diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json
index cfbc18b..bb990c6 100644
--- a/.github/public-workflow-action-allowlist.json
+++ b/.github/public-workflow-action-allowlist.json
@@ -79,53 +79,13 @@
     "state": "active",
     "rationale": "Exact selected policy Go setup."
   },
-  {
-    "path": ".github/workflows/ci.yml",
-    "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956",
-    "nodeSHA256": "2e0ab657507095c018435a0da34a76ffffd3ca15eb3ceff7c2b17e13ebbb9383",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed immutable action node and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956",
-    "nodeSHA256": "50a4a8d5a662beda4b4b57507d7342495a175dd663e5c1e247961dcbb5d83bee",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed immutable action node and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5",
-    "nodeSHA256": "72a9f885834e7e7cfc170d24954ed15b9c11a222760a6b919510993561321f03",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed immutable action node and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff",
-    "nodeSHA256": "63e1fbea8394f4452eca79cb20922e0b2b95957668000216016ece59a792c060",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed immutable action node and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
-    "nodeSHA256": "0fe822ed8559961639e22a7249495326099fd0c0302ee96b5ecdf0e6434d6385",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed immutable action node and inherited execution context.",
-    "state": "active"
-  },
   {
     "path": ".github/workflows/ci.yml",
     "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956",
     "nodeSHA256": "2e0ab657507095c018435a0da34a76ffffd3ca15eb3ceff7c2b17e13ebbb9383",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -133,7 +93,7 @@
     "nodeSHA256": "50a4a8d5a662beda4b4b57507d7342495a175dd663e5c1e247961dcbb5d83bee",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -141,7 +101,7 @@
     "nodeSHA256": "72a9f885834e7e7cfc170d24954ed15b9c11a222760a6b919510993561321f03",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -149,7 +109,7 @@
     "nodeSHA256": "5f52e8bc5d4f74ac39c486b8605c4e16db070ea05934d4d741f739f34e43394a",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -157,14 +117,14 @@
     "nodeSHA256": "0fe822ed8559961639e22a7249495326099fd0c0302ee96b5ecdf0e6434d6385",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "nodeSHA256": "558cd5abea492ec06d260cfe3bbd499e0a6b994bbf2d5377fdaa685f3fca5f8e",
     "path": ".github/workflows/ci.yml",
     "rationale": "Exact reviewed complete public bootstrap receipt export; no credentials or control writes.",
-    "state": "staged",
+    "state": "active",
     "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
   }
 ]
diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json
index 6feb625..e0063fb 100644
--- a/.github/public-workflow-command-allowlist.json
+++ b/.github/public-workflow-command-allowlist.json
@@ -703,165 +703,13 @@
     "state": "active",
     "rationale": "Fail closed on any candidate symlink."
   },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "$assignment",
-    "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed $assignment statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "check-public-workflow-policy.sh",
-    "statementSHA256": "059267b9a877a8957428b61e6450583c9962076265d2e5021c62503cbaaa80cd",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed check-public-workflow-policy.sh statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "cp",
-    "statementSHA256": "0d014a1d348020afc447050504e37ef90fff840616f0bd14bbe55fa8691ff82c",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed cp statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "cp",
-    "statementSHA256": "f24c02e0a37916516a87e3adb67605ee89a9829472e4b8c1ea728f5e6b30fc13",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed cp statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "echo",
-    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed echo statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "exit",
-    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed builtin statement and complete workflow context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "go",
-    "statementSHA256": "4b2eb9bc1a70c92294c2a9f9ff2429166f819eec67e05a3db30b46dfc3ea08de",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed go statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "go",
-    "statementSHA256": "f9f85ad974896d0638b921502dcc30e4a553f92830be8bdc9914a8959bf142ee",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed go statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "mktemp",
-    "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed mktemp statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "rm",
-    "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed rm statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "rm",
-    "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed rm statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "rm",
-    "statementSHA256": "abca00ffde9ce2b84108aa4b5161a54703373b74d9cd4d64625103d19db1b800",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed rm statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "sed",
-    "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed sed statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "sed",
-    "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed sed statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "test",
-    "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed builtin statement and complete workflow context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "test-public-workflow-policy.sh",
