Add read-only hosted qualification of the published Wizard 0.22.0 knowledge rows (Refs #4822)

.github/workflows/new-sdd-workspace-selftest.yml

@@ -154,6 +154,7 @@ jobs:
           python3 -B tests/new-sdd-workspace/knowledge-retained-upgrade-public.py --source-controls
           python3 -B tests/new-sdd-workspace/knowledge-retained-adoption-public.py --source-controls
           python3 -B tests/new-sdd-workspace/knowledge-rendering-routes-public.py --source-controls
+          python3 -B tests/new-sdd-workspace/knowledge-wizard-default-rows-public.py --source-controls
           python3 tests/new-sdd-workspace/knowledge-creation.py \
             --wizard /pure-control --sdd-cli /pure-control --insufficient-cli /pure-control \
             --providers /pure-control --workspace-package /pure-control \

.github/workflows/wizard-default-rows-public-acceptance.yml

@@ -0,0 +1,59 @@
+# Read-only hosted public acceptance run for the published Wizard 0.22.0 knowledge rows (FS-GG/.github#4822):
+# Rendering Wizard default (app, game) and fable-game PLAYER/COMPLETE with explicit typed-sdd and omitted
+# lifecycle, unpinned, on SDD.Cli 2.4.0 / Workspace.Template 0.19.3 / UI.Template 0.32.3, plus the non-SVG
+# Wizard refusal control. Public nuget.org feeds only and an isolated HOME. The job writes nothing to any
+# repository, feed, board or package registry and receives no token: `contents: read` is the only permission
+# and no credential reaches a child process. Its single output is the Actions evidence artifact an independent
+# reviewer checks against the pinned package identities. Dispatch-only.
+name: wizard-default-rows-public-acceptance
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  wizard-default-rows-acceptance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      # Frozen receiver probes, hash-verified by the adapter.
+      - uses: actions/checkout@v7
+        with:
+          repository: FS-GG/FS.GG.Templates
+          ref: f5fbd06ed9e6df40f9037c7acddf9eca3c6a14fc
+          path: templates-probe-source
+          persist-credentials: false
+      # Templates 24f3c307 descriptors; the adapter requires the Wizard's runtime main descriptors to equal their pinned hashes.
+      - uses: actions/checkout@v7
+        with:
+          repository: FS-GG/FS.GG.Templates
+          ref: 24f3c30790b401d4bc435a1b1c07c07ecfd30d76
+          path: templates-current
+          persist-credentials: false
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: "10.0.x"
+      - name: Run the published Wizard 0.22.0 knowledge rows
+        run: |
+          set -euo pipefail
+          test "$(git -C templates-probe-source rev-parse HEAD)" = f5fbd06ed9e6df40f9037c7acddf9eca3c6a14fc
+          test "$(git -C templates-current rev-parse HEAD)" = 24f3c30790b401d4bc435a1b1c07c07ecfd30d76
+          python3 -B tests/new-sdd-workspace/knowledge-wizard-default-rows-public.py --source-controls
+          python3 -B tests/new-sdd-workspace/knowledge-wizard-default-rows-public.py --run \
+            --templates "$GITHUB_WORKSPACE/templates-probe-source" --current "$GITHUB_WORKSPACE/templates-current" \
+            --work "$RUNNER_TEMP/wizard-default-rows-public"
+      - name: Keep the evidence (report, command journal and original outputs)
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: wizard-default-rows-public-acceptance
+          path: |
+            ${{ runner.temp }}/wizard-default-rows-public/report.json
+            ${{ runner.temp }}/wizard-default-rows-public/evidence/
+          if-no-files-found: error
+          retention-days: 30

docs/roadmaps/tsdd-knowledge-wizard.md

@@ -1415,3 +1415,43 @@ Only the provider's own scaffold installs UI.Template, and the raw rows reuse th
 Every installed or restored archive must equal its pinned SHA-256: SDD.Cli 2.4.0, UI.Template 0.32.3
 `747f33eb…`, Workspace.Template 0.19.3 and Coord.Cli 0.94.0. A source merge establishes no runtime result,
 and acceptance remains fdev's after an independent review of the hosted artifact.
+
+### Published Wizard 0.22.0 knowledge rows (#4822)
+
+Wizard 0.22.0 (#4811, signed archive `caa91285…`) derives an omitted lifecycle from the provider
+descriptor's default. [`knowledge-wizard-default-rows-public.py`](../../tests/new-sdd-workspace/knowledge-wizard-default-rows-public.py)
+qualifies the remaining Wizard rows unpinned, with no `--pinned` and no `--ref`, using public SDD.Cli
+2.4.0, Workspace.Template 0.19.3 and UI.Template 0.32.3. The read-only hosted operation is
+[`wizard-default-rows-public-acceptance.yml`](../../.github/workflows/wizard-default-rows-public-acceptance.yml).
+Helpers load from the accepted Rendering-routes adapter's sealed bytes.
+
+**Rows**
+
+- **Rendering Wizard default, app and game.** The lifecycle is omitted, so it falls to the Wizard's own
+  `sdd` default for Rendering. Only fable-game takes the descriptor default; the Rendering descriptor
+  default is also `sdd`, so these rows cannot tell the two apart. The provenance records `sdd`, and the
+  created product's heading confirms the sdd lane.
+  These rows have no canonical store and no knowledge CI.
+- **fable-game PLAYER and COMPLETE, each with explicit `typed-sdd` and with the lifecycle omitted.** An
+  omitted lifecycle resolves to `typed-sdd`, the fable-game descriptor default.
+  - The provenance records the bundle (an omitted bundle is `player`).
+  - The exact local pins are Fable 5.18.0, Fantomas 8.0.5, Coord 0.94.0 and SDD 2.4.0.
+  - The store and guide are present, and the owner CI equals the 0.19.3 `fs-gg-fable-game` payload.
+  - The Wizard makes no background commit.
+  - Each row passes the normal initial commit, the maintained #4723 probe and the ALL-shared export taken
+    after private capture.
+  - The ordinary pinned checker accepts 10,485,760 bytes, refuses 10,485,761, and leaves no residue.
+  - Every generated product byte and mode is preserved outside the declared knowledge paths.
+- **non-SVG (`svgFoundation=false`).** This is not a Wizard 0.22.0 route. The parser refuses
+  `--svg-foundation` with exit 2 and `unknown argument: --svg-foundation` before creating any target, and
+  the run records that refusal as a control. Non-SVG knowledge readiness stays covered by the provider route (#4773) and the raw route (#4769).
+
+The descriptors the Wizard fetches from Templates main must be byte-identical to the Templates `24f3c307`
+descriptors: Rendering `ff49732a…`, fable-game `6b3d8f2d…`. Any later change fails the run closed, which is
+why it should be dispatched before the next coherent-set publish. The installed `fsgg-sdd --version` must read 2.4.0, and `dotnet tool list` must show Wizard 0.22.0. Every
+installed or restored archive must equal its pinned SHA-256.
+
+**Scope against the Templates verifier.** The Templates `fable-reference-public` verifier, flipped for
+Wizard 0.22.0 in Templates #760, separately runs pinned (`--ref` tag) Wizard COMPLETE and PLAYER creations,
+including product builds. These rows do not repeat that run. They add the unpinned public path and the
+knowledge contract, and they build no product.