[AustinKelsay]

Summary

-rollout-lat1-runtime-artifact --host lat1|lat3|lat4|lat5
+rollout-lat1-runtime-artifact --host lat1|lat3|lat4|lat5|lat7

The authorized disposable release canary landed on Lat7, which the guarded wrapper did not support. Add its existing host address, source-host ID and work root using the Lat5 precedent. Update one runbook sentence and test the mapping and refusal paths. Core calls continue to go to Lat2; plan hashes, identity and closure binding, lifecycle gates and retry behavior are unchanged.

No application, schema, image, flake, lock or workflow input changes. The prepared Lat2 closure and unpromoted Runtime image remain valid. Linear is unavailable; this PR records the bounded release prerequisite.

Evidence

• Before: --host lat7 was rejected; baseline rollout suite passed 39 tests.
  After: rollout suite passes 45 tests, including exact Lat7 Runtime/machine/owner/closure binding, destination validation, drift refusal, probe gates and no retry after a Core failure. Closure tests (16), service executable tests (5), runbook facts and source structure pass.
• Opus 5.5 built and checked 618e7855286d0a2b039d3a5a15452a696b0ca2b9; Fable 5.1 independently approved that exact commit, reran the gates and caught all seven of its mutation probes. The builder caught ten additional mutations. All execution evidence is synthetic, using fake SSH; no live rollout has run.
• Host values match the owning Lat7 NixOS definition. Application, infrastructure, image and workflow subtrees are byte-identical to parent 50a98845.

Merge Danger

Door: Two-way

Reverting restores the previous host allowlist. Merging this script does not deploy or upgrade any Runtime.

Blast Radius: Operations

Lat7 serves other customers. The first live use is restricted to exactly one explicit --roll-project-id for the disposable canary, with LAT7 unset and prepare/execute from the same clean landed commit. The existing Lat7 fleet hold remains in place: no --roll-all. Operator identity arguments must match the authoritative binding because Core treats them as an upsert.

[github-actions]

Documentation census

This PR adds 0 new Markdown files and 2 lines of Markdown, and removes 0 Markdown files and 1 line of Markdown.

Net documentation change: +1 line.

Counts .md and .markdown files anywhere in the repo, case-insensitively. Lines include additions and deletions across all matching files; net change is additions minus deletions. Renamed files are not counted as new or removed. Advisory only; never a merge gate.

[alexlwn123]

Pass for this bounded wrapper change at 618e7855286d0a2b039d3a5a15452a696b0ca2b9; no actionable regression found.

Lat7's destination, source-host ID and work root match its owning NixOS definition. Core calls remain on Lat2. Traced host/scope validation, Runtime/machine/ownership and principal checks, closure/hash drift refusal, lifecycle gates, and stop-on-Core-failure behavior through the shared path.

Independently passed: 45 rollout tests with fake SSH, 16 Lat7 closure contract tests, five service-executable fixture tests, runbook facts, Bash syntax and diff whitespace checks. Checkout stayed clean. Tests used local Python 3.12/Bash/jq, not the pinned Nix environment: Nix/direnv are unavailable. No live SSH, canary, rollout preparation/execution, activation, or production changes occurred; synthetic results do not establish live rollout readiness.

CI has no reported failures so far, but Rust workspace, Dashboard, Hermes bridge and Nix static contracts are still pending. Local Nix/Rust/integration layers and CI logs were not run/read. Posting COMMENT only; this is not merge or rollout authorization, and the stated Lat7 fleet hold remains applicable.