App Runtime Revalidation

apps/runtime-revalidation.tsv is the active Index and Kukulkan runtime

revalidation manifest. It maps each production workflow area to the real gate,

runtime artifact, production API source, and evidence mode that must be used

before app production readiness can be claimed.

This manifest does not replace running the app gates. It prevents the

normal path from drifting back to roadmap-status evidence, fake adapters, or

constructor-only claims while the lower runtime milestones continue.

Evidence Modes

• source-production-test: checks 0x0 production source and accepted corpus

tests without starting services.

• bounded-runtime-gate: executes a bounded local runtime command.
• bounded-loopback-runtime-gate: starts only local loopback processes needed

by the relevant gate.

• release-artifact-gate: checks release manifests, lockfiles, hashes, and

rollback metadata.

• static-deploy-gate: checks deployment manifests, scripts, image metadata,

service files, and runbook commands without contacting a cluster.

• release switch-artifact-gate: checks release switch, legacy archive, release candidate,

and production acceptance artifacts.

Runtime Areas

The manifest covers:

• Index document, extraction, rendering, file, browser, network, auth assist,

and package-release workflows.

• Kukulkan API routing, auth, database, idempotency, service adapter, and

observability workflows.

• Kukulkan UI template, WebSocket/live, browser bridge, accessibility, and load

workflows.

• Kukulkan image, service, remote deployment, rollback, backup, and restore

workflows.

• Legacy normal-path removal.

Every row must use fake_adapter_allowed set to no. Test-only fake adapters

may still exist as deterministic fixtures, but they are not accepted as

production revalidation evidence.

Gate

make app-runtime-revalidation-check validates the manifest, required workflow

areas, Makefile targets, artifact paths, documentation, release notes, roadmap

progress, ADR/RFC records, and removal of roadmap-status checks from the app

production-build gate. It does not run the full Index/Kukulkan app suite; that

remains part of the final release discipline gate.