# Isolated public-candidate acceptance

The Gitea workflow `.gitea/workflows/public-candidate-acceptance.yml` moves the expensive release
proof off a developer workstation and onto a Docker-capable server runner. It is manual-only and
accepts an exact canonical commit SHA. It does not invoke `unraid-deploy.yml`, the deploy controller
or the production Compose project.

The job creates a curated public export, validates its content manifest, scans it with Gitleaks,
then creates a temporary parentless Git commit so release provenance describes the exact exported
tree. From that tree it:

1. builds API, Console, Node Agent and Runtime Worker images with OCI identity;
2. produces the release manifest, checksums, CycloneDX inventory and image provenance;
3. scans every exact image ID with checksum-pinned Trivy and rejects ambiguous reports or any
   HIGH/CRITICAL finding;
4. starts API, Console, PostgreSQL and Redis with the production overlay under a unique
   `modelforge-rc-*` Compose project;
5. uses newly generated secrets, loopback-only ephemeral host ports and project-scoped volumes;
6. proves liveness, readiness, version identity, Console serving and both sides of the operator
   authentication boundary; and
7. always removes the temporary containers, networks, volumes and four candidate image tags. An
   independent `if: always()` workflow cleanup repeats the exact project-label cleanup after a
   failure, cancellation or timeout; it never runs a host-wide Docker prune.

No Node Agent or Runtime Worker is started by this clean-install gate. Consequently it creates no
compute identity and cannot interact with the production GPU node. A later GPU qualification must
enrol a disposable `rc-canary` identity with `production_eligible=false` and retain that separate
evidence.

After the workflow exists on the default branch, dispatch it directly and enter the exact pushed
commit. Before merge, dispatch the existing **Managed validation** workflow on the candidate branch
with profile `build`; that profile calls the same acceptance workflow with `gitea.sha`. Use the
actual intended Console API origin for a publishable artifact; the managed-branch route uses
`https://modelforge.example.test` and therefore produces non-publishable infrastructure rehearsal
artifacts. Evidence is retained for 90 days. A failed scan or install is evidence of a blocker, not
permission to bypass the gate.