feat: add pinned and follow stable controls

.traceweaver/auto-advance-20261104/anchors-final.md

@@ -0,0 +1,2 @@
+# Code Traceability Findings
+

.traceweaver/auto-advance-20261104/authority-gate.json

@@ -0,0 +1,11 @@
+{
+  "decision": "Proceed",
+  "scope": "exactapprovedplanC1-C8andnamedfiles;noinferrednewrequirements",
+  "authority": "authority.json andowner-approval.json",
+  "profile": "profile.json/frozenbeforeproductionmutations",
+  "vv": "vv-capsule.json/review-definition.json",
+  "baseline_hash": "94b783d925834004cd3f111dd2437f8ae531850f0184aaa29c52f89f84267795",
+  "must_not_change": "otherroles/modes/pins/runtimes/accounts/data;existingtrustandlifecycleguardcontracts;installationmanual",
+  "publication": "separatecontrolledrouteaftercleanreview/verification",
+  "runtime_acceptance": "helduntilactualnative/browser/publisher/bridgeevidence"
+}

.traceweaver/auto-advance-20261104/authority.json

@@ -0,0 +1,19 @@
+{
+  "mode": "approved implementation and controlled publication/LTX activation",
+  "baseline_id": "AUTOADVANCE-20261104",
+  "approved_plan_sha256": "94b783d925834004cd3f111dd2437f8ae531850f0184aaa29c52f89f84267795",
+  "owner_record": "owner-approval.json",
+  "ids_are_administrative_mappings": true,
+  "requirements": {
+    "REQ-AUTOADVANCE-001": "exact approved plan C1",
+    "REQ-AUTOADVANCE-002": "exact approved plan C2",
+    "REQ-AUTOADVANCE-003": "exact approved plan C3",
+    "REQ-AUTOADVANCE-004": "exact approved plan C4",
+    "REQ-AUTOADVANCE-005": "exact approved plan C5",
+    "REQ-AUTOADVANCE-006": "exact approved plan C6",
+    "REQ-AUTOADVANCE-007": "exact approved plan C7",
+    "REQ-AUTOADVANCE-008": "exact approved plan C8"
+  },
+  "must_preserve": "allother service modes,pins,data,accounts,lifecycleowner/trustcontracts;manualinstallation;no prerelease/majorautoadvance",
+  "existing_Fleet_dependency": "native/publisher acceptance still required beforeactivation"
+}

.traceweaver/auto-advance-20261104/browser-verification.json

@@ -0,0 +1,16 @@
+{
+  "scope": "real Chrome on actual candidate page; synthetic API fixture; no LTX operation",
+  "result": "passed",
+  "steps": [
+    "default pinned",
+    "select Follow stable",
+    "Check Updates selects synthetic1.4.1 without changing installed1.4.0",
+    "reload retains mode and pending target",
+    "repin returns installed1.4.0",
+    "next check stays pinned"
+  ],
+  "requests": 4,
+  "install_requests": 0,
+  "pending_screenshot": "follow-stable-pending.jpg",
+  "repin_screenshot": "repinned.jpg"
+}

.traceweaver/auto-advance-20261104/final-annotated-tests.log

@@ -0,0 +1,28 @@
+........................................................................ [ 59%]
+..................................................                       [100%]
+=============================== warnings summary ===============================
+tests/test_auth.py: 68 warnings
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:375: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    'created_at': datetime.utcnow().isoformat(),
+
+tests/test_auth.py: 58 warnings
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:472: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    users[username]['last_login'] = datetime.utcnow().isoformat()
+
+tests/test_auth.py::TestAccountLockout::test_lockout_after_max_attempts
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:491: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    datetime.utcnow() + timedelta(minutes=lockout_mins)
+
+tests/test_auth.py::TestAccountLockout::test_lockout_after_max_attempts
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:463: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    if datetime.fromisoformat(locked_until) > datetime.utcnow():
+
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/test_auth.py:442: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    datetime.utcnow() - timedelta(minutes=5)
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+122 passed, 132 warnings in 6.64s