-    "statementSHA256": "c133baf851f841a2a19da61077e346d5f5d6d7640e23b310a3c11f8307370a2a",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed test-public-workflow-policy.sh statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "wfctl",
-    "statementSHA256": "10a8deeda60dd3240448a5f198fa8b22207e27f405c1bc21fd9178b8d27b94bf",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "wfctl",
-    "statementSHA256": "67815ba97241cf4f93fa278d1412e0fae91e87afc65f43fe52d211243a2bb95e",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
-    "state": "active"
-  },
-  {
-    "path": ".github/workflows/ci.yml",
-    "command": "wfctl",
-    "statementSHA256": "95886645768adfe207686bd3667365dff6bcdd9a4fdf24a4365b54afaf9fbd75",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "rationale": "Exact reviewed wfctl statement and inherited execution context.",
-    "state": "active"
-  },
   {
     "path": ".github/workflows/ci.yml",
     "command": "$assignment",
     "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed $assignment statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -869,7 +717,7 @@
     "statementSHA256": "059267b9a877a8957428b61e6450583c9962076265d2e5021c62503cbaaa80cd",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed check-public-workflow-policy.sh statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -877,7 +725,7 @@
     "statementSHA256": "0d014a1d348020afc447050504e37ef90fff840616f0bd14bbe55fa8691ff82c",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed cp statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -885,7 +733,7 @@
     "statementSHA256": "f24c02e0a37916516a87e3adb67605ee89a9829472e4b8c1ea728f5e6b30fc13",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed cp statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -893,7 +741,7 @@
     "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed echo statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -901,7 +749,7 @@
     "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed builtin statement and complete workflow context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -909,7 +757,7 @@
     "statementSHA256": "4b2eb9bc1a70c92294c2a9f9ff2429166f819eec67e05a3db30b46dfc3ea08de",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed go statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -917,7 +765,7 @@
     "statementSHA256": "f9f85ad974896d0638b921502dcc30e4a553f92830be8bdc9914a8959bf142ee",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed go statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -925,7 +773,7 @@
     "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed mktemp statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -933,7 +781,7 @@
     "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -941,7 +789,7 @@
     "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -949,7 +797,7 @@
     "statementSHA256": "abca00ffde9ce2b84108aa4b5161a54703373b74d9cd4d64625103d19db1b800",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -957,7 +805,7 @@
     "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed sed statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -965,7 +813,7 @@
     "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed sed statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -973,7 +821,7 @@
     "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed builtin statement and complete workflow context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -981,7 +829,7 @@
     "statementSHA256": "c133baf851f841a2a19da61077e346d5f5d6d7640e23b310a3c11f8307370a2a",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed test-public-workflow-policy.sh statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -989,7 +837,7 @@
     "statementSHA256": "10a8deeda60dd3240448a5f198fa8b22207e27f405c1bc21fd9178b8d27b94bf",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -997,7 +845,7 @@
     "statementSHA256": "67815ba97241cf4f93fa278d1412e0fae91e87afc65f43fe52d211243a2bb95e",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "path": ".github/workflows/ci.yml",
@@ -1005,14 +853,14 @@
     "statementSHA256": "95886645768adfe207686bd3667365dff6bcdd9a4fdf24a4365b54afaf9fbd75",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.",
-    "state": "staged"
+    "state": "active"
   },
   {
     "command": "sha256sum",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "path": ".github/workflows/ci.yml",
     "rationale": "Exact reviewed complete public bootstrap receipt export; no credentials or control writes.",
-    "state": "staged",
+    "state": "active",
     "statementSHA256": "4f06eb1ddb17ddafb81b73107604ea4a5ea4b4d3d19d6f0e69bb717e0ab987da"
   },
   {
@@ -1020,7 +868,7 @@
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "path": ".github/workflows/ci.yml",
     "rationale": "Exact reviewed complete public bootstrap receipt export; no credentials or control writes.",
-    "state": "staged",
+    "state": "active",
     "statementSHA256": "e739d35965f92ee7d73a7ea8855c5947a8b61d88ad546726d7fc098a7fe75a40"
   },
   {
@@ -1028,7 +876,7 @@
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
     "path": ".github/workflows/ci.yml",
     "rationale": "Exact reviewed real policy-fixture search dependency helper; no credentials or control writes.",
-    "state": "staged",
+    "state": "active",
     "statementSHA256": "442c424de88bbb38ed77925066ff227894ddc02632bf84a98b2c730105434da4"
   }
 ]
diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json
index 0baf272..7e8beab 100644
--- a/.github/public-workflow-executable-allowlist.json
+++ b/.github/public-workflow-executable-allowlist.json
@@ -15,27 +15,11 @@
     "sha256": "5066dea5a461524cbda244f7ca00cdd85127457406af9966fd638d3648fd276a",
     "rationale": "Runs credential-free released-engine host conformance for the provider plugin."
