[andrescera]

What

• Log stage=held-policy for reason=first_party_held_back.
• Keep stage=simulation for an apt-mark showhold command failure.
• Add a real-discovery regression that checks the production JSON journal output,
  and document the distinction in the backend README and discovery contract.

Why

A held first-party package is a policy refusal, not a failed simulation command.
Previously both appeared under stage=simulation, so stage-only journal readers
could not distinguish them. Reason, step, exit/detail fields, deduplication,
redaction, update admission and installation behavior remain unchanged.

This is a post-release follow-up, rebased onto released main 7c076c15.
The single rebased commit is dcb6d469ed900247ccf1e2599ebe668ff84fa20d.
Stable patch IDs match the independently approved original both with default
context and with -U0; no semantic changes or conflict resolutions were needed.

How to verify

• From apps/backend, run bun test src/tests/apt-all-journal.test.ts and
  bun test --parallel src/tests/update-orchestrator*.test.ts.
• From the repository root, run bun run --filter backend test, bun run lint,
  bun run test:release-package-contracts, bun run check:rc-pins, and
  bun run --filter backend check:exec-guard.
• Run all four VITEST_SHARD=N/4 bun run --filter frontend test:ci-shard lanes,
  merge with bun run --filter frontend test:ci-merge, and run the existing
  tech-debt, spec, workflow-shape and hardware-preflight guardrails.
• Build with BUILD_ARCH=amd64 bun run build:backend and
  BUILD_ARCH=arm64 bun run build:backend, plus the existing production frontend,
  poisoned-environment and bundle-budget gates.
• Local results: backend 10824 pass / 4 existing skips / 0 fail; focused
  orchestrator 651 pass; frontend 7275 tests in 435 files pass. Both architecture
  builds, package contracts, lint/typechecks and guardrails pass.
• The rootful UID-routing gate could not start locally: sudo -n requires a
  password. It remains required on an authorized runner. An extra serial
  orchestrator sweep had three notification-isolation assertions fail; both
  affected files passed alone and the normal worker-isolated sweep passed
  unchanged. Do not treat that extra serial run as green.
• Require green hosted CI and acceptance of the carried independent review on
  this exact head before merge. No UI or packaging files changed; browser E2E
  was not rerun locally for this diagnostic-only follow-up.

Risks

• RR-1: an external stage-only filter that previously caught held refusals through
  stage=simulation must also recognize held-policy. No such consumer was
  found by the independent review in the repository, docs or board kits.
• Existing reason=first_party_held_back and step=held-packages filters remain
  valid. Recovery/query independent of stage:
  journalctl -u ceralive.service -o cat | grep '"reason":"first_party_held_back"'.
• This changes journal metadata only: no RPC/schema, UI copy, package-selection,
  installation or safety-policy change. Host tests and cross-compilation do not
  establish installed-board qualification. The local rootful prerequisite
  blocker must not be mistaken for complete CI parity.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 51d0018e-8fd9-4e6c-87b4-0316faa712ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}