Implementation is ready in MR !38. Local gates are green: make ci, make terraform-ci (including a credential-free mocked plan and policy checks), Playwright 14/14, and axe 8/8. An independent post-MR reviewer is now running; actionable feedback will be addressed in one cycle before merge. Real cloud-dev deploy/cold-start/rollback remains the explicit post-merge gate because the immutable Web digest is published only from mirrored main.

Implementation merged through MR !38 as no-ff merge db79ef8f5c9c89d88b6d50ac0d4909a88441e78f after an independent review cycle and exact branch-SHA CI success (7/7): https://github.com/urandon/sessionless/actions/runs/32475508340

The post-merge trusted-main run reached the real registry gate: build of all five images and GitHub→Yandex OIDC login succeeded, control-api published, then web-bff:db79ef8... failed closed on registry inspection with 403 Permission denied (request id 742b0da6-64b7-4835-8ec6-be551f18446b). Run: https://github.com/urandon/sessionless/actions/runs/32476618448

This is live foundation drift, not a safe publisher retry case: the merged Terraform adds the web-bff repository and repository-scoped publisher binding, but that foundation plan/apply has not been executed. The publisher must not skip the fifth image or weaken the immutable-tag guard.

The live gate remains blocked because the operator-owned CLOUD_DEV_BACKEND_CONFIG, CLOUD_DEV_TFVARS, CLOUD_DEV_IMAGE_TFVARS, deployment-lock coordinates, and authenticated Terraform state context are absent from the workspace/environment. I will not synthesize or apply an unmanaged state. Required continuation:

1. restore the external backend/tfvars and deployment-lock context;
2. run reviewed saved-plan foundation apply to create/bind the web-bff repository;
3. rerun exact main SHA db79ef8... and require all five immutable images + manifest;
4. generate digest tfvars, run reviewed saved-plan cloud-dev apply;
5. execute managed-host/OIDC/header/direct-invocation/cold-start smoke, digest-only rollback, and repeat smoke.

Issue #34 remains open until those live checks pass.

Live blocker evidence from trusted-main run 32496579324, merge SHA 5dc15453a640df0815544340104595af0bd23749:

The reproducible image gate and GitHub→Yandex OIDC exchange both passed. Registry-native publication successfully copied control-api, then failed closed on web-bff with Yandex 403 Forbidden while inspecting cr.yandex/crpou2pdlncghcfj5qrm/web-bff:<merge-sha>.

This confirms the committed WEB-05 foundation repository/IAM is not yet present in live cloud state. I am preparing a read-only scoped Terraform foundation plan before any apply.

Post-merge trusted-main CI for MR !40 reproduced the existing Web foundation blocker after all local/integration/reproducibility gates passed.

Evidence: https://github.com/urandon/sessionless/actions/runs/32505310082

• merge SHA: bf38f12e838f9613168fea04ae2a6da0585ce446;
• five-image clean-room reproducibility artifact uploaded successfully;
• GitHub→Yandex OIDC exchange and registry login succeeded;
• control-api immutable publication succeeded;
• web-bff:bf38f12... HEAD failed with 403 Permission denied;
• Yandex request ID: b603dd94-bb19-458f-9e23-720c81cdc962.

This continues to show that the Terraform declaration is present in main but the live cloud foundation (repository/IAM) has not been applied. Applying the reviewed #34 foundation remains the prerequisite for trusted-main five-image publication and the controlled cloud evidence phase of #42.

New exact-main evidence after REL-01 merge: https://github.com/urandon/sessionless/actions/runs/32513804398 at 0ef23e6dca44c465c3d476e3ce5a98dca4d89deb.

All repository, Web, YDB, Terraform, local multi-service, and five-image reproducibility gates passed. GitHub→Yandex OIDC exchange also passed. The only failure was Publish immutable deployment images; manifest/receipt were skipped and retained candidate cleanup succeeded.

This is the same live boundary blocked by the unapplied WEB-05 foundation. The GitHub job-log connector timed out twice, so no new provider request ID is asserted. The existing required continuation is unchanged: restore operator-owned backend/tfvars/deployment-lock context, review/apply the #34 foundation repository/IAM plan, then rerun exact main publication and proceed with digest-only Web apply/smoke/rollback evidence.

Post-merge CI evidence from #27 / MR !43:

• exact mirrored main SHA: 9c57e6219c4b49f0e9dd72bceaa0ae3b385de0f6
• run: https://github.com/urandon/sessionless/actions/runs/32539651755
• clean-room reproducibility for all five runtime images: passed
• Yandex OIDC exchange: passed
• immutable image publication: failed
• retained candidate cleanup: passed

GitHub does not expose the failed step log publicly without repository admin access, so this comment does not claim an unobserved error string. The failing boundary matches the already documented unapplied Web foundation prerequisite (exact web-bff repository/IAM). Keep #34 as the live foundation/application blocker; the #27 code/CI gates before publication are green.

Fresh post-merge evidence after MR !44:

• GitCode/GitHub main exact SHA: 6605f8a4e034484462880ea0085ce2eca4cda29f;
• CI run #147: https://github.com/urandon/sessionless/actions/runs/32552125116
• Go, Web browser, Telegram edge, Terraform, YDB, and Local multi-service stand: green;
• Runtime images passed the clean-room build stage and failed only at Publish immutable deployment images.

This is the same live-foundation boundary tracked here: the Web BFF repository/IAM resources from #34 have not yet been applied, so trusted-main immutable publication cannot complete. No new code regression was observed.

Fresh mirrored-main evidence from merge a2dd319279305dce40ea99880f0eef7366d638d5: GitHub CI run 32729570850 passed Web/accessibility, Go verification, Telegram Worker, Terraform, YDB, local multi-service stand, and clean-room runtime image reproducibility. Runtime images failed only at Publish immutable deployment images after reproducibility and Yandex OIDC exchange both succeeded.

The public API exposes the failing step but not its authenticated log, so the exact registry error was not available to this agent. This is consistent with (but does not independently prove beyond the step boundary) the known unapplied #34 foundation state for the web-bff repository/IAM. Do not rerun publication expecting a different result until foundation apply/evidence is completed.

Fresh post-merge evidence from dependency-security merge 643ab060fae0b05af6845dee5b40fa4f1910f218: GitHub CI run 32761178553 passed Go, Web/accessibility, Telegram Worker, Terraform, YDB, local multi-service stand, and clean-room runtime-image reproducibility.

The trusted Runtime images job failed only at Publish immutable deployment images after both reproducibility and Yandex OIDC exchange succeeded. The same step boundary and timing reproduced in the immediately preceding main run 32753246856, so this is not caused by the dependency-only MR !54.

The authenticated log connector did not return within a bounded wait; the public API exposes only the failed step. This remains consistent with, but does not independently prove beyond that boundary, the known unapplied Web foundation/repository/IAM state documented here. Do not rerun publication expecting a different outcome before the #34 foundation apply/evidence gate.