   },
-  {
-    "path": ".github/workflows/scripts/check-public-workflow-policy.sh",
-    "workflowPath": ".github/workflows/ci.yml",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "state": "active",
-    "sha256": "297b344d854f461a61e9c85475b528c335ccba3f27f0a039d2a6944f84c1f8b7",
-    "rationale": "Enforces the credential-free public workflow boundary before other CI proof."
-  },
-  {
-    "path": ".github/workflows/scripts/test-public-workflow-policy.sh",
-    "workflowPath": ".github/workflows/ci.yml",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "state": "active",
-    "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9",
-    "rationale": "Exercises fail-closed workflow policy mutations in the CI test job."
-  },
   {
     "path": ".github/workflows/scripts/check-public-workflow-policy.sh",
     "workflowPath": ".github/workflows/ci.yml",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
-    "state": "staged",
+    "state": "active",
     "sha256": "3fbf786aad1448c55a934f3fc3ed22644d5e83fef2a1a299a09b48b803ae7d37",
     "rationale": "Exact reviewed Go1.27.2 CI context; Enforces the credential-free public workflow boundary before other CI proof."
   },
@@ -43,7 +27,7 @@
     "path": ".github/workflows/scripts/test-public-workflow-policy.sh",
     "workflowPath": ".github/workflows/ci.yml",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
-    "state": "staged",
+    "state": "active",
     "sha256": "70da3f19cd3c288b612d910f5805de24e59a393f186ed6307aeacfd79bfff839",
     "rationale": "Exact reviewed Go1.27.2 CI context; Exercises fail-closed workflow policy mutations in the CI test job."
   },
@@ -52,7 +36,7 @@
     "path": ".github/workflows/scripts/require-policy-rg.sh",
     "rationale": "Exact reviewed hosted rg provisioning and actual fixture PATH/PCRE checks.",
     "sha256": "614908108730d6a2f01f42f0e45df1b34b03fe4037fc3ece323152a355d04109",
-    "state": "staged",
+    "state": "active",
     "workflowPath": ".github/workflows/ci.yml"
   }
 ]
diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json
index fcd0be5..4d35ed0 100644
--- a/.github/public-workflow-presence-allowlist.json
+++ b/.github/public-workflow-presence-allowlist.json
@@ -23,16 +23,10 @@
     "state": "active",
     "presence": "present"
   },
-  {
-    "path": ".github/workflows/ci.yml",
-    "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2",
-    "state": "active",
-    "presence": "present"
-  },
   {
     "path": ".github/workflows/ci.yml",
     "contextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
-    "state": "staged",
+    "state": "active",
     "presence": "present"
   }
 ]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bcc844d..99ef399 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,6 +63,9 @@ Eliminates the runtime-failure surface (sentinel-stub returning `ErrApplyV1Remov
 
 ### Fixed
 
+- Retire the PR201-only policy bootstrap after its accepted cutover. Normal CI
+  now binds the real accepted main base to the candidate and builds only that
+  base's checker, retaining complete SDK/source receipts and hostile controls.
