[Task] Prove the full consolidated package set without publication

[sfmskywalker]

Outcome

Prove the complete first consolidated 3.10 package set from the canonical Core solution without publishing packages or changing live publisher ownership. Parent: #8216; also supplies evidence for #8219 and #8220. Program #8194, board 52.

Basis and dependencies

• History/source and 3.8.x/3.9 catch-up is merged in Reconcile 3.8/3.9 release history and refresh Studio and Extensions imports #8624; baseline Core main 6dbfc58624c28e147a90e2d2b0d1a610817012e2.
• [Task] Implement and verify the bounded independent-packaging proof #8260 is closed with a bounded Slack artifact proof; it does not prove the entire consolidated package set.
• Accepted ADR doc/adr/2026-09-28-lockstep-consolidated-release-and-publisher-cutover.md governs the first lockstep 3.10 release. Independent streams remain later program work.
• The initial PR inventory contained no matching implementation. Active implementation and review now use Prove consolidated packages, provenance, and clean consumers without publication #8627; do not create a competing PR.

Scope

Implement an explicit nonpublishing consolidated-package proof lane and reproducible local command. Keep imported packages excluded from ordinary builds until separately approved cutover. Correct imported Extensions repository metadata to Core. Use the canonical solution/build graph and preserve project-specific nonpackable exclusions, including retired Secrets packages and unfinished lifecycle packages.

Acceptance

• An explicit proof-only switch lifts only the product-wide imported-subtree packability guards. Default behavior and all project-specific exclusions remain intact; do not set global IsPackable=true.
• Enumerate and record the evaluated expected package IDs and exclusions. Fail on missing, duplicate, unexpected, or retired package artifacts.
• Pack at one isolated 3.10 proof version; inspect nuspec identity/version, dependencies, framework assets, repository commit/URL, hashes, and symbol/source provenance across the resulting package set.
• Restore and build representative clean Core, Extensions, and Studio consumers against the produced artifacts, using fresh caches and no source-project fallback. Detect an accidental dependency on unavailable internal artifacts.
• Artifact workflow has no publisher credentials, package push, deployment, or publisher-ownership mutation. Normal Packages workflow does not opt in.
• Regression tests demonstrate default exclusions, preservation of project exclusions, and rejection of malformed/incomplete artifacts. Document reproducible commands, evidence, and proof limits.
• Exact-head independent review and repository CI gates pass before merge. No publication or cutover is claimed.

Delivery

One active delivery task. Slice PR targets shared codex/elsa-integration-program; final program integration targets main. Lead owns integration and QA. All edits occur in isolated worktrees.

Out of scope

Feed publication, source publisher disabling, NuGet deprecation, archival, production deployment, independent release policy acceptance, and live Slack certification. Those remain required follow-on outcomes where specified by the program.

[sfmskywalker]

Implementation is in PR #8627, targeting the shared codex/elsa-integration-program branch. Python contract checks and narrower Studio/Slack artifact checks have passed; complete consolidated artifact and runtime-consumer acceptance is still pending. A targeted SDK metadata-staging defect is being corrected before a new exact-head full proof. This remains the only active delivery task. No publication or publisher cutover has occurred.

[sfmskywalker]

Delivered by merged #8627 into codex/elsa-integration-program at 5b6b75fdd64a22d99ac4258311a29258b559055b, after independent APPROVE + HIGH and Greptile 5/5 at head 44083dc4f47d56aa2d5c215b0c7479c0b7290cb0, all applicable exact-head CI, and lead artifact inspection. Full proof: 225 nupkg/snupkg pairs, 124 preserved exclusions, 668 assembly/framework provenance entries and fresh package-only .NET 8/9/10 consumers. The lead rehashed all 450 package/symbol files and checked 5,666 unique tracked source paths against exact Git blobs. Artifact 11390805430 archive SHA-256: 8317e5766591f9da2d1f83cd6a85274bd41efbfbd0039d6a1bcfaf0c9bf81636.

This completes the bounded nonpublishing proof task. Integration into main, persisted upgrade/runtime compatibility, npm artifacts, publication and publisher cutover remain separate program gates; #8216/#8219/#8220 and program #8194 remain open. No package was published.