exit-codes.md 3.6 KB
checksums.txt 624 B
manifest.json 3.7 KB
README.md 3.6 KB
source-summary.md 3.5 KB

Full package README — claim, source provenance, redaction statement, reproduction

Claim supported: A promotion path reached PARTIAL_SUCCESS and cleanup (prune) then destroyed an orphaned submodule commit before it could be pushed anywhere reachable. The remedy separated close/promote/prune/deploy into four gates, made push-before-prune binding, made ambiguous reachability a HALT with fail-closed exit codes, and Caliber C112 keeps the isolation installed. (Articles: foundational four-failures table; technical companion §3 walked example + §9.)

Claim IDs: E2-C001, E2-C002 Evidence level: fleet-codified (installed → enforced → exercised → outcome → fleet-codified) Access classification: Sanitized public excerpt

What this package proves, and what it does not

Proves: the close/promote/prune/deploy separation is real and each is its own command boundary (four-gate-contract.md); the prune gate is fail-closed with named exit codes, orders push before any destructive operation, and HALTs on ambiguous reachability (prune-exit-codes.md); the isolation is mechanically enforced by a Critical, no-grace Caliber criterion (c112-contract.md); and the whole control traces to a concrete incident whose three structural defects were eliminated rather than patched (incident-sequence.md).

Does not prove: that the original data-loss event can be re-triggered from this package — that was a one-time close-out of the Cure v2 blind-benchmark work recorded in the owner plan's failure narrative, not reproducible here. This package evidences a discipline/enforcement outcome on internal build tooling; it makes no claim about any production customer data (the destroyed commit was an internal canary commit in an internal canary app).

Source

Redaction statement

No secrets, credentials, private URLs, API keys, tokens, connection strings, or customer/staff/tenant identifiers appear in these artifacts. The sources are framework orchestration scripts, fleet contract/doctrine, scanner logic, and an internal engineering plan. Two incident-specific identifiers are retained because they are load-bearing and non-sensitive: apps/rentos-canary (an internal canary app, not a customer tenant) and cc1fc8a / 202cec2 (internal git commit SHAs). See manifest.json → redactions.

Reproduction