chore: Track 2026-08-08 core/template audit gaps: capability-aware policy (#11) and template release (#12)

[Nickfost]

Audit baseline

This tracks the confirmed public-template follow-up from the 2026-08-08 core/template compatibility audit.

Reviewed heads:

• template: e483998b34595e51426c3b14589a74ca09ae78a9
• core: b76aefe668f07904e1a782fa5b779b606d6a44c9

Both current-main validation suites pass. The template is internally consistent at its older reviewed schema-v3 contract and its immutable example engine pin is reachable from core main. The confirmed gaps are about truthful deployment capabilities/role isolation and the absent release/freshness lifecycle, not a reason to replace an immutable pin with a moving ref.

Confirmed gap issues

Dependency order:

1. feat: Model GitHub plan capability and isolate privileged deployment roles in fleet.json policy #11 — make deployment policy capability-aware and isolate privileged roles. Design input comes from core deployer/tester issues #22/#23; the minimum truthful documentation/schema boundary can land before those installers.
2. feat: Publish tagged template release and machine-readable core compatibility/freshness signal #12 — publish a real template release and exact core compatibility signal. It must include or explicitly defer feat: Model GitHub plan capability and isolate privileged deployment roles in fleet.json policy #11 before advertising the template as a complete delivery contract.

Core dependencies and cross-links:

• worker-host convergence remainder: feat: Add idempotent install-host.sh to enroll and manage CI fleet Docker hosts ci-fleet#21
• deployer role: feat: Add idempotent install-deployer.sh for the separate CI deployment control plane ci-fleet#22
• persistent tester role: feat: Add idempotent install-tester.sh for persistent test environment hosts ci-fleet#23
• operator workflow documentation: docs: Complete operator-workflow docs: role quickstarts, landing index, and truthful stale-content cleanup ci-fleet#24
• naming owner decision: Evaluate renaming ci-fleet for the expanded delivery scope ci-fleet#25
• GitHub App/runner-group bootstrap: feat: Add Bash bootstrap-github.sh to automate GitHub App and runner-group provisioning ci-fleet#27
• managed-image reproducibility: feat: Pin managed image base images and package inputs by digest for reproducible pinned-engine rebuilds ci-fleet#36
• local-only capacity telemetry: feat: Record per-runner and host utilization telemetry to drive max_runners and pool-budget capacity decisions ci-fleet#50
• separately authorized status-receiver deployment: feat: Deploy authenticated status receiver on isolated host and activate controller outbound HTTPS reporting ci-fleet#66

User/operator impact

Without #11, GitHub Free/private adopters can be promised an unavailable approval mechanism and privileged roles remain descriptive rather than machine-isolated. Without #12, no adopter can execute the documented tagged-release baseline and no exact signal says which core/template pair was reviewed together.

Bounded scope

This issue only coordinates #11 and #12 and records their dependency order. Implementation and acceptance remain in those distinct issues.

Non-goals

• No source changes are requested in this tracker itself.
• No live GitHub Environment, runner group, credential, host, deployment, status receiver, or consumer-repository change.
• No project-specific delivery policy in the public template.
• No rename decision; core #25 remains owner-controlled.
• No mandatory telemetry.

Cross-repository compatibility

The template must remain schema-v3 compatible with explicitly reviewed core commits, preserve ordinary-CI/tester/deployer/ref-writer boundaries, and retain immutable exact pins. Core #24 owns the public operator index; this tracker owns only the template side.

Acceptance criteria

• feat: Model GitHub plan capability and isolate privileged deployment roles in fleet.json policy #11 is resolved with capability-aware, tested role separation or an explicit safe versioned exclusion that removes overclaims.
• feat: Publish tagged template release and machine-readable core compatibility/freshness signal #12 is resolved with a real immutable release, tested adopter update flow, and exact compatibility metadata.
• Core #24 links the final template release/update path.
• All fictional examples and validation remain Linux/Bash-only, secret-free, and free of private infrastructure inventory.
• Final current-main validation passes in both repositories.

Validation

Use the repository checks required by #11 and #12, plus an exact-commit comparison against the core compatibility record. No live deployment or infrastructure proof is part of this tracker.

Parallel-safe work

• Core #36 and #50 are independent of feat: Model GitHub plan capability and isolate privileged deployment roles in fleet.json policy #11.
• Core #21 and #27 can proceed while feat: Model GitHub plan capability and isolate privileged deployment roles in fleet.json policy #11 defines only capability/role policy, but the template must not invent their runtime interface.
• Core #66 live deployment is independent and remains separately authorized; its public contract evidence can inform feat: Publish tagged template release and machine-readable core compatibility/freshness signal #12 without activating reporting.