 - **App Platform active image provenance** — deployment image refs now come
   from the identified `ACTIVE` deployment's embedded spec, with an explicit
   `active_deployment.spec` source marker. Missing active specs and unsupported
diff --git a/docs/public-workflow-policy.md b/docs/public-workflow-policy.md
index f35d853..fde2dd5 100644
--- a/docs/public-workflow-policy.md
+++ b/docs/public-workflow-policy.md
@@ -82,12 +82,27 @@ Zero, adjacent, unknown, or later missing-policy bases fail closed. If `main`
 moves before bootstrap merges, rebase and update this exact SHA through review;
 never replace it with a generic missing-policy skip. After bootstrap,
 subsequent `.github/workflows` changes use trusted prior-revision policy.
+
 Because that exact base has no public policy workflow or trust manifests, the
 initial bootstrap pull request finalizes all active trust atomically. The
 required status check is installed immediately after the bootstrap merge; it
 is necessarily absent during bootstrap because no base workflow produces it.
 This exception does not apply to any later workflow-authority change.
 
+The separate Go1.27.2 normal-CI bootstrap admitted only PR201 and the first
+adoption push. Its reviewed retirement anchors the full accepted cutover
+`d85f44c7573d66ae64ec003a94158480b24ac4df`, then binds each actual main/PR event
+to its real prior accepted base and exact candidate. PR203 binds that exact
+cutover; later event bases must contain it. PR synthetic merge parents and
+candidate/checkout trees are checked independently. Only the full actual
+accepted-base checker and maps scan the inert candidate; no candidate-map or
+finite proposal override is used. Missing policy, ambiguous/shallow ancestry,
+wrong event identities and tampered source/SDK fail closed. The complete v3
+receipt retains the floor and actual authority inventories separately, all
+hostile controls, and the unchanged CI export path. Canonical `policy` and the
+required normal `test` remain separate acceptance checks; retirement does not
+waive either check or grant merge/release authority.
+
 The same stable `policy` check also runs on pushes to
 `main`, comparing `github.event.before` as trusted policy authority with the new
 commit as candidate data. Task completion remains contingent on repository
diff --git a/provider_policy_bootstrap_test.go b/provider_policy_bootstrap_test.go
index 5ba6ea4..f4468b4 100644
--- a/provider_policy_bootstrap_test.go
+++ b/provider_policy_bootstrap_test.go
@@ -138,13 +138,18 @@ type bootstrapEvent struct {
 	} `json:"repository"`
 	PullRequest struct {
 		Head struct {
+			Ref  string `json:"ref"`
 			SHA  string `json:"sha"`
 			Repo struct {
 				FullName string `json:"full_name"`
 			} `json:"repo"`
 		} `json:"head"`
 		Base struct {
-			SHA string `json:"sha"`
+			Ref  string `json:"ref"`
+			SHA  string `json:"sha"`
+			Repo struct {
+				FullName string `json:"full_name"`
+			} `json:"repo"`
 		} `json:"base"`
 	} `json:"pull_request"`
 }
@@ -421,7 +426,7 @@ func verifyBootstrapCandidateTree(checkoutTree, candidateTree string) error {
 
 func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 	if os.Getenv("GITHUB_ACTIONS") != "true" || os.Getenv("GITHUB_REPOSITORY") != bootstrapRepo || runtime.Version() != "go1.27.2" || runtime.GOOS != "linux" || runtime.GOARCH != "amd64" {
-		t.Fatal("finite bootstrap requires the admitted hosted Go1.27.2 producer; no local or generic event fallback")
+		t.Fatal("accepted-policy proof requires the admitted hosted Go1.27.2 producer; no local or missing-policy fallback")
 	}
 	root, err := os.Getwd()
 	if err != nil {
@@ -445,10 +450,11 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 	if err := json.Unmarshal(eventData, &event); err != nil {
