ci: validate resource dispatch identifiers

[Jeremy1844]

DO NOT MERGE — private producer grammar/length and maintainer-owned no-content staging are unverified.

Root cause

The repository_dispatch port_id crossed directly into the object-store command boundary. A malformed producer value could change the intended command argument instead of being treated as one identifier.

Confidence is high, not confirmed. The public consumer boundary is reproduced, but the private producer contract and an authorized staging run remain unavailable.

Change

• validate the raw value once against the bounded ASCII identifier grammar [A-Za-z0-9_-]{1,64}
• transfer only the validated value through structured step output
• quote the complete object-store source argument
• reject invalid input before the credential-bearing object-store step

This draft addresses only ADV-2026-0055 / RC-0055. It does not change TLS (#78), credential transport (#80), sender authorization, package provenance, import idempotency, or atomic promotion.

Regression-first evidence

• base: protected stage@9d237dd4fb37dd1fb936e3f9649020cc43a374c8
• regression: b73ceaba5060c84900cc0bfe0277524e2c42fd1c — 0/3 introduced tests pass
• fixed head: 708a25713c9d46a63ff092651ff9f19f0807c06d — 3/3 pass
• decoded Bash exercises accepted numeric/UUID/underscore/hyphen values and rejects missing/empty, oversized, Cyrillic, whitespace, path-like, and shell-significant values
• rejected values write no step output, produce only generic stderr, create no shell marker, and do not call the synthetic credential-step spy
• exact js-yaml 4.1.0 parses all eight workflows; three relevant decoded Bash scripts pass bash -n
• Actionlint 1.7.12 passes the changed workflow; diff, two-path scope, protected-object, and added-secret-pattern checks pass

The local credential-step check is synthetic. It is not a claim that GitHub-hosted step skipping or secret non-resolution has been observed.

Open-PR composition

• fix: make resource validation read-only and fail closed #76, ci: fix resource workflow path filters #77, and ci: remove unused changed-file workflow boundary #79 are path-disjoint
• ci: enforce TLS for authenticated resource writes #78 and ci: keep resource-writer credentials ephemeral #80 share port-from-v2.yml but edit independent TLS/authentication hunks
• exact fix: make resource validation read-only and fail closed #76–ci: keep resource-writer credentials ephemeral #80 plus this two-commit pair was materialized in canonical and reverse orders
• both orders pass 18/18 focused tests, eight YAML parses, three decoded Bash syntax checks, diff/protected-object/secret checks, and converge on tree 1947cadb5605d4abf0d1029f5b442ad99ab7efe1

These remain separate root causes and separate pull requests.

Required before review or merge

1. Confirm the producer's complete identifier grammar, maximum length, and versioned compatibility contract.
2. Run valid and rejected synthetic dispatches in a maintainer-owned no-content staging repository with production credentials unavailable.
3. Prove rejected input prevents the credential-bearing/object-store step and that retained logs contain neither raw payloads nor secrets.
4. Rebase on the landed one-root workflow changes and rerun the full composition matrix.

Migration, recovery, and scope

There is no user-data, schema, content, package, lockfile, or artifact migration. A rejected event should leave the repository and object store untouched. Correct the producer value and retry only after confirming no earlier partial execution; idempotency remains a separate root.

If the path must be paused, disable the dispatch/import automation. Do not restore direct event-to-command interpolation as rollback.

No credential, private package/source, cloud configuration, user data, lesson, translation, image, audio, video, PDF, Ellen G. White material, or other rights-controlled content was read, changed, or uploaded.