.traceweaver/auto-advance-20261104/full-tests-final.log

@@ -0,0 +1,72 @@
+........................................................................ [  6%]
+........................................................................ [ 12%]
+........................................................................ [ 19%]
+........................................................................ [ 25%]
+........................................................................ [ 32%]
+........................................................................ [ 38%]
+........................................................................ [ 45%]
+..s..................................................................... [ 51%]
+........................................................................ [ 58%]
+........................................................................ [ 64%]
+........................................................................ [ 71%]
+........................................................................ [ 77%]
+........................................................................ [ 84%]
+........................................................................ [ 90%]
+..............................................................s......... [ 97%]
+............................                                             [100%]
+=============================== warnings summary ===============================
+tests/test_account_link.py: 54 warnings
+tests/test_auth.py: 68 warnings
+tests/test_exporter_auth_protections.py: 131 warnings
+tests/test_landing_support.py: 2 warnings
+tests/test_netbox_link.py: 41 warnings
+tests/test_proxy_customer_route_repairs.py: 28 warnings
+tests/test_proxy_lifecycle_review_repairs.py: 21 warnings
+tests/test_proxy_recovery_tls_repairs.py: 54 warnings
+tests/test_release_selection.py: 1 warning
+tests/test_routes.py: 73 warnings
+tests/test_updates.py: 1 warning
+tests/test_vast_price_manager.py: 3 warnings
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:375: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    'created_at': datetime.utcnow().isoformat(),
+
+tests/test_account_link.py: 49 warnings
+tests/test_auth.py: 58 warnings
+tests/test_exporter_auth_protections.py: 60 warnings
+tests/test_netbox_link.py: 42 warnings
+tests/test_proxy_lifecycle_review_repairs.py: 2 warnings
+tests/test_release_selection.py: 1 warning
+tests/test_routes.py: 61 warnings
+tests/test_updates.py: 1 warning
+tests/test_vast_price_manager.py: 3 warnings
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:472: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    users[username]['last_login'] = datetime.utcnow().isoformat()
+
+tests/test_auth.py::TestAccountLockout::test_lockout_after_max_attempts
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+tests/test_routes.py::TestVastPriceManagerFleetSession::test_reauth_reports_detectable_password_throttling
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:491: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    datetime.utcnow() + timedelta(minutes=lockout_mins)
+
+tests/test_auth.py::TestAccountLockout::test_lockout_after_max_attempts
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:463: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    if datetime.fromisoformat(locked_until) > datetime.utcnow():
+
+tests/test_auth.py::TestAccountLockout::test_lockout_expires
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/test_auth.py:442: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    datetime.utcnow() - timedelta(minutes=5)
+
+tests/test_routes.py::TestVastPriceManagerFleetSession::test_reauth_reports_detectable_password_throttling
+  /private/tmp/ltx-auto-advance-20261104/cryptolabs-proxy/tests/../src/cryptolabs_proxy/auth.py:1884: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
+    datetime.fromisoformat(current['locked_until']) > datetime.utcnow()
+
+tests/test_vast_price_manager.py::test_concurrent_cli_registrations_preserve_both_services
+tests/test_vast_price_manager.py::test_concurrent_cli_registrations_preserve_both_services
+tests/test_vast_price_manager.py::test_manual_rollback_blocks_lifecycle_command_until_runtime_and_registry_restore_finish
+  /Users/hanneszietsman/.local/share/uv/python/cpython-3.12.12-macos-aarch64-none/lib/python3.12/multiprocessing/popen_fork.py:66: DeprecationWarning: This process (pid=98944) is multi-threaded, use of fork() may lead to deadlocks in the child.
+    self.pid = os.fork()
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+1106 passed, 2 skipped, 765 warnings in 105.97s (0:01:45)

.traceweaver/auto-advance-20261104/native-negative.log

@@ -0,0 +1 @@
+{"scope": "disposable Linux fixture; no production key or catalog", "cases": [{"case": "bad-real-signature-no-partial-persistence", "result": "passed"}, {"case": "real-SO_PEERCRED-rejects-UID65534-claiming-root", "result": "passed", "restored_socket_mode": "0600"}]}

.traceweaver/auto-advance-20261104/native-source-equivalence.json

@@ -0,0 +1,21 @@
+{
+  "method": "Both Python3.12 AST without comments/locations; trace-comment changes after wheel build",
+  "matched": true,
+  "initial_attempt": "cross-version Python3.14/3.12 AST hashes incomparable; rerun with matching Python3.12",
+  "guest": {
+    "cryptolabs_proxy/auth.py": "c40e04b318910ce1a2c1eedfac710d1f8c5ce60959da43f5316979229a21b42d",
+    "cryptolabs_proxy/release_client.py": "66dd68c121586470256923237436033d60e308e7c60f84ad6141d42c4bf63fe7",
+    "dc_overview/cli.py": "3255b052cac6e7dd165189fc95f5357c92a32854254c4ea392b24122c303f04c",
+    "dc_overview/fleet_upgrade.py": "5f696be2b9c06780b76e8c617485857752d171f025f27425ef292089997894dc",
+    "dc_overview/release_broker.py": "afb854ac3640f6dcc528cf5aa8fce8f19eacc0916f0fecc7bfa2ceff8000cc1e",
+    "dc_overview/release_policy.py": "b72cf1d61337b9dbcf2cb9bb0ecb9c95659efde0d1074e1ede22d730392c86ee"
+  },
+  "local": {
+    "cryptolabs_proxy/auth.py": "c40e04b318910ce1a2c1eedfac710d1f8c5ce60959da43f5316979229a21b42d",
+    "cryptolabs_proxy/release_client.py": "66dd68c121586470256923237436033d60e308e7c60f84ad6141d42c4bf63fe7",
+    "dc_overview/cli.py": "3255b052cac6e7dd165189fc95f5357c92a32854254c4ea392b24122c303f04c",
+    "dc_overview/fleet_upgrade.py": "5f696be2b9c06780b76e8c617485857752d171f025f27425ef292089997894dc",
+    "dc_overview/release_broker.py": "afb854ac3640f6dcc528cf5aa8fce8f19eacc0916f0fecc7bfa2ceff8000cc1e",
+    "dc_overview/release_policy.py": "b72cf1d61337b9dbcf2cb9bb0ecb9c95659efde0d1074e1ede22d730392c86ee"
+  }
+}

.traceweaver/auto-advance-20261104/native-verification.json

@@ -0,0 +1 @@
+{"application_health":"not exercised; two controller images kept idle","discovery":"synthetic signed raw bundles; actual signature verification; no production catalog claim","production":false,"results":[{"case":"real-docker-pin-follow-refresh","result":"passed"},{"case":"repin-installed-no-advance","result":"passed"},{"case":"abrupt-death-before-native","exit":77,"recovered_mode":"pinned","result":"passed"},{"case":"abrupt-death-after-selection","exit":77,"recovered_mode":"pinned","result":"passed"},{"case":"abrupt-death-after-public","exit":77,"recovered_mode":"follow-stable","result":"passed"},{"case":"abrupt-death-before-policy","exit":77,"recovered_mode":"follow-stable","result":"passed"},{"case":"competing-process-and-repin-cas","result":"passed"},{"case":"actual-root-socket-cli-and-systemd-refresh","result":"passed","service_status":"Result=success\nExecMainStatus=0","timer":"NextElapseUSecRealtime=Thu 2026-11-05 00:10:52 SAST\nActiveState=active","unauthorized_uid_denied":65534},{"case":"zero-container-replacement-or-restarts","identities":{"cryptolabs-proxy":{"Id":"9a0b552ae7fc78d9e19334ad0e16133f28b777c3ae9679996be57ab00b50b180","Image":"sha256:8fc51cde1555f7b6a3b21faf20740cae3eff145c6d661868c4a1ad6a07dd7874","RestartCount":0,"StartedAt":"2026-11-04T17:31:14.768729077Z"},"ipmi-monitor":{"Id":"a6d86e80adb3d052b96fde553957106d9a795e2bae983f7cb1761c1006178d81","Image":"sha256:84563cf838bd34c12cc83239c06c44f9a69c01b9dfff570e35ca913ef1825dac","RestartCount":0,"StartedAt":"2026-11-04T17:31:16.84448682Z"}},"result":"passed"}]}

.traceweaver/auto-advance-20261104/owner-approval.json

@@ -0,0 +1,8 @@
+{
+  "utc": "2026-11-04T16:34:29.958547+00:00",
+  "owner": "Hannes Zietsman",
+  "message": "Yes approve the plan",
+  "approved_plan_sha256": "94b783d925834004cd3f111dd2437f8ae531850f0184aaa29c52f89f84267795",
+  "scope": "all candidatebehavior C1-C8, numberedimplementation andCI/release/LTXverification inexactplan",
+  "no_repeat_approval_needed": true
+}