Add bounded follower reads and parallel task acceptance

Integrate explicit follower document reads, RF3 lifecycle and authority regressions, genuine issued-grant expiry coverage, native TUnit default20 and six isolated task/profile CI cells. Retain original source/report admission and all full qualification gates.

Validation: complete Release build and native formatter passed; related88 whole-operation cases passed at20 and50, with actual20 original TRX overlap. Exact3114 native census and60 task expectations bind. Current-source Linux RF3 and product coverage remain unqualified.

Author: KSemenenko

.github/workflows/build-and-tests.yml

@@ -4,6 +4,12 @@ on:
     branches: [main]
   pull_request:
   workflow_dispatch:
+    inputs:
+      task:
+        description: 'Acceptance task; all runs complete qualification and all task lanes'
+        type: choice
+        default: all
+        options: [all, KL-011, KL-014, KL-015]
 permissions:
   contents: read
 concurrency:
@@ -21,6 +27,7 @@ jobs:
         run: node scripts/Features/RepositoryGovernance/verify.mjs
   analyzer-rules:
     name: Test code analyzers
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.task == 'all' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -95,6 +102,7 @@ jobs:
           if-no-files-found: error
   verify:
     name: Build and test KeyLoad
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.task == 'all' }}
     needs: repository-checks
     strategy:
       fail-fast: false
@@ -210,8 +218,84 @@ jobs:
           name: code-quality-${{ matrix.os }}
           path: artifacts/code-quality/**
           if-no-files-found: error
+  task-acceptance:
+    name: Qualify ${{ matrix.task }} (${{ matrix.profile }} caller)
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        task: ${{ fromJSON(inputs.task == 'KL-011' && '["KL-011"]' || inputs.task == 'KL-014' && '["KL-014"]' || inputs.task == 'KL-015' && '["KL-015"]' || '["KL-011","KL-014","KL-015"]') }}
+        profile: [normal, scalar]
+    steps:
+      - name: Download source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          global-json-file: global.json
+      - name: Check Docker
+        run: docker version
+      - name: Build this task's KeyLoad server image
+        id: images
+        run: node scripts/Features/BenchmarkComparisons/prepare-images.mjs --server-only
+      - name: Configure this task's Docker image
+        shell: bash
+        env:
+          KEYLOAD_SERVER_IMAGE: ${{ steps.images.outputs.server-image }}
+        run: |
+          test -n "$KEYLOAD_SERVER_IMAGE"
+          printf 'KeyLoad__ContainerImages__Server=%s\nKEYLOAD_IMAGE_RECEIPT=%s\n' "$KEYLOAD_SERVER_IMAGE" "$RUNNER_TEMP/keyload-images/image-receipt.json" >> "$GITHUB_ENV"
+      - name: Restore .NET packages
+        run: dotnet restore KeyLoad.slnx
+      - name: Build the complete current solution
+        id: build
+        run: dotnet build KeyLoad.slnx --no-restore --configuration Release
+      - name: Prepare original task source and test-image receipts
+        id: source-identity
+        shell: pwsh
+        run: |
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.production-source-manifest.ps1 `
+            -Mode prepare -Root $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/task-acceptance')
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Discover and execute this task's complete acceptance flows
+        id: acceptance
+        if: ${{ !cancelled() && steps.build.outcome == 'success' && steps.source-identity.outcome == 'success' }}
+        shell: pwsh
+        env:
+          KEYLOAD_ACCEPTANCE_TASK: ${{ matrix.task }}
+          KEYLOAD_ACCEPTANCE_PROFILE: ${{ matrix.profile }}
+        run: |
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/task-acceptance.ps1 `
+            -Repository $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/task-acceptance') `
+            -Task $env:KEYLOAD_ACCEPTANCE_TASK -Profile $env:KEYLOAD_ACCEPTANCE_PROFILE
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Verify unchanged task source and test images
+        if: ${{ !cancelled() && steps.source-identity.outcome == 'success' }}
+        shell: pwsh
+        run: |
+          & pwsh -NoLogo -NoProfile -File scripts/Features/CodeQuality/functional-coverage.production-source-manifest.ps1 `
+            -Mode verify -Root $env:GITHUB_WORKSPACE `
+            -EvidenceRoot (Join-Path $env:GITHUB_WORKSPACE 'TestResults/task-acceptance')
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Clean up this task's Docker registry
+        if: ${{ always() && (steps.images.outcome == 'success' || steps.images.outcome == 'failure') }}
+        run: node scripts/Features/BenchmarkComparisons/cleanup-images.mjs
+      - name: Save this task's original acceptance results
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: task-acceptance-${{ matrix.task }}-${{ matrix.profile }}
+          path: |
+            TestResults/task-acceptance/**
+            artifacts/code-quality/**
+            ${{ runner.temp }}/keyload-images/**
+          if-no-files-found: error
   docker-rf3:
     name: Test three-node database
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.task == 'all' }}
     runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
@@ -260,7 +344,12 @@ jobs:
       - name: Check original three-node reports for diagnostic upload
         id: rf3-original-reports
         if: ${{ !cancelled() && (steps.rf3-required.outcome == 'success' || steps.rf3-required.outcome == 'failure') }}
-        run: rg --files --no-ignore TestResults/rf3-required -g '*.trx'
+        shell: bash
+        run: |
+          test -d TestResults/rf3-required
+          original_trx=$(find TestResults/rf3-required -type f -name '*.trx' -size +0c -print -quit)
+          test -n "$original_trx"
+          printf '%s\n' "$original_trx"
       - name: Save original three-node diagnostics before covered suites
         if: ${{ !cancelled() && steps.rf3-original-reports.outcome == 'success' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