 		t.Fatal("invalid actual GitHub event metadata")
 	}
-	binding, err := bindBootstrapEvent(os.Getenv("GITHUB_EVENT_NAME"), os.Getenv("GITHUB_WORKFLOW_REF"), os.Getenv("GITHUB_WORKFLOW_SHA"), checkout, os.Getenv("PROVIDER_BOOTSTRAP_PREPARATION_SHA"), event)
+	binding, err := bindAcceptedPolicyEvent(os.Getenv("GITHUB_EVENT_NAME"), os.Getenv("GITHUB_WORKFLOW_REF"), os.Getenv("GITHUB_WORKFLOW_SHA"), checkout, os.Getenv("GITHUB_SHA"), os.Getenv("PROVIDER_BOOTSTRAP_PREPARATION_SHA"), event)
 	if err != nil {
 		t.Fatal(err)
 	}
+	retirement := acceptedPolicyRetirementProposal(t)
 	sdkArchive := bootstrapSDKArchive(t)
 	sdkInventory, err := bootstrapSupplierSDK(sdkArchive)
 	if err != nil {
@@ -458,25 +464,47 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	manifestData, err := bootstrapRegularFile("testdata/provider-policy-bootstrap-accepted-0f72.json", 128*1024)
-	if err != nil || bootstrapHash(manifestData) != bootstrapInventorySHA {
-		t.Fatal("accepted inventory source digest mismatch")
+	manifestData, err := bootstrapRegularFile("testdata/provider-policy-accepted-d85f.json", 128*1024)
+	if err != nil || bootstrapHash(manifestData) != acceptedPolicyFloorInventorySHA {
+		t.Fatal("accepted floor inventory source digest mismatch")
 	}
 	var frozen bootstrapInventory
 	decoder := json.NewDecoder(bytes.NewReader(manifestData))
 	decoder.DisallowUnknownFields()
-	if decoder.Decode(&frozen) != nil || frozen.Commit != bootstrapBase || frozen.Tree != bootstrapBaseTree || len(frozen.Files) != 217 {
-		t.Fatal("accepted inventory is not the reviewed exact base")
+	if decoder.Decode(&frozen) != nil || decoder.Decode(new(any)) != io.EOF || frozen.Commit != acceptedPolicyFloor || frozen.Tree != acceptedPolicyFloorTree || len(frozen.Files) != 257 {
+		t.Fatal("accepted floor inventory is not the reviewed exact cutover")
+	}
+	bootstrapGit(t, root, env, "fetch", "--quiet", "--no-tags", "--depth=64", "https://github.com/"+bootstrapRepo+".git", acceptedPolicyFloor, binding.Base, binding.Candidate, bootstrapBase, "075c2c291a1f933692d9949650fc41d20c0a63f9")
+	for _, relation := range [][2]string{{acceptedPolicyFloor, binding.Base}, {binding.Base, binding.Candidate}} {
+		if _, err := providerProofCommand(t, root, env, "/usr/bin/git", "merge-base", "--is-ancestor", relation[0], relation[1]); err != nil {
+			t.Fatal("actual accepted authority/candidate does not contain the reviewed floor; missing or shallow history is not proof")
+		}
+	}
+	// Traversal output hides parents at a shallow checkout boundary. Read the
+	// exact immutable object headers instead; ancestry is checked separately.
+	checkoutCommitTree, checkoutParents, err := acceptedPolicyCommitHeaders(bootstrapGit(t, root, env, "cat-file", "commit", checkout))
+	if err != nil {
+		t.Fatal(err)
 	}
-	bootstrapGit(t, root, env, "fetch", "--quiet", "--no-tags", "--depth=64", "https://github.com/"+bootstrapRepo+".git", bootstrapBase, binding.Candidate)
-	if _, err := providerProofCommand(t, root, env, "/usr/bin/git", "merge-base", "--is-ancestor", bootstrapBase, binding.Candidate); err != nil {
-		t.Fatal("candidate does not contain the actual accepted stage")
+	if err := verifyAcceptedPolicyParents(binding, checkoutParents); err != nil {
+		t.Fatal(err)
 	}
 	tmp := t.TempDir()
-	trusted, candidate := filepath.Join(tmp, "trusted"), filepath.Join(tmp, "candidate")
-	accepted := materializeBootstrapTree(t, root, bootstrapBase, trusted, env, &frozen)
+	floor, candidate := filepath.Join(tmp, "floor"), filepath.Join(tmp, "candidate")
+	acceptedFloor := materializeBootstrapTree(t, root, acceptedPolicyFloor, floor, env, &frozen)
