From d52154cd64e56063dc6fb69ddbf9d499d1510424 Mon Sep 17 00:00:00 2001 From: Jonathan Langevin Date: Tue, 6 Oct 2026 15:49:36 -0400 Subject: [PATCH 1/2] chore(ci): stage trust for exact policy check repair --- .github/public-workflow-action-allowlist.json | 40 +++++ .../public-workflow-command-allowlist.json | 152 ++++++++++++++++++ .../public-workflow-executable-allowlist.json | 16 ++ .../public-workflow-presence-allowlist.json | 6 + 4 files changed, 214 insertions(+) diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json index f3461aa..ead3b7e 100644 --- a/.github/public-workflow-action-allowlist.json +++ b/.github/public-workflow-action-allowlist.json @@ -118,5 +118,45 @@ "contextSHA256": "b8f88db240092833ebe1a3fe2a8f68a9a5ee0858d64e650a43159f3587c76797", "state": "active", "rationale": "Exact selected policy Go setup." + }, + { + "path": ".github/workflows/ci.yml", + "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956", + "nodeSHA256": "2e0ab657507095c018435a0da34a76ffffd3ca15eb3ceff7c2b17e13ebbb9383", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956", + "nodeSHA256": "50a4a8d5a662beda4b4b57507d7342495a175dd663e5c1e247961dcbb5d83bee", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5", + "nodeSHA256": "72a9f885834e7e7cfc170d24954ed15b9c11a222760a6b919510993561321f03", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff", + "nodeSHA256": "63e1fbea8394f4452eca79cb20922e0b2b95957668000216016ece59a792c060", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02", + "nodeSHA256": "0fe822ed8559961639e22a7249495326099fd0c0302ee96b5ecdf0e6434d6385", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed immutable action node and inherited execution context.", + "state": "staged" } ] diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json index 773144a..aa19c1d 100644 --- a/.github/public-workflow-command-allowlist.json +++ b/.github/public-workflow-command-allowlist.json @@ -854,5 +854,157 @@ "contextSHA256": "b8f88db240092833ebe1a3fe2a8f68a9a5ee0858d64e650a43159f3587c76797", "state": "active", "rationale": "Fail closed on any candidate symlink." + }, + { + "path": ".github/workflows/ci.yml", + "command": "$assignment", + "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed $assignment statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "check-public-workflow-policy.sh", + "statementSHA256": "059267b9a877a8957428b61e6450583c9962076265d2e5021c62503cbaaa80cd", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed check-public-workflow-policy.sh statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "cp", + "statementSHA256": "0d014a1d348020afc447050504e37ef90fff840616f0bd14bbe55fa8691ff82c", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed cp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "cp", + "statementSHA256": "f24c02e0a37916516a87e3adb67605ee89a9829472e4b8c1ea728f5e6b30fc13", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed cp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "echo", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed echo statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "exit", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed builtin statement and complete workflow context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "go", + "statementSHA256": "4b2eb9bc1a70c92294c2a9f9ff2429166f819eec67e05a3db30b46dfc3ea08de", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed go statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "go", + "statementSHA256": "f9f85ad974896d0638b921502dcc30e4a553f92830be8bdc9914a8959bf142ee", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed go statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "mktemp", + "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed mktemp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "abca00ffde9ce2b84108aa4b5161a54703373b74d9cd4d64625103d19db1b800", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "sed", + "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed sed statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "sed", + "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed sed statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "test", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed builtin statement and complete workflow context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "test-public-workflow-policy.sh", + "statementSHA256": "c133baf851f841a2a19da61077e346d5f5d6d7640e23b310a3c11f8307370a2a", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed test-public-workflow-policy.sh statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "10a8deeda60dd3240448a5f198fa8b22207e27f405c1bc21fd9178b8d27b94bf", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "67815ba97241cf4f93fa278d1412e0fae91e87afc65f43fe52d211243a2bb95e", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "95886645768adfe207686bd3667365dff6bcdd9a4fdf24a4365b54afaf9fbd75", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "rationale": "Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" } ] diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json index cbbe444..0beb52b 100644 --- a/.github/public-workflow-executable-allowlist.json +++ b/.github/public-workflow-executable-allowlist.json @@ -30,5 +30,21 @@ "state": "active", "sha256": "5066dea5a461524cbda244f7ca00cdd85127457406af9966fd638d3648fd276a", "rationale": "Runs credential-free released-engine host conformance for the provider plugin." + }, + { + "path": ".github/workflows/scripts/check-public-workflow-policy.sh", + "workflowPath": ".github/workflows/ci.yml", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "state": "staged", + "sha256": "297b344d854f461a61e9c85475b528c335ccba3f27f0a039d2a6944f84c1f8b7", + "rationale": "Enforces the credential-free public workflow boundary before other CI proof." + }, + { + "path": ".github/workflows/scripts/test-public-workflow-policy.sh", + "workflowPath": ".github/workflows/ci.yml", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "state": "staged", + "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9", + "rationale": "Exercises fail-closed workflow policy mutations in the CI test job." } ] diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json index 0f18af6..bfe0b71 100644 --- a/.github/public-workflow-presence-allowlist.json +++ b/.github/public-workflow-presence-allowlist.json @@ -28,5 +28,11 @@ "contextSHA256": "50ddd8592c22d83996429e9a303b9676bf747f1742687c81f5320d9a371b467e", "state": "active", "presence": "present" + }, + { + "path": ".github/workflows/ci.yml", + "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", + "state": "staged", + "presence": "present" } ] From 298b0548a8f842d71a6efee337e6e86110e24b57 Mon Sep 17 00:00:00 2001 From: Jonathan Langevin Date: Tue, 6 Oct 2026 18:35:44 -0400 Subject: [PATCH 2/2] chore(ci): 01-stage-trust for exact policy check contract --- recovery_workflow_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/recovery_workflow_test.go b/recovery_workflow_test.go index 1ed7e80..6d14316 100644 --- a/recovery_workflow_test.go +++ b/recovery_workflow_test.go @@ -11,8 +11,8 @@ import ( "testing" ) -// Entire CI, trust and executable inventory at immutable 5e5887a5. -const recoveryTrustedInventorySHA256 = "0d7179d840de07d0791ada93c2e1be1cc228a2eb37efbd93baba439ea669f250" +// Entire CI, trust and executable inventory at the approved check-contract trust staging baseline. +const recoveryTrustedInventorySHA256 = "0a4569f3fbf7bc49e6879879ad75b14c5424be723fd9a2882aa059b6a378415e" func recoveryTrustedInventory(root string) (string, int, error) { var paths []string @@ -54,7 +54,7 @@ func TestRecoveryCIAndTrustBytesUnchanged(t *testing.T) { t.Fatal(err) } if count != 46 || digest != recoveryTrustedInventorySHA256 { - t.Fatalf("CI/trust/script bytes differ from immutable base: files=%d digest=%s", count, digest) + t.Fatalf("CI/trust/script bytes differ from approved baseline: files=%d digest=%s", count, digest) } }