AGENTS.md

@@ -566,3 +566,11 @@ A bounded website qualification candidate contains the20-project historical runt
 - After the wave's changes are integrated, stop source and compiled-image mutations across every owner at one explicit verification barrier. Build the coherent solution once, run independent required test lanes together when their native resources do not conflict, and assign every failure back to its task owner. Preserve original failures and resource cleanup; no shared compiler races, concurrent writes to the same files, or weakened tests are allowed.
 - Record actual acceptance outcomes in the canonical plan, commit and push the complete authorized wave, then immediately assign the next independent tasks. Count a task as done only when its complete required acceptance evidence exists; report the real executor limit when the environment cannot run the requested number of agents.
 - Owner selection 2026-10-08 requires GPT-6.1 Sol with medium reasoning for the parallel implementation agents completing this plan, unless the owner explicitly changes that selection. Preserve each task's code, acceptance ownership and handoff when changing its executor.
+
+## Parallel GitHub acceptance, owner direction 2026-10-09
+
+- Run independent complete module acceptance scopes concurrently in isolated Linux GitHub Actions jobs so one long RF3 suite does not hold every task's qualification. Keep all mandatory full build, unit/scalar, recovery, RF3 and coverage jobs; a scoped job supplements those gates and proves only its explicitly mapped task criteria.
+- Every scoped job MUST discover its actual native TUnit cases, retain source/DLL/PDB identities and original reports, execute the complete mapped operation flows without retries or skips, and join cleanup of its own Aspire resources. Preserve real .NET and official MCP clients, genuine RF3 membership, bounded execution and truthful caller-versus-server scalar evidence; partial suites MUST NOT become full-suite or coverage qualification.
+- Owner clarification 2026-10-09 permits task iterations and checkpoints to execute only the tests mapped to that task's acceptance scope, locally or through an explicitly selected GitHub task run. Preserve the full mandatory final qualification; a focused run's green result proves its selected task flows only and MUST NOT be reported as the complete solution or coverage gate.
+- Owner correction 2026-10-09 requires at least 20 native TUnit execution slots for independent functional tests, rather than substituting parallel CI jobs for test concurrency. Default the native selector and typed test execution options to 20 and remove forced one-test execution from task lanes. Preserve genuine shared-resource invariants with narrowly justified native scheduling; audit blanket serial attributes and prove actual concurrency from original native execution records rather than fabricated counters.
+- Owner authorization 2026-10-09 permits increasing native TUnit concurrency up to 50 during implementation when actual CPU/resource use and complete-flow outcomes support it. Start at 20, compare real execution duration and resource pressure, retain original failures, and choose the measured useful concurrency without changing acceptance, timeouts, shared-resource ownership or cleanup.

README.md

@@ -355,6 +355,17 @@ local seed/replay/cold-reopen flow; public transfer and fresh full Linux RF3,
 model, recovery and performance qualification remain open. Original source
 identities and results belong in the [qualification records](docs/implementation/status.json).
 
