Promotion gate: LoopX acceptance of experimental/metadata-runtimes

[wchwawa]

Summary

Tracks the one mandatory condition for merging experimental/metadata-runtimes (#500) into main: production-grade acceptance by LoopX, as stated in the maintainer note on #500. main keeps the etcd control path until this gate passes.

Gate

• LoopX's NoKV live rows s0.nokv_live_matrix and s2a.nokv_live_qualification (examples/shared-goal-authority-e2e in huangruiteng/loopx) pass against a build of the branch.
• The LoopX-side configuration change that runs those rows against the branch is reviewed and merged by the LoopX owner.
• No regression in the SDK 0.11.0 / API 1 wire contract LoopX pins, or the break is made visible and decided explicitly (this branch changes WORKSPACE_PROTOCOL_SCHEMA v9 → v10 and replaces RoutingConfig.etcd/static with RoutingConfig.seeds while keeping __version__ 0.11.0 / API_VERSION 1).
• Green internal FDB and Holt gates are necessary, not sufficient.

Work items

• Export the wire schema so a deployment can detect the v9/v10 break before connecting: nokv.WORKSPACE_PROTOCOL_SCHEMA and workspace_protocol_schema in nokv version --json (branch PR).
• Record the gate, evidence procedure and roles in-repo (docs/development/loopx-acceptance-gate.md) and fix the branch README's etcd-era CLI usage (branch PR).
• LoopX helper accepts a seeds routing kind and reports a typed capability mismatch when the installed wheel cannot build the configured routing (LoopX PR).
• LoopX ladder/live matrix can be pointed at a seed-routed owner (LoopX PR).
• Baseline, candidate and regression ladder runs plus the negative pairing (0.11.0 wheel against a branch owner) recorded here with binary/wheel SHA-256 and schema strings, no credentials or endpoints.
• Decision on API_VERSION 2 / 0.12.0 at promotion time.

Not proven by this gate

FDB runtime, seed failover, availability/restart/takeover, envelope capacity/retention, real cloud S3, and pre-connect wire-mismatch detection inside LoopX's version guard (the schema export makes it possible; adopting it is the LoopX change).

[wchwawa]

Acceptance record 1 (2026-09-19): first candidate run, gate not yet passed

Status: candidate rows pass on a build of this branch; the gate stays open until the LoopX-side change is merged by the LoopX owner (#511 condition 2) and the API_VERSION / 0.12.0 decision is taken.

Builds under test

Artifact	Identity
Branch commit	experimental/metadata-runtimes @ 0c0b7e2 plus #512 head c105fc9 (schema export)
nokv binary	SHA-256 fb9cb1da6abd54144e0e2027c5b424ac3f0671cf7da47080dbe6e65001e46206; nokv version --json: version 0.11.0, holt 0.8.6, workspace_protocol_schema nokv.workspace.rpc.v10
Python wheel	nokv-0.11.0-cp39-abi3-macosx_11_0_arm64.whl, SHA-256 f183e400f5881d2581323770f8804460acbaffbc72b8ff62e3a502b85e268804; nokv.WORKSPACE_PROTOCOL_SCHEMA == "nokv.workspace.rpc.v10", __version__ 0.11.0, API_VERSION 1
Owner	one Holt-backed owner (format → provision → serve --meta-url holt:///…), reached through one seed
Object store	S3-compatible local provider (moto), fresh bucket and prefix; the same provider class that qualified main
LoopX	helper change loopx-project/loopx#4724 (head f3da9005d), ladder/live-matrix change loopx-project/loopx#4726 (head d8cc665a3, draft, stacked on #4724)

LoopX ladder runs (s0.nokv_live_matrix + s2a.nokv_live_qualification)

Run	Wheel	Owner	Result
Baseline	0.11.0 release	main 0.11.0, etcd control path	LoopX main da6d79778: 2 pass, exit 0
Regression	0.11.0 release	main 0.11.0, etcd control path	LoopX #4726 head: 2 pass, exit 0; bindings nokv_protocol_schema: null, routing group NOKV_ETCD
Candidate	branch wheel above	branch owner above, seed routing	LoopX #4726 head: 2 pass, exit 0; bindings nokv_protocol_schema: nokv.workspace.rpc.v10, routing group NOKV_SEEDS, seed count 1; Stage 2A report 13 checks, nokv_protocol_schema: nokv.workspace.rpc.v10
Negative pairing	0.11.0 release	seed-routed environment	both rows unverified / nokv_sdk_capability_mismatch (the release wheel has no RoutingConfig.seeds), exit 1, 0 privacy violations; not reported as a pass or as an outage

All four reports passed the ladder's privacy scan (no endpoint, credential or path values in evidence; the routing kind literal is deliberately reported as the variable name).

Not proven by this record

• Wire-level pairing of the 0.11.0 wheel against the v10 owner through static routing (the running owner exposes no placement identifiers to build one); the LoopX-visible wrong-wheel behaviour is covered by the negative pairing above.
• Multi-seed discovery and failover (one seed), availability/restart/takeover, envelope capacity/retention, real cloud S3, FDB runtime (NOT QUALIFIED by this gate).
• The candidate wheel still reports 0.11.0 / API 1; only the schema string and the SHA-256 distinguish it from the release. The version decision belongs to the promotion PR.

Reports and transcripts are retained locally by the NoKV maintainer; they contain stack coordinates and are not attached.