+	if err := verifyBootstrapAuthority(floor, acceptedFloor); err != nil {
+		t.Fatal(err)
+	}
+	trusted, accepted := floor, acceptedFloor
+	if binding.Base != acceptedPolicyFloor {
+		trusted = filepath.Join(tmp, "trusted")
+		accepted = materializeBootstrapTree(t, root, binding.Base, trusted, env, nil)
+	}
 	scanned := materializeBootstrapTree(t, root, binding.Candidate, candidate, env, nil)
 	checkoutTree := strings.TrimSpace(string(bootstrapGit(t, root, env, "rev-parse", "HEAD^{tree}")))
+	if checkoutCommitTree != checkoutTree {
+		t.Fatal("immutable checkout commit header tree differs from the actual checkout tree")
+	}
 	if err := verifyBootstrapCandidateTree(checkoutTree, scanned.Tree); err != nil {
 		t.Fatal(err)
 	}
@@ -516,14 +544,10 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 		t.Fatal(err)
 	}
 	checkerSHA := bootstrapHash(checkerBytes)
-	proposalArgs, proposal := bootstrapReceiptPolicyProposal(t, trusted, candidate, filepath.Join(tmp, "receipt-context-proposal"))
 	var outcomes []string
-	scanAt := func(label, authorityRoot, scanRoot, diagnostic string, amendment bool) {
+	scanAt := func(label, authorityRoot, scanRoot, diagnostic string) {
 		t.Helper()
 		args := []string{"--repo", authorityRoot, "--scan-root", scanRoot}
-		if amendment {
-			args = append(args, proposalArgs...)
-		}
 		output, err := providerProofCommand(t, trusted, []string{"PATH=/usr/bin:/bin", "LANG=C.UTF-8"}, binary, args...)
 		if diagnostic == "" {
 			if err != nil || !strings.Contains(string(output), "public workflow policy passed") {
@@ -537,12 +561,16 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 		}
 		outcomes = append(outcomes, label+":PASS")
 	}
-	scan := func(label, scanRoot, diagnostic string) { scanAt(label, trusted, scanRoot, diagnostic, true) }
-	scanAt("reject-exporter-with-unamended-accepted-authority", trusted, candidate, "no trust group matches workflow", false)
+	scan := func(label, scanRoot, diagnostic string) { scanAt(label, trusted, scanRoot, diagnostic) }
+	// Retain the real pre-cutover rejection as historical data. Accepted A
+	// legitimately admits this workflow; no candidate maps override its policy.
+	preCutover := filepath.Join(tmp, "pre-cutover")
+	materializeBootstrapTree(t, root, bootstrapBase, preCutover, env, nil)
+	scanAt("reject-exporter-with-historical-unamended-0f72-authority", preCutover, candidate, "no trust group matches workflow")
 	scan("complete-actual-candidate", candidate, "")
 	unprepared := filepath.Join(tmp, "unprepared")
 	materializeBootstrapTree(t, root, "075c2c291a1f933692d9949650fc41d20c0a63f9", unprepared, env, nil)
-	scanAt("reject-actual-unprepared-predecessor", unprepared, candidate, "no trust group matches workflow", false)
+	scanAt("reject-actual-unprepared-predecessor", unprepared, candidate, "no trust group matches workflow")
 	// Candidate source/modules/maps are data, never executable authority.
 	for _, poison := range []struct{ Path, Content string }{
 		{".github/workflows/policytool/main.go", "package main\nfunc main() { panic(\"candidate executed\") }\n"},
@@ -621,6 +649,9 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 	if err := verifyBootstrapAuthority(trusted, accepted); err != nil {
 		t.Fatal(err)
 	}
+	if err := verifyBootstrapAuthority(floor, acceptedFloor); err != nil {
+		t.Fatal("reviewed accepted floor changed during the actual proof")
+	}
 	if err := verifyBootstrapAuthority(candidate, scanned); err != nil {
 		t.Fatal("owned controls did not restore the full actual candidate")
 	}
@@ -634,14 +665,15 @@ func TestActualAcceptedPolicyBootstrap(t *testing.T) {
 	}
 	sdkInventoryJSON, _ := json.Marshal(sdkInventory)
 	bootstrapReceipt(t, map[string]any{
-		"Schema": "provider-actual-accepted-policy-bