feat(mesh): establish provider-neutral compute mesh control plane

[KooshaPari]

Summary

• define BytePort ownership of the provider-neutral compute mesh control plane
• add owner-scoped desired-state validation and persistence boundaries
• document execution-substrate/provider separation
• pin the Go toolchain and align security governance

Validation

• GOTOOLCHAIN=auto go mod verify passes in a clean detached worktree
• BytePort pilot on 80bfa769: GET /api/v1/health returned 200; authenticated workload create returned 202; subsequent list/readback preserved the requested placement metadata
• focused placement tests pass: go test ./internal/application/meshworkload and go test ./internal/infrastructure/http/handlers
• cargo deny check advisories passes. RUSTSEC-2026-0194/-0195 are explicitly bounded in deny.toml: they are transitive through Tauri/plist, BytePort does not parse user-controlled XML, and upgrading to plist 1.10 (quick-xml 0.41) would raise the app beyond its declared Rust 1.77.2 MSRV. Re-evaluate when Tauri/plist can upgrade without that MSRV break.
• CI Go test/build/vet are green on the current head; local Go 1.25.12 acquisition was not required for that evidence

Pilot handoff

• BytePort health and authenticated desired-state create
• placement persistence/readback
• complete PhenoCompose -> BytePort -> NanoVMS runtime handoff
• clear remaining CI/lint/advisory gate failures

Current gate snapshot (2026-07-16)

• Head: 80bfa769; PR remains draft/open/mergeable.
• Green: SBOM, Doc Links, secrets scan, cargo-deny, E2E, cross-compile, Security Scan, Quality Gate, Rust CI; CI Go vet/test/build/golangci jobs.
• Failing: CI Go-fmt advisory and pre-commit; standalone Lint (golangci); these are repository-wide baseline findings.
• The live control-plane pilot is evidence only; the NanoVMS runtime handoff and full gate closure remain outstanding.

This is intentionally a draft while the cross-component pilot and full CI gates complete.

Stability audit (2026-07-18)

• Head is now cf72d60b (artifact reference bounds/control-character validation plus regression tests).
• New validation applies before persistence/provider adapters; no credentials or provider state are introduced.
• Actions for cf72d60b are still running; this snapshot is not a replacement for terminal CI evidence.

Superseding gate snapshot (2026-07-19)

• Head: cf72d60b; fresh Actions runs are active.

• The prior 2026-07-16 gate list is historical; do not infer current terminal status from it.

• The first artifact-reference regression-test commit exposed a missing brace and was corrected before this head; current CI is the authoritative syntax/test check.

• Current CI failure detail: pre-commit only proposes a final newline in an unrelated existing worklog; Go-fmt advisory reports broad existing formatting drift. Mesh package tests/vet/lint pass on cf72d60b.

Persistence hardening (2026-07-19)

• Head: b8436a2.
• DeploymentStore.Save now revalidates the complete mesh request at the persistence boundary.
• DeploymentStore.List rejects corrupt persisted composition digests/artifact references rather than returning unverifiable desired state.
• Focused tests cover invalid direct-save input and corrupt readback.
• Idempotency remains an explicit follow-up: the current deployment schema has only generated UUID uniqueness and no idempotency key; adding a natural uniqueness constraint would alter existing deployment semantics, so no speculative deduplication was introduced.
• Current head Actions were still running at snapshot time; terminal CI remains required.

Five-day status

• PhenoCompose chore: pin GitHub Actions to commit SHAs #107 is blocked for code updates while its repository is archived; unarchive is required before digest-handoff and renderer fixes can be published.
• NanoVMS fix(cargo-deny): add RUSTSEC-2024-0436 ignore (paste via tauri) #112 is visible on GitHub web as Draft/open (latest branch commit 3040734), while the connector returns 404 for the same PR/branch; treat that as an integration visibility mismatch requiring reconciliation.

Terminal CI result (2026-07-19)

• Head b8436a2: Security Scan, Rust CI, Cross-Compile, E2E, SBOM, secrets-scan, cargo-deny, Quality Gate, and Doc Links passed.
• Main CI remains red only for pre-existing Go-fmt advisory drift and pre-commit's unrelated worklog newline; Go test/build/vet/golangci passed.
• Standalone Lint remains red on 49 pre-existing errcheck/staticcheck findings (none in meshworkload).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[sonarqubecloud]

Quality Gate failed

Failed conditions
5.1% Duplication on New Code (required ≤ 3%)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

[github-actions]

Legacy Tooling Scan Report

Severity	Count
Critical	0
High	0
Medium	0
Low	0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.