prometeu-studio/docs/packer/pull-requests/PR-10-versioning-migration-trust-and-production-gates.md

PR-10 Versioning, Migration, Trust, and Production Gates

Domain Owner: docs/packer

Briefing

Finish the production track by hardening the packer against version skew, corrupted inputs, and unsupported artifacts, while installing CI and integration gates for the standalone project.

This PR closes the packer implementation wave with production readiness checks rather than new feature surface.

Objective

Deliver explicit version checks, migration ownership behavior, trust-boundary enforcement, and production test gates for prometeu-packer and its Studio integration path.

Dependencies

• ./PR-09-event-lane-progress-and-studio-operational-integration.md
• ../specs/6. Versioning, Migration, and Trust Model Specification.md
• cross-domain reference: ../../studio/specs/4. Assets Workspace Specification.md

Scope

• implement explicit version checking across:
  • asset.json
  • index.json
  • packer-owned cache/control schemas
  • assets.pa writer-side contract surfaces
• implement supported-window failure behavior and migration reporting
• enforce conservative trust checks before parse, validation, mutation, and build
• add CI gates and end-to-end fixtures for:
  • read flows
  • mutation preview/apply flows
  • doctor
  • build
  • Studio adapter integration
• consolidate operational docs and production readiness notes for the packer project

Non-Goals

• no plugin system
• no artifact signing strategy
• no remote registry or shared-cache product surface

Execution Method

1. Add version and migration checks to all packer-owned artifact boundaries.
2. Make unsupported-version and migration failures explicit and structured.
3. Add end-to-end integration fixtures that exercise the standalone packer with the Studio adapter path.
4. Install repository gates so production regressions fail before merge.

Acceptance Criteria

• unsupported versions fail early and clearly
• migration attempts and failures are visible to Studio and CI
• packer trust boundaries are enforced before unsafe work proceeds
• prometeu-packer has end-to-end production gates covering its declared service surface

Validation

• version-compatibility and migration tests
• malformed/untrusted input hardening tests
• end-to-end integration tests across packer plus Studio adapter path
• CI execution proving the packer project is gated independently

Affected Artifacts

• prometeu-packer/**
• repository CI/build configuration
• prometeu-studio/** integration gates where the adapter path is exercised
• packer learn/spec propagation targets after implementation