[Dunky13]

Summary

The integrated managed-service implementation is already on main, but its squash author/sign-off mismatch prevented release qualification. This successor preserves the hosted failure witnesses, partitions tooling within existing CI budgets, separates HTTPS from backend CPU work, and fixes the packaged setup fixture's one-attempt assumption when a private service holds a lock.

complete tooling inventory -> disjoint shards -> race tests on both architectures
complete runtime inventory -> core + isolated HTTPS -> both architectures
packaged setup busy refusal -> prove no accepted mutation -> bounded retry
all required CI -> correctly authored squash -> fresh main/release qualification

Both tooling shards retain race detection, two package/test workers, the 12-minute test timeout and 20-minute job limit. The package fixture retries only kernel busy refusals with unchanged file custody and native-action history, within its original single 30-second deadline and three attempts. Accepted mutations and uncertain state remain fatal. Product code, locking, DCO verification and release gates are unchanged.

The complete remote package now has a required runner independent of core on each architecture. Their union covers the original runtime scope exactly once, with the same race/worker/time limits. The default runtime command retains its original complete scope. Bcrypt cost 14, authentication caching, admission bounds and service deadlines are unchanged. Cold-burst and request-failure diagnostics retain timing without logging credentials.

Evidence

• Before: Main certification failure: c3a690b has a valid GitHub signature but author email and certification differ. Published history remains intact.
  After: Successor commits use the configured maintainer author, cryptographic signature and matching DCO footer. The final squash author and signature still require verification.
• Before: Intel tooling failure: the full package reached its 720.078-second deadline with parallel tests still pending.
  After: Queue job 2162 passed the actual shard runner with all 169 top-level tests, 85/84 per shard, in 203.965/175.657 seconds. Inventory and workflow regressions verify complete coverage, exact budgets and failure propagation. Hosted results for both architectures remain required.
• Before: Universal installer failure: packaged payload setup passed, then app-bundle setup received the safe kernel busy-lock refusal.
  After: Queue job 2163 passed lint, refusal-guard race tests, actual packaged payload/app-bundle setup, private outer-installer lifecycle and DMG verification/detach. Regression cases reject pending state, changed identity/wrappers/action history, service mutations, non-kernel errors, cancellation and exhausted attempts.
• Before: Intel HTTPS failure: cold authentication took 35.93 seconds and fourteen queued assets received 429; lifecycle requests reached the unchanged 30-second deadline while backend and remote shared the runner. Cache comparison-count assertions did not fail.
  After: The same two tests passed locally in isolation under race, job 2165: cold burst 9.86 seconds, lifecycle 92.62 seconds total. Partition regressions failed before and passed after the adapter change, covering future child packages, exact flags, incomplete inventory, invalid selectors and failure propagation. Queue job 2166 then passed lint, the focused runner/workflow regressions, and both actual complete runtime partitions with race detection: backend 213.362 seconds, remote 156.960 seconds, exit 0. CPU contention remains the leading explanation; isolated hosted Intel acceptance is pending.
• The integrated product passed the complete local pipeline in job 2161. This successor changes CI, test fixtures and documentation. Real native registration and SentinelOne acceptance remain separate qualification boundaries.

Merge Danger

Door: Two-way

Blast Radius: CI

Every shard and architecture remains required. Merge after green CI with author email marc@went.io and exactly one matching maintainer footer, then verify the merged author/signature before following the signed release pipeline. Build 118 stays immutable. Do not rewrite history, bypass checks or duplicate Apple submissions.