DEN-3475: replace metadata-only client consumers with executable frozen-install canaries #35

Recovery boundary — 2026-09-02

zed-pkg/.github/.github/workflows/nightly-clients-fleet-hardening.yml is the sole 03:00 America/Chicago scheduler. Do not restore a timer in this test organization. This issue owns the consumer evidence that the production scheduler currently lacks.

Current blockers to preserve honestly

• current-tip Zed resolution remains fail-closed until a protected ZED_PKG_TOKEN or public package authority can resolve every required immutable dependency;
• zed-pkg/zed-clients#54 intentionally rejects the repository's one-line placeholder .zpkg.lock; never hand-author a lock to turn the matrix green;
• the historical fleet runs identified missing paired organizations and metadata-only consumers; a parsed manifest or zero-test command is not executable certification;
• a scheduled/manual run against an old workflow head cannot certify current zed-pkg/.github@468baa1105d5529e36a41ada3697d88aa8366991 or current Zed CLI/API/interfaces tips.

First executable test-org tranche

Create independent consumer contracts for at least these existing repositories:

• node-app, node-lib, and polyglot-node-app;
• rust-app and rust-lib;
• go-app and go-lib;
• dart-app and dart-lib;
• java-app, kotlin-app, swift-app, gleam-app, and erlang-app.

Each must contain non-generated application/library source and at least one semantic assertion against an installed client API. It must install through the current Zed CLI from a resolver-generated immutable lock, verify package/artifact/tag/commit/checksum provenance, compile/test with the native toolchain, run once with the network unavailable after cache fill, and fail on lock drift, missing target, wrong source, checksum mismatch, traversal, redirect/credential replay, or API-surface mismatch.

Peer-authority contract

Where a client exposes schema-generated types, consume the independently authored TypeSpec and JSON Schema/OpenAPI products, normalize their symbols/types/SQL metadata, and stop on discrepancy. Any Diesel/SeaORM model in a consumer fixture must be independently checked, not generated from one ORM and copied into the other.

Scheduler replay gate

After the public/protected registry path is healthy:

1. mint/store the least-privilege package token only in the production scheduler repository; never copy it into test repositories or logs;
2. run the sole current-head scheduler with a bounded organization override and apply=false first;
3. require real discovery, current-tip toolchain assembly, full pagination, paired-org classification, executable consumer jobs, immutable artifacts, and a terminal summary distinguishing pass/fail/blocked/skipped/unverified;
4. only then run apply=true for deterministic reversible changes;
5. deduplicate follow-up issues/PRs and never auto-publish or fabricate APIs/locks.

Missing paired organizations

Re-verify the formerly absent seven pairings against current GitHub state. Create no organization merely from the August list; for each still absent, require an organization-admin owner, canonical production org match, non-collision proof, bootstrap policy, and at least one executable consumer plan.

No secret, organization, package, lockfile, branch, publication, or scheduler run is created by opening this issue.