+Current source also includes an explicit bounded follower document read through
+the .NET SDK and MCP, with a selected replica, lag limit and fresh authorization.
+Its [document contract](docs/Features/DocumentStorage.md) keeps the captured data
+cut distinct from the current authorization cut. Complete current-source RF3
+qualification remains open.
+
+Native TUnit now defaults to 20 parallel tests. GitHub also runs separate
+normal/scalar-caller acceptance lanes for strict indexes, the server/SDK and
+security/telemetry. Focused task runs retain their complete declared operation
+scope; full build, unit, recovery, RF3 and coverage gates remain mandatory.
+
 Complete product functional coverage remains **unmeasured**. The
 [coverage contract](docs/Features/CodeQuality.md) admits whole operation flows,
 excludes load and comparison runs, and requires matching source and build reports.

docs/ADR/ADR-017-ownership-session-tokens.md

@@ -152,6 +152,8 @@ Frozen bounded native authority observation (owner approved2026-10-08): under th
 
 Service-user invariant clarification: the fault Dockerfile inherits and restores the base APP_UID USER. The selected resources preserve the already existing ClusterResourceSettings --user uid:gid override exactly, captured through pinned public ContainerRuntimeArgsCallbackAnnotation before adding NET_ADMIN. They do not change default host/container identity or start service as root. Native tool/read commands alone use --user0 inside each verified owned namespace.
 
+TASK-KL021-NATIVE-NETWORK-IDENTITY-003 refines the existing REQ-MTOKEN-ISOLATION-003 / AC-MTOKEN-ISOLATION-003/005 native inspection contract without changing topology or namespace ownership. Docker's original NetworkMode must exactly equal either the nonempty name or nonempty native ID of its sole actual attached network; the same entry supplies both identities. An unrelated mode, absent/malformed ID or multiple networks fails closed, with no alias/prefix lookup or raw identity export. The original schema2 Linux3458/run37821315110/attempt1 admission receipt proves modeMatchesAttachedId=true and modeMatchesAttachedName=false. Root freezes this predicate correction in TestInfrastructure, changes only IntegrationTests Features/ClusterReplication/Validation/ReplicaIsolationContainerAdmission, builds/reviews it and executes the existing full former-leader SDK/official-MCP minimum-token/isolation/restoration flow through the Linux-owned fault image. All original privilege, service-user, PID, source/image/incarnation and actual majority-ACK/cleanup gates remain unchanged. Rollout is the next native source/image cohort; rollback removes the predicate refinement without any database migration. Accepted; genuine current-source runtime qualification is pending.
+
 Persisted NodeStatus.NodeId is a physical GUID independent of Aspire node1/node2/node3 resource names. The real flow captures each original authenticated endpoint identity and requires it unchanged after restoration; public SDK/official MCP status comparisons bind that actual GUID rather than an invented resource-name identity.
 
 
@@ -255,3 +257,46 @@ IntegrationTests ClusterReplication Lifecycle/ReplicaIsolationOwner.cs owns part
 Related REQ/AC-SESSIONREAD-001..004. The existing IntegrationTests ClusterReplication DocumentSessionReadRf3Authorization owns a complete grant revoke→valid-minimum rejection→administrator unchanged document→grant restore→healthy continuation through direct SDK, official MCP and Q1 CALL. Denied SDK typed reads carry no value; denied SQL SDK reads carry no JSON value; actual official errors retain dispatched request identity, safe envelope and private-data omission. Full administrator document equals the independent literal reference/revision/JSON/unredacted/empty-redactions model.
 
