[acamarata]

Rows D-0697, D-0701, D-1217, D-0778, D-0824 (cli part). D-1216 is not changed.

Per row

• D-0697 internal/deploy/pintest.Home (already used by the controlplane and cmd/commands tests) returned t.TempDir(), which is 0775 under umask 002 and is itself the refused ancestor. It now chmods the dir 0700. New test sets umask 002 and fails before the fix. The named controlplane tests and TestE487HintEnrollThenDeploy pass under umask 002 (they failed before).
• D-0701 CaptureSourceManifest now reads docker compose ps --all next to the images listing (when images rows carry no service) and replays it, so the compare step no longer lists containers live. Test fails before. Reworded the gosec nolint in deploy_promote.go; added a Windows note to .github/wiki/cmd-deploy.md. The Windows local runner argv form is not done (docs note only).
• D-1217 Golden contract test: three real ci evidence verify --json outputs (plugins 076f5063, ci 1.2.13) in verify/testdata, fed through checkEvidence. Not done: matching digests to service names. The manifest Artifact.Name is an operator-declared artifact name, not defined as a compose service, and the manifest contract is experimental until P8, so that needs a contract decision. The release-class golden is a real plugin report for a document edited to kind: release (exit 11), since a passing release run needs a container executor.
• D-0778 sameNames is false when either set is empty; checkFrontForeign refuses E485 and frontPrunable keeps the file. Table + behaviour tests. An existing test (TestFrontPruneOnlyOwnShipped) pruned a file with an empty recorded set; it now records a real server_name.
• D-0824 guardedScript exit status (rc=1 on any failed act); build context base dir = first compose file; checkMounts requires a destination at/under /etc/nginx; clearScratch refuses symlinked .nself / .nself/deploy-build; rm -f the .new path before the redirect; cert find treats only a missing dir as empty; prune script rechecks the server_name set (same set as serverNameSet) and prints KEPT on mismatch. Each has a test that failed before. Not done: server_name recheck at rollback (needs the set recorded in the deploy record, a state schema change); the .env.<env> snapshot in the interpolation manifest is a product decision.
• D-1216 not changed: owner decision (trust-on-first-use vs require the pin).

Commands

• go build ./..., go vet ./internal/deploy/... ./internal/controlplane/... ./cmd/commands/ clean
• go test ./internal/deploy/... ./internal/controlplane/... ok
• go test ./cmd/commands/ ok
• umask 002; go test ./internal/deploy/pintest ./internal/controlplane ok (and the cmd/commands named test)
• golangci-lint is not installed on this worker, so lint was not run.

[acamarata]

Rebased onto origin/main and extracted front-check helpers (sameNames, hasBuildMarker, serverNameSet, frontPruneBody, frontConfMax) from internal/deploy into a new internal/frontcheck package to bring the deploy package under the 6667-line ceiling. TestPackageSizeBudget and TestGofmtClean now pass; full module tests green.