# Waldur Project source migration The agreed source owner is Beto Project. The Go implementation adapts ikons' qualified producer at [`39e5221cd`](https://github.com/pharos-ai-factory/pharos-platform/tree/39e5221cd8cbb086da3dde89cd33662fbda78fd5). Its original qualification remains evidence for that implementation and release. It does not establish qualification of this Beto composition. ## Commit provenance | Original commit | Treatment | | --- | --- | | `14a46e4c911bff1ebd2696bb7ef541f8598664b1` | Cherry-picked with `-x`, preserving ikons' author. Login code is unchanged; the changelog conflict retained both applicable entries. | | `3636595ff693befcdf0bb12ba6482be865a3e41b` | Source acquisition, durable notice/refresh recovery, complete reads, replay and test scenarios adapted into Project-owned Go ports/adaptors. Waldur administration and TLS infrastructure extracted separately from the original Metallo context and deployment wiring. | | `c0a34596b5a7c7f25fd9bd85413f4259985864d1` | Preserve API-container administration with the TLS sidecar. | | `064e674bd433e6b889733b5bea5eb5eb208d13fc` | Preserve published trust and validate restored authority/key consistency. | | `a7bdc0b47c73dbdc2f7c3f3c090ac40578f89b4e` | Use the scoped registration management service port. | | `2626868fd0849bda0c55050a1042300a956f7383` | Enable native role publication and preserve the distinction between native notice delivery and periodic reconciliation. | | `0845b5c44a15a1a1838b6d5fa050b56d8e999935` | Retain configuration-checksum rollout for API, worker and beat in the patched Waldur 8.1.3 chart. | | `179c35447` | Qualification inspects the actual public Protobuf payload rather than a private intermediate value. Beto's broker lane checks its canonical payloads. | | `22ba9392d`, `39c55cd96`, `87d8fe2d5`, `39e5221cd` | Referenced design, seed and qualification evidence; ownership and runtime instructions rewritten for Beto. | Adapted commits cite their original sources and retain `Co-authored-by: ikons `. The source branch had no associated PR at the reviewed head; commit references provide the original provenance. ## Preserved and extended qualification scenarios | Behaviour | Beto evidence | | --- | --- | | Scoped complete REST reads | Project Waldur adaptor tests: customer scope, complete pagination/counts, duplicate/foreign/partial replies, stable repeated membership/metadata reads and explicit member bound. | | Native intake | Real RabbitMQ TLS/STOMP lane with Waldur 8.1.3 headers: verified hostname/CA, receipt before ACK, refusal/redelivery, invalid notice quarantine, distinct grant/revoke/regrant receipts and restricted queue permissions. | | Durable recovery | Real Project PostgreSQL tests: source uniqueness, fenced claims, concurrent/duplicate notices, receipt conflicts, rollback, acquisition-identity reuse and replay cursor. | | Public delivery | Real RabbitMQ composition tests inspect canonical payloads and independent observers; transport identity and scope remain enforced. | | Freshness and canonical identity | Unchanged complete reads preserve Project revision while renewing source evidence. Exact retry and replay never renew it. Unknown/retired Party bindings cannot grant access; late resolution cannot restore removed members. | | Provider trust | Original authority-preservation tests and restricted same-Pod Nginx TLS smoke retained with Beto-scoped runtime wiring. | The source `ProjectAccessObserved` contract is provider evidence. This branch publishes canonical `ProjectChanged` and `ProjectAccessChanged` instead. It adds separate complete-read evidence, current Party checks and source scope/generation fencing. Empty membership, inventory absence and ambiguous provider failures cannot establish Project deletion. Native closure and fulfilment remain deferred. RabbitMQ's STOMP delivery identifier changes after reconnect. Waldur 8.1.3's `x-message-id` hashes the payload, so distinct occurrences can share it. Receipts therefore deduplicate deliveries within their transport identity; reconnection may schedule a redundant complete read. The source transport lane uses a failing in-memory receipt sink; the PostgreSQL lane separately qualifies durable receipt/refresh transactions. ## Verification — 20 October 2026 The implementation through `96ef35b2c` passed `pnpm verify` and `pnpm test:integration` in a clean checkout. The latter qualified disposable PostgreSQL/RabbitMQ, all service images, authenticated API-to-Beto queries, session/realtime behaviour and Chromium. The dedicated native PostgreSQL, assembled Project broker and TLS/STOMP source lanes also passed. The provider TLS smoke exercised restricted same-Pod Nginx. Regression tests cover first acquisition racing query authorisation and hyphenated customer UUID enrolment. These results qualify the implemented boundaries; the live provider and deployment checks below remain outstanding. ## Registration and deployment gates Registration targets `app: beto`, namespace `pharos`, Secret `beto-project-source` in the dev-box overlay. The Go worker retains STOMP 1.2 with verified TLS; notices request complete reads through Project's REST port. Provider administration owns registration, credentials and queue scopes. Runtime receives no administrator credentials. Acquisition remains disabled by default. Before enabling it: 1. Qualify the selected Waldur 8.1.3 chart, registration and restricted reader together with retained Themelio login/AUP, account writer and real AAI users. 2. Enrol the exact installation/customer, provider trust, Party proof/bindings and query caller scopes. Unresolved provider accounts remain without canonical access. 3. Stop any former Metallo Project/member reader for that source scope and retain its pending/replay evidence. There must be one acquisition owner per scope. 4. Exercise native role grant/removal, restart, source outage, lost responses, late Party resolution and replay against the real provider. 5. Establish the end-to-end freshness/revocation budget. A configured scan interval alone does not establish a bound. ### Live source qualification — 20 October 2026 dev-ikons at `37fcbe6a7`, acquisition disabled, real AAI users Alice and Bob: [`dx/beto/project-source/qualify.py`](../../../../dx/beto/README.md#waldur-project-source-qualification) passed. Registration reused the existing Waldur consumer queue and wrote `beto-project-source`. Native grant/revoke/regrant notices, verified STOMP TLS, queue-scoped reader permissions, complete paginated reads and a read-only PAT held against Waldur 8.1.3. Observations for the Project design: - Deletion is soft. The Project leaves the customer inventory, while its detail read returns HTTP 200 with `is_removed: true`. Waldur publishes `role_revoked` for each remaining member. - Grant and regrant notices have byte-identical bodies. - Notices carry `email`, `full_name` and `user_username` besides the identifiers. This covers only the source parts of gates 1 and 4: chart, registration, restricted reader and native grant/removal. Themelio login/AUP, the account writer, Party bindings, restart, outage, replay and freshness remain for the end-to-end run. No shared environment is deployed by this change. Live Waldur/AAI, retained browser/UAT, Minikube/k3s, NetworkPolicy enforcement and production rollout require their own recorded qualification. Metallo production consumer wiring remains a subsequent slice. Waldur 8.1.3 is the sole supported provider release for this pre-production platform.