I0907 — The running process says what it is, from an allowlist

BLOCKED wave 2 · p1 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Objective

Expose the version, revision, build profile, target and the safe platform facts of a hosted process through the existing metadata surface, with every field explicitly allowlisted.

Why

Verifying that the deployed image is the one that was built requires the running process to say which revision it is. Doing that by reflecting the environment would publish whatever the platform happens to inject, including things that must never leave the Machine.

Current state

about.rs carries the executable's own description. Nothing reports the build revision or any platform fact, because nothing is deployed.

Desired state

One metadata read reports an allowlisted set of build and platform fields, and a test proves that a value outside the allowlist cannot reach it.

Scope

• apps/majordomus-cli/src/about.rs
• apps/majordomus-cli/build.rs

Out of scope

• Any environment dump, any pass-through of unknown variables
• Any credential, token or authorization header, in any form

Dependencies

• I0902BLOCKED The deployment object becomes typed Rust that refuses nonsense

Acceptance criteria

• Version, commit revision, build profile and target are embedded at build time through the existing version infrastructure
• Platform facts are read from the hosting environment by explicit name only, and absence is reported as absence rather than as an error
• A test proves an environment variable outside the allowlist never appears in the output, including one whose name resembles a secret
• The metadata read is a registered capability and appears in OpenAPI and the reference without a second registration

Validation

• cargo test --workspace --all-features
• majordomus generate --check

Evidence required

• metadata_allowlisted
• fly_platform_fields
• redaction_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

A build timestamp defeats reproducibility. It is included only if the reproducibility decision in I0910 permits it.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0907.yaml. Read it back with majordomus plan show I0907.