 Stages: canonical ClusterReplication contract and this amendment; private guarded assertion-only delta; root source join and native build; unchanged fixture-owned failover case and delivered-source Linux RF3 original evidence. Dependencies, routing, authorization, token validation, storage format, admission and lifecycle unchanged. Root owns shared integration/compiler/Git, author owns complete adapter oracle. No data migration; rollback this coherent assertion-only delta. Original failures remain preserved and acceptance remains open until required runtime reports.
+
+
+## TASK-KL021-FOLLOWER-SNAPSHOT-001 implementation contract
+
+Decision and related REQ/AC-FOLLOWERREAD-001..005 are canonical in
+[DocumentStorage](../Features/DocumentStorage.md#task-kl021-follower-snapshot-001-explicit-bounded-follower-document-reads).
+The architecture's required follower mode is a separate explicit version1 point
+read, preserving the initial strong/minimum stage boundary. Signed server-only
+DatabaseCredentialWitness, FollowerDocumentReadCapability and local snapshot use
+stable generated Orleans aliases/Ids. Existing owning DatabaseEngine credential
+issuer/verifier serves both Authenticate and final same-cut key/principal/policy/
+current+captured row validation. Public callers cannot create proof or trusted roles.
+
+Ordered integration: frozen contract and broader unsupported inventory; guarded
+Abstractions DTO/alias + Core Authorization/DocumentStorage + Orleans
+ClusterRouting capture/barrier/final-admission + Server canonical routes/catalog/
+safe-output + shared SDK transport; authored native Unit17 ZoneTree functional and
+Schema2 supporting cases;28 actual independently owned Aspire RF3 SDK/official
+MCP/Q1 held/refusal/cancel/no-quorum/restoration cases; root full solution/native
+census/source/PE/PDB checks and exact-current committed Linux qualification.
+Root alone owns shared source joins/compiler/formatter/Git; author retains whole
+acceptance ownership. Existing dependencies, unique request grain, node-local
+store/apply ownership, admission/deadline/cancel/drain, readiness and cleanup are
+unchanged. No data/storage/legacy migration, private transport, history allocation
+or stronger durability promise is introduced. Homogeneous current first-release
+sources/images include the new explicit operation. Rollback removes the new
+capability and its catalog/SDK/tests coherently, retaining original strong routes.
+New source/tests remain unexecuted and ADR completion cannot be inferred. Broader
+KL021 model stale modes and remote forwarding stay open until their contracts
+and actual acceptance are complete.
+
+```mermaid
+sequenceDiagram
+  participant Client
+  participant Gateway
+  participant RequestGrain
+  participant LocalOwner
+  Gateway->>RequestGrain: Signed server-created native witness
+  RequestGrain->>LocalOwner: Capture one bounded committed document cut
+  RequestGrain->>LocalOwner: Fresh quorum and apply barrier
+  RequestGrain->>LocalOwner: Revalidate key principal policy and both rows
+  LocalOwner-->>Client: Explicit data cut and current authority cut or safe refusal
+```

docs/ADR/ADR-072-authorized-sql-model-views.md

@@ -108,3 +108,12 @@ flowchart LR
     Models --> Policy[Rebased field-use checks and safe projection]
     Policy --> Result[Bounded ordered rows without lease authority]
 ```
+
+
+### TASK-AUTH-KL015-MODEL-VIEW-DENIAL-001
+
+REQ/AC-AUTH-005/006/009 and REQ/AC-SQLVIEW-002/003/005 require a failed event/queue SQL request to carry no partial page or protected payload/header metadata. Freeze before the test extension under unchanged ADR-014/015/022/072. The existing two real persisted model-authority cases check the SDK error code only at field-use denial and have no actual foreign model partition. Extend those same whole flows using a second genuinely administrator-seeded event/queue partition with its own tenant. The original non-admin persisted own-tenant credential must receive exact PermissionDenied/safe scope detail for both foreign SQL model sources through SDK and official MCP. Every failed SDK result must be IsFailed, Value null and contain no credential or any of the four literal event/queue payload/header canaries in complete native serialization; official MCP must retain its exact error envelope and omit those same canaries from the complete native result. Apply the complete privacy/no-page oracle to the original same-tenant denied sensitive predicate too.
+
+Before and after foreign rejections, actual administrator native stream and message inspection plus SQL rows must equal the literal seeded histories and Ready/unclaimed queue state. Compare ordered logical rows and complete original native records, require positive cuts, and never infer equal cluster-wide cuts across separate calls. The original authorized redacted SDK/MCP read follows the denials, then a real persisted field grant exposes the literal selected value, followed by actual revocation. Original transport, topology, grant epoch, deadlines and cleanup stay unchanged. No product fix or new runtime hook is presumed from this coverage gap.
+
+Ownership: existing QueryExecution Cases/SqlModelViewRf3QueueAuthorityTests.cs and SqlModelViewRf3EventAuthorityTests.cs; new feature-local Helpers/SqlModelViewRf3ForeignTenantFlow.cs and Assertions/SqlModelViewRf3DenialAssertions.cs; requirements here and Authorization/QueryExecution with ADR072. Root alone joins/compiles/formats/delivers. Stages: contract, guarded source-only test repair, coherent native build/discovery, both actual Aspire RF3 flows, exact-source original Linux TRX and source/image/artifact receipts. Native discovery, source review and historical weaker passes cannot qualify these stronger flows. Rollback removes these case extensions and private helpers together; wire, provider, public API, persisted format and UI are N/A. KL015 remains open until current repaired C1 and all required acceptance gates are proven.