chore(ci): stage trust for exact policy check repair

.github/public-workflow-action-allowlist.json

@@ -118,5 +118,45 @@
     "contextSHA256": "b8f88db240092833ebe1a3fe2a8f68a9a5ee0858d64e650a43159f3587c76797",
     "state": "active",
     "rationale": "Exact selected policy Go setup."
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956",
+    "nodeSHA256": "2e0ab657507095c018435a0da34a76ffffd3ca15eb3ceff7c2b17e13ebbb9383",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed immutable action node and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956",
+    "nodeSHA256": "50a4a8d5a662beda4b4b57507d7342495a175dd663e5c1e247961dcbb5d83bee",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed immutable action node and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5",
+    "nodeSHA256": "72a9f885834e7e7cfc170d24954ed15b9c11a222760a6b919510993561321f03",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed immutable action node and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff",
+    "nodeSHA256": "63e1fbea8394f4452eca79cb20922e0b2b95957668000216016ece59a792c060",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed immutable action node and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
+    "nodeSHA256": "0fe822ed8559961639e22a7249495326099fd0c0302ee96b5ecdf0e6434d6385",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed immutable action node and inherited execution context.",
+    "state": "staged"
   }
 ]

.github/public-workflow-command-allowlist.json

@@ -854,5 +854,157 @@
     "contextSHA256": "b8f88db240092833ebe1a3fe2a8f68a9a5ee0858d64e650a43159f3587c76797",
     "state": "active",
     "rationale": "Fail closed on any candidate symlink."
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "$assignment",
+    "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed $assignment statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "check-public-workflow-policy.sh",
+    "statementSHA256": "059267b9a877a8957428b61e6450583c9962076265d2e5021c62503cbaaa80cd",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed check-public-workflow-policy.sh statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "cp",
+    "statementSHA256": "0d014a1d348020afc447050504e37ef90fff840616f0bd14bbe55fa8691ff82c",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed cp statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "cp",
+    "statementSHA256": "f24c02e0a37916516a87e3adb67605ee89a9829472e4b8c1ea728f5e6b30fc13",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed cp statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "echo",
+    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed echo statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "exit",
+    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed builtin statement and complete workflow context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "go",
+    "statementSHA256": "4b2eb9bc1a70c92294c2a9f9ff2429166f819eec67e05a3db30b46dfc3ea08de",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed go statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "go",
+    "statementSHA256": "f9f85ad974896d0638b921502dcc30e4a553f92830be8bdc9914a8959bf142ee",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed go statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "mktemp",
+    "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed mktemp statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "rm",
+    "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed rm statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "rm",
+    "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed rm statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "rm",
+    "statementSHA256": "abca00ffde9ce2b84108aa4b5161a54703373b74d9cd4d64625103d19db1b800",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed rm statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "sed",
+    "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed sed statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "sed",
+    "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed sed statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "test",
+    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed builtin statement and complete workflow context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "test-public-workflow-policy.sh",
+    "statementSHA256": "c133baf851f841a2a19da61077e346d5f5d6d7640e23b310a3c11f8307370a2a",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed test-public-workflow-policy.sh statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "wfctl",
+    "statementSHA256": "10a8deeda60dd3240448a5f198fa8b22207e27f405c1bc21fd9178b8d27b94bf",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "wfctl",
+    "statementSHA256": "67815ba97241cf4f93fa278d1412e0fae91e87afc65f43fe52d211243a2bb95e",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
+    "state": "staged"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "command": "wfctl",
+    "statementSHA256": "95886645768adfe207686bd3667365dff6bcdd9a4fdf24a4365b54afaf9fbd75",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
+    "state": "staged"
   }
 ]

.github/public-workflow-executable-allowlist.json

@@ -30,5 +30,21 @@
     "state": "active",
     "sha256": "5066dea5a461524cbda244f7ca00cdd85127457406af9966fd638d3648fd276a",
     "rationale": "Runs credential-free released-engine host conformance for the provider plugin."
+  },
+  {
+    "path": ".github/workflows/scripts/check-public-workflow-policy.sh",
+    "workflowPath": ".github/workflows/ci.yml",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "state": "staged",
+    "sha256": "297b344d854f461a61e9c85475b528c335ccba3f27f0a039d2a6944f84c1f8b7",
+    "rationale": "Enforces the credential-free public workflow boundary before other CI proof."
+  },
+  {
+    "path": ".github/workflows/scripts/test-public-workflow-policy.sh",
+    "workflowPath": ".github/workflows/ci.yml",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "state": "staged",
+    "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9",
+    "rationale": "Exercises fail-closed workflow policy mutations in the CI test job."
   }
 ]

.github/public-workflow-presence-allowlist.json

@@ -28,5 +28,11 @@
     "contextSHA256": "50ddd8592c22d83996429e9a303b9676bf747f1742687c81f5320d9a371b467e",
     "state": "active",
     "presence": "present"
+  },
+  {
+    "path": ".github/workflows/ci.yml",
+    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
+    "state": "staged",
+    "presence": "present"
   }
 ]

recovery_workflow_test.go

@@ -11,8 +11,8 @@ import (
 	"testing"
 )
 
-// Entire CI, trust and executable inventory at immutable 5e5887a5.
-const recoveryTrustedInventorySHA256 = "0d7179d840de07d0791ada93c2e1be1cc228a2eb37efbd93baba439ea669f250"
+// Entire CI, trust and executable inventory at the approved check-contract trust staging baseline.
+const recoveryTrustedInventorySHA256 = "0a4569f3fbf7bc49e6879879ad75b14c5424be723fd9a2882aa059b6a378415e"
 
 func recoveryTrustedInventory(root string) (string, int, error) {
 	var paths []string
@@ -54,7 +54,7 @@ func TestRecoveryCIAndTrustBytesUnchanged(t *testing.T) {
 		t.Fatal(err)
 	}
 	if count != 46 || digest != recoveryTrustedInventorySHA256 {
-		t.Fatalf("CI/trust/script bytes differ from immutable base: files=%d digest=%s", count, digest)
+		t.Fatalf("CI/trust/script bytes differ from approved baseline: files=%d digest=%s", count, digest)
 	}
 }