# Private Health V5 release-candidate publication

Use when a health-dashboard candidate already has broad green evidence and the task is limited to review, one final commit, push, exact-SHA artifact generation, private V5 deployment, and read-only acceptance while V4 remains frozen.

## Scope freeze

- Inventory tracked and untracked files before staging. Stop on any file that cannot be assigned to the release.
- Preserve already-published commits: no squash, amend, reset-hard, or force-push.
- Freeze migrations, data sources, medical semantics, navigation, and redesign. A release blocker gets only the smallest correction plus causally affected tests.
- Treat shared server/read-API/assets as V4-sensitive even when their names do not contain `v4`.

## Efficient evidence reuse

1. Record the last broad Python/browser/static evidence and its candidate time.
2. Compare file modification/diff history after that evidence.
3. Rerun only tests covering later changes, changed-file AST/JS/shell syntax, `git diff --check`, and a short added-lines security/medical scan.
4. Run at most the bounded RC browser group when relevant UI or its fixture changed.
5. Do not claim the earlier matrix covers a later tree; list reused and newly executed evidence separately.

## One-commit publication gate

- Prove authenticated non-force push capability before creating the sole final commit.
- Stage an explicit path allowlist including untracked documentation.
- Require no unstaged or untracked residue, then record the staged tree hash and run cached diff checks.
- Create exactly the requested commit, push normally, fetch, and prove local `HEAD == origin/main` with ahead/behind `0/0` and a clean tree.

## Exact-SHA artifact and private runtime

1. Require clean Git and local/remote SHA equality before generation.
2. Hash the protected V4 artifact before any runtime write and stop on mismatch.
3. Generate V5 twice from the pushed checkout with the same explicit local day, generation timestamp, and **the exact full profile/feature flags used by the production worker's regeneration command**; require byte-identical hashes. A byte-identical minimal/default build is not release evidence when the deployed worker regenerates a richer profile.
4. Create owner-only rollback copies of the prior V5 and every runtime source to be replaced.
5. Atomically install only V5/shared files whose Git blobs belong to the published commits. Never regenerate or copy V4.
6. Write an owner-only runtime identity sidecar containing Git SHA, build ID, generation time, profile, and artifact SHA-256.
7. Before restart, prove each installed runtime source is byte-identical to the pushed checkout and the V5 artifact hash matches the sidecar.
8. Restart only the explicitly authorized dashboard service, then verify active state, new start time, listener owner, interpreter, zero restart loop, and exact runtime identity.

## Read-only private smoke

- Verify unauthenticated V5 and API requests return `401`, authenticated V5 returns `200`, and V4 returns `200`.
- Check `no-store`, CSP, `nosniff`, browser-session bootstrap, Origin, and CSRF contracts without submitting a productive action. For the Health V5 session contract, obtain the one-time CSRF token from the rendered meta tag, send it with the matching `health_browser_csrf` cookie, and expect a successful bootstrap to return `204` plus the session cookie—not `200`. Parsers must accept the template's actual quote style without ever logging the token.
- Make every compound smoke harness fail-fast (`set -e` or checked child exit codes). Capture and compare DB/queue sentinels only after the child probe itself succeeded; never print unchanged/success markers after a failed assertion.
- Exercise Today and open/close capture only; calendar/day with an aggregate symptom-surface assertion; nutrition/reference view; document center; desktop, 390 px, 200% text, and keyboard focus.
- Collect only aggregate browser evidence: console errors, page errors, unexpected request failures, external origins, overflow, and visible-surface counts. Do not log health text, filenames, document names, IDs, or screenshots.
- Classify `net::ERR_ABORTED` caused by deliberate reload/back navigation separately from unexpected request failures; require the latter to be zero.
- Keep temporary Playwright spec/output outside the final candidate and delete repository-local `test-results` residue.
- Finish with SQLite `mode=ro`, `query_only`, `integrity_check`, and `foreign_key_check`; re-hash V4; re-prove V5 hash, runtime source equality, service state, local/remote SHA equality, and clean Git.

## Reporting

Return only: local/remote SHA; the newly published commits; clean-tree state; rerun versus reused evidence; build ID/hash/time/profile; service start/status; aggregate private-smoke results; DB integrity; V4 hash/reachability; private V5 URL; and P0/P1 blockers. Stop for manual acceptance and do not begin the next sprint.