Phase 5 enterprise track v2 (code GO, release held on owner gates)

[samrusani]

Summary

Replacement Phase 5 carrier after the first attempt failed committed-SHA CI. The team repaired all six reported CI defects (shallow-clone handoff guard, missing-tag ops upgrade drill, hardcoded venv path in migrate.sh, gitleaks false positive on the example env, and the browser-clip transport browser test), and cleared eight additional CodeQL alerts without suppressions, testing this time against the shallow / one-commit-range / Playwright conditions the first attempt missed.

Independently re-verified by release engineering: carrier receipt recomputed from live bytes to 94c990d7 (exact match), both report hashes match the trailers, 4,042 unit tests pass, control-doc truth and release_check pass at 0.13.1, the shallow-clone guard fix is present, and the browser-clip origin binding survived the CodeQL URL-scheme fix and stays non-vacuous by mutation.

Draft; runs committed-SHA CI only; holds the release. Versions remain 0.13.1. No 0.14.0 cut, tag, or publish until CI is green and the 5.4 real-host deployment receipt exists. 5.1.c is owner-accepted at the OpenAI Trusted Access scan plus internal-review bar; the claim stays 'automated security scanning under OpenAI Trusted Access ... plus internal adversarial review', never 'independently audited'.

Upgrade Overview

Protected Areas

• Memory schema
  • Additive migration 0094 (browser_clip_capabilities table); sqlite_schema.py, sqlite_store.py, vnext_store.py, and vnext_stores/* gain the capability store methods. No change to existing table semantics.
• Continuity APIs
  • routers/vnext_memories.py gains the origin-bound browser-clip issue/consume path behind the authenticated boundary; no existing route contract shape changes.
• No MCP tool, dependency, or version change (versions held at 0.13.1)
• Immutable release records and the protected SQLite memory_access.py are unchanged

Compatibility Impact

Additive only. Existing routes, tools, and stored data are unaffected. The one behavior change is the clipper: the previous reusable token is replaced by a short-lived, origin-bound, one-time capability (the security-review fix).

Migration / Rollout

One additive Alembic migration (0094) creating the browser_clip_capabilities table; the SQLite bootstrap gains the same table. No existing data is migrated or destroyed.

Operator Action

None for existing deployments. The single-tenant deployment guide and ops-evidence tooling are new documentation and scripts; using them is optional and covered by the 5.4 owner gate.

Validation

Receipt 94c990d7 recomputed (exact); 4,042 unit tests pass; static checks pass at 0.13.1; browser-clip security re-verified non-vacuous. CodeQL, gitleaks, integration, web, browser, and ops drills run on this committed SHA via CI.

Rollback

Revert the carrier commit and run the 0094 downgrade (drops the browser_clip_capabilities table). No existing data is affected.