OKF estate build and publication standardisation tracker

Status: implementation complete; public completion is enforced by the post-merge exact-main Chrome deployment gate. Started 18 August 2026.

This is the canonical progress record for standardising OKF repository builds, documentation lockstep and publication. Update it in the same change as each material decision, repository adoption, validation result or newly discovered backlog item.

Completion definition

The programme is complete when every registered OKF repository has been reviewed and either adopts the applicable controls or records a justified non-applicable decision; changed repositories have passed their declared checks; affected public deployments have been verified at their exact commit; and all additional optimisations found during adoption are recorded in the backlog.

Shared controls

Repository adoption

Parallel work allocation

Decisions and conflict log

• The tracker is authored documentation and is not a semantic-graph authority.
• Repository-specific commands remain authoritative. Shared tooling may inspect and report them but must not replace them with Explorer commands.
• Existing dirty worktrees, branches and untracked files are preserved. An adoption workstream must stop only for the affected repository; independent repositories continue.
• Parallel agents do not edit the same repository concurrently unless they have disjoint files and an explicit hand-off. Any unexpected overlap is recorded here before work resumes.
• Live GitHub discovery is a separate input from the reconciliation presets. Four additional okf-* repositories and one external registered-bundle host were found; no preset list is treated as complete until registry discovery and classification reconcile.
• Initial timing evidence found duplicate branch push and pull-request CI in AI Infrastructure, GOV.UK Content, UK Legislation and UK Government APIs. ONS also builds the same bundle twice in one validation path, while building before --check can mask tracked-output drift. Repository-specific changes will preserve required main/tag assurance and check clean state before build.
• Repeated hand-off scans found ignored .DS_Store files appearing across source, cache and Git-internal directories while command-line work continued. Finder involvement is an unproven inference, and repeatedly deleting ignored local cache metadata did not provide a stable control. The enforceable publication boundary is therefore fail-closed: no such file may be tracked, staged, copied into a Site component or present in the assembled Site. Each repository hand-off checks those four boundaries without treating unrelated ignored local state as a reason to stop other work.
• The semantic Bundle Wiki registry remains a discovery surface for publishable bundles. A separate estate registry records every reviewed repository, including fixtures, embedded producers, immutable publication units, compatibility routes and upstream dependencies. Lifecycle publication scope must not be overloaded into a bundle's semantic status.
• Adoption is transactionally isolated per repository. The reconciler retains its safe all-target preflight default, while estate orchestration invokes one repository at a time so a blocked or dirty target does not stop independent work.
• Five active producer worktrees already contain substantial, unrelated semantic migrations. Their standardisation changes will be prepared in clean isolated clones and reviewed as repository-specific commits rather than overwriting shared working state.
• The ONS producer supplies the existing workbook-folder precedent: governed Excel sources are transformed through an allowlisted, deterministic snapshot. This is an input adapter and provenance boundary, not automatic semantic authority for cells, formulas or presentation structure.
• Regenerating the Explorer semantic bundle and legacy viewer after adding the lifecycle profile produced no tracked byte changes. The standardisation work therefore remains a governance, application and Site publication change; it does not force a semantic bundle or GitHub Release rebuild.
• The first full application gate found the server-rendered learning registry still carried pre-validation bundle statuses and the AI Infrastructure 0.4.0 version. The canonical registry projections were already correct; the small application projection was corrected and its existing drift test now passes. This is a dependency the initial parallel work allocation had not identified.
• The first hosted Python-contract gate then correctly rejected the heritage local-candidate receipt because it still bound the preceding Explorer app tree. The existing Site and corpus bytes were reused: installed Chrome reran the 100-question evaluation and the tiny, faithful and synthetic journeys, then the receipt alone was rebound to the exact current app identity. The first journey invocation omitted its declared publication bundle-root and failed all three paths independently; the corrected invocation passed 3 of 3. Future orchestration must carry an application's route and its corpus mount as separate declared inputs when the Pages root is a learner landing page.
• Local browser tests initially failed because the managed sandbox denied macOS browser rendezvous and loopback sockets. The unchanged suite passed when run with its governed browser and loopback permissions. Treat this error class as an execution-environment boundary, not a reason to rebuild application bytes.
• The first WCC runner-Chrome attempt linked chromium.executablePath() into Playwright's browser cache. Playwright Test headless mode resolves a distinct chromium_headless_shell path, so the Silver job failed before browser interaction. The supported chrome channel now selects installed Chrome for every affected launcher without a download or cache mutation. Installed Chrome then exposed a real missing-favicon console error, corrected with a self-contained icon. Future adoptions must use an explicit supported channel and retain clean-console checks rather than synthesising cache paths.
• GitHub did not attach the corrected WCC branch head to PR #34 even though both Git and the GitHub ref API reported 6aa4910b. Independent repository work continued. The stale PR was closed without deleting its branch and replacement PR #35 immediately bound the correct head and started fresh checks. Future orchestration must compare the PR head OID with the remote branch OID after every corrective push and replace only the affected PR if they diverge.
• GitHub did not emit a push run or check suite for the GOV.UK Content squash commit even though the workflow is active and declares main. The reviewed pull-request tree and integrated tree have the same Git tree identity. A byte-preserving manual recovery attempt failed closed because the workflow has no workflow_dispatch entry. Future producer CI should provide a reviewed exact-ref recovery hook, and orchestration must record missing event evidence rather than inventing an integration gate.
• ONS confirmed the repository-specific limit of a generic clean-first rule: its generated bundle/ is intentionally ignored and absent from a clean Git tree. The adopted workflow therefore builds it exactly once and transports that workspace to Pages. An immutable baseline is a separate design decision, not a reason to perform a second masking build.
• Land Registry's first full-test run found one genuine lockstep dependency: the new publication-method document increased the current governed inventory from 153 to 154 controls, while a legacy-bound test still expected 153. The repair updates the current test, architecture and maintenance documentation together, while retaining the immutable v0.3.0 release's historical 153-file boundary. Bundle, distribution, validation and frozen release bytes remain unchanged.
• Explorer's first exact deployed-commit run proved the identity, contract, route bytes and structured registry links, then failed the clean-console gate because the generated page did not declare its project favicon. Chrome requested origin-root /favicon.ico, while Pages correctly publishes /okf-explorer/favicon.svg. The renderer now emits the relative ../../favicon.svg link and the verifier records console message URL, line and column. This is an application/Site correction only; no semantic bundle, corpus or release rebuild is required.
• Land Registry's first integrated-main run exposed an interaction between two fail-closed flags. The reviewed three-file lifecycle exception cleared manual_review_required, but the same unknown paths still set stage1_review_required, making immutable maintenance unreachable. Focused PR #8 clears both flags only for those exact paths and adds a historical-main replay test. All 568 main tests passed and the bundle, distribution, validation, source, semantic and schema bytes have zero diff.

Optimisation backlog

• Decide whether common lockstep tooling should be vendored, packaged or invoked from a pinned Explorer revision; avoid an unpinned cross-repository dependency.
• Add cache and timing evidence so impact routing can be evaluated against actual CI duration rather than assumed savings.
• Add workbook-folder conformance fixtures and content-free inventories for .xlsx, .xlsm, .ods and CSV companions, covering formula, macro, hidden-sheet, external-link, provenance, rights and personal-data boundaries.
• Decide and document the lifecycle of candidate or legacy repositories found by discovery but absent from the reviewed reconciliation presets.
• Add a shared, commit-pinned post-deployment verifier which uses runner-installed Chrome, consumes repository-declared identity and journey checks, and does not rebuild candidate bytes.
• Profile the 21-minute UK Legislation validator and the 9-minute ONS test suite before sharding; route documentation-only changes only after fail-closed dependency classification has evidence.
• Add a reviewed workflow_dispatch recovery path with exact-ref reporting to GOV.UK Content CI, and investigate why GitHub omitted its integrated-main push event.
• Triage the four pre-existing GOV.UK Content Dependabot alerts (one high and three moderate) independently of this byte-preserving methodology adoption.
• Decide whether ONS should publish an immutable generated-bundle baseline; until then, retain one build and never claim a clean pre-build byte comparison.
• Add the Planning Pages shell and .nojekyll to a governed checksum catalogue without forcing a semantic bundle rebuild.
• Enforce pull-request head identity against the remote branch after corrective pushes so stale GitHub bindings cannot hide the reviewed commit.
• Keep the application route and corpus mount as separate declared browser inputs; a learner landing page must not be inferred to be the bundle root.
• Harden the estate-registry builder with fail-closed checks for unique backlog IDs, valid repository references, single bundle ownership and coherent adoption/audit/contract state tuples.
• Refresh immutable GitHub Action pins which still declare the deprecated Node.js 20 runtime; legislation's exact-main run showed GitHub forcing those actions onto Node.js 24. Review the equivalent estate pins without replacing immutable SHAs with moving tags.