Epic: Local-first NetRatel: setup, identity, scoped access, integrations, branding and RC

[boston-ai-agent]

Programme

Deliver a self-hosted, local-first NetRatel while preserving existing PostgreSQL/OIDC installations, native Client connectivity, dependency baseline, approved branding defaults, and release-provenance safeguards.

Execution rules

Each numbered phase has a separate issue and CI-gated PR to main. The implementation ledger is maintained in docs/implementation/local-first-progress.md; issue and PR links, merge SHAs, exact validation evidence, and blockers are updated per phase.

Phase ledger

• P00 — PR #43
• P01 — PR #44
• P02 — PR #45
• P03 — PR #46
• P04 — PR #47
• P05 — PR #48
• P06 — PR #49
• P07 — PR #50
• P08 — PR #51
• P09 — PR #52
• P10 — PR #53
• P11 — PR #54
• P12 — PR #55, PR #56, verified v0.1.0-rc.3

Completion

All phases are merged to main through CI-gated pull requests. One immutable prerelease was published and independently verified from the integrated tested commit. Detailed final evidence is recorded on P12.

[boston-ai-agent]

P00 completed: PR #43 merged as 35d23b2fb49e91d2389d04bd3c6966210807138a; exact-head Public PR validation is fully green. Proceeding with P01.

[Proxicon]

P01 is merged: PR #44, merge commit fcd202d. Evidence is the all-green hosted validation run https://github.com/BostonTechnologies/netratel/actions/runs/35494345483, including source and release-image generic OIDC Compose smoke coverage. Proceeding with P02 (#32).

[Proxicon]

P02 is complete: native local identity foundation merged via PR #45 (bd567c091cc0efe8f4d63d253aaee6180dd01d8f). Hosted validation run 35495761003 passed all required checks, including both generic OIDC Compose compatibility paths. P03 scoped RBAC is next.

[Proxicon]

P03 is merged via PR #46 (1969e9aea3c9e12aa492120c4b3452f8e9e7bc9c). CI run 35500498475 passed all required checks, including full .NET validation and source/release-image generic-OIDC Compose rehearsals. Moving to P04 (SQLite support while preserving PostgreSQL).

[Proxicon]

P04 is merged: PR #47, merge commit e0225697e0bc21bb8f939ef9595014ee9dc59117. Exact-head hosted validation run 35503965482 passed, including source and release-image generic OIDC Compose preservation smokes. Advancing to P05.

[Proxicon]

P05 guided setup, local login, unattended initialization, and deployment-admin recovery merged through PR #48 at 5de08326af0f0ee1159a2ce9c19e44f4f96bcd67. Hosted evidence: https://github.com/BostonTechnologies/netratel/actions/runs/35509225124 (full .NET, local-first browser Compose, source OIDC Compose, and release-image OIDC Compose all passed).

[Proxicon]

P06 complete: #36 closed via PR #49, merge 2bc881d. Hosted exact-head evidence: Public PR validation 35511238938 passed all gates, including local-first and source/release-image OIDC Compose smoke.

[Proxicon]

P07 complete — scoped CLI and stdio integration credentials landed via PR #50, merge 863ac40748072b70935483d9f870281db683287e. The CI-gated evidence run passed every required check, including OIDC compatibility and local-first browser Compose validation: run 35521471258.

[Proxicon]

P08 is merged: PR #51, merge ea6d6eeb396af089aa8876cfaee6c6a3f81297d7. Exact-head run 35524074101 passed all 16 checks, including Release .NET, HTTP MCP image, local-first browser, and retained source/release-image generic OIDC Compose validation. P09 is next.

[Proxicon]

Ledger update: P09 / issue #39 merged through PR #52 at f84732594b168b034d64428a997ab91596da2052; exact-head 16-job run https://github.com/BostonTechnologies/netratel/actions/runs/35529053598 passed. P10 / issue #40 is next.

[Proxicon]

Ledger update: P10 is complete via PR #53, merged as 73b5790. Exact-head CI run 35535685943 passed all protected checks, including first-paint browser and source/release-image OIDC smoke coverage. Next: P11 documentation and API reference #41.

[Proxicon]

Ledger update: P11 is complete via PR #54, merged as b942a72. Exact-head CI run 35536764306 passed all protected checks. Next: P12 integrated validation, release preparation, and verified prerelease publication #42.

[Proxicon]

P12 checkpoint and external publication blocker:

• Release-preparation PR #55 merged as 65750980b59b187dd7a4218ae8ffd3903cee301c after all 16 protected checks passed: run 35537639456.
• Immutable v0.1.0-rc.2 points to that exact commit. Its tag workflow run 35538199670 passed source validation, all release archives/SBOMs, Linux/Windows/macOS Client packages, all final images, HTTP MCP smoke, and the release-image OIDC/enrollment/Client/CLI/MCP Compose smoke.
• The receipt binds all 11 required assets to run 35538199670, attempt 1, exact artifact IDs and ZIP digests. The repository's authenticated non-publishing promote-release.py preflight re-downloaded those artifact IDs, validated every file and checksum, and produced the clean staged release set for 0.1.0-rc.2@65750980b59b187dd7a4218ae8ffd3903cee301c.

Publication cannot proceed safely: the authorized GitHub identity gets HTTP 403 (You need at least read:packages scope to list packages) from orgs/BostonTechnologies/packages?package_type=container. The promotion safeguard requires that authenticated inventory before it can establish ownership/visibility of netratel-{api,web,migrations,mcp-http,client}; anonymous absence is explicitly insufficient. No OCI image was pushed, no package visibility was changed, and no draft or public GitHub release was created.

To resume: use an authorized BostonTechnologies credential with at least read:packages for the ownership/visibility preflight and the separately authorized GHCR publish capability for the immutable version/commit-qualified image tags. Retain the existing tag, receipt, preflight state and staged inputs; do not move the tag or rebuild/substitute artifacts.

[Proxicon]

Programme complete. All P00–P12 issues are closed. The final evidence is recorded on P12 #42: v0.1.0-rc.3 is a public, immutable, non-draft prerelease with verified assets, provenance manifest, and public GHCR deployment images.