[mbruzda-splunk]

Description

When RFCT is enabled and an eligible TA mapping change is found, compare the latest stable package with the package built in the current run. Manual callers can select two released packages. Run the comparison on WFE using two independent Splunk deployments and publish comparison JSON, versioned CIM-change docs, provenance and diagnostics as a GitHub artifact.

• Keep release selection and source/package acquisition on the trusted GitHub runner; validate app identity, versions, archive paths and checksums.
• Stage a frozen source export, packages and credential-free request under run/attempt S3 prefixes.
• Submit the paired Argo workflow, validate workflow UID/image/version on return, and collect artifacts automatically.
• Preserve worker/provisioning errors; retry bounded transient polling errors and request graceful cleanup on timeout or cancellation.
• Reuse existing WFE credentials; the cluster pulls RFCT 1.1.0 by immutable ECR digest.

RFCT is opt-in and advisory, and is excluded from the pre-publish gate. Public inputs: rfct-enabled, rfct-image, rfct-manifests-ref, rfct-argo-template, rfct-baseline-release, and rfct-candidate-release.

This separate implementation targets develop; the earlier draft #547 is unchanged.

Validation

• 169 repository tests passed; 95.62% total Python coverage (80% minimum).
• Required pre-commit/actionlint/workflow-hygiene checks passed; copyright, secret scan and Semgrep checks pass.
• Producer/controller/bootstrap contracts tested with checksummed package/source fixtures.
• Workflow revision 878f092edca05079018a338d4e83bf6bf60f3dce, runtime fe3c9c93c1e06297783364798dc1e833d7086e31, RFCT image digest fde0822f3163777f82cd1c69b3e61a42cea5297d8df483398e05effaac25c54f.
• Isolated fixture PR394 uses the exact workflow SHA and staging template. Shared main/develop refs remain unchanged. Legacy WFE suites are intentionally skipped with use_labels; primary build and both Python unit versions are expected to run.

Dependencies and rollout

• Runtime/manifests PR151.
• Argo templates/RBAC PR47 must be installed before enabling callers.
• Caller-template changes are prepared locally; publish them only after the reusable workflow is released and validated against the released tag.
• No production changes or merges performed.

Staging evidence

• Known-change comparison: controller exit 0, RFCT changes, intended user change detected in two events, all six phases exit 0, versioned docs collected automatically; both namespaces removed.
• Cancellation: both namespaces observed before SIGTERM; controller exit 130; Argo graceful stop and both teardown tasks succeeded; namespaces absent.
• Partial provisioning failure: valid candidate metadata with intentionally absent S3 package caused download-init exit 1 after namespace creation; baseline provisioned, bounded server deadline expired, both teardown tasks succeeded; namespaces absent.
• Initial no-change comparison passed every cluster node and generated docs, but its original controller timed out polling. Evidence was collected manually; this is not counted as an end-to-end controller pass. Bounded transient polling retries now pass the known-change run.
• The first real TA caller run passed acquisition, input staging, authentication and paired provisioning, then exposed a PSA circular import. Failure artifacts were uploaded and both namespaces removed. The adapter fix passed a credential-free test in the exact 1.1.0 image, generating raw and modular-input samples without executing candidate hooks.
• Final-runtime PSA comparison: normal PSA generation, one frozen corpus replayed independently, intended user change detected, docs and artifacts collected; all phases exit 0, both namespaces removed.
• Final-runtime no-change comparison: controller exit 0, status no-changes, two fully matched events on each side, docs/artifacts collected; all phases exit 0, paired cleanup succeeded.
• Final real TA caller run against workflow 878f092: RFCT job succeeded, 90 PSA modular-input events replayed per side, matching counts, no-changes, all six phases exit 0, versioned 0.394.42250644437 docs and full evidence artifact verified. Both teardown tasks succeeded and both namespaces are absent.
• The targeted caller's planner, metadata/setup, primary build and Python 3.9/3.13 unit jobs passed; legacy WFE suites were intentionally skipped. Unrelated fixture failures remain: 18 existing FOSSA dependency findings, auxiliary build(3.13) using unsupported pip show --version, and existing AppInspect python.required settings.
• Validation PR394 was closed without merging and only its isolated remote branch was deleted. Fixture main/develop stayed unchanged. Temporary staging templates, bootstrap/CSI resources, diagnostic pods and cancellation Role/Binding were removed; evidence retained.
• Independent integration review found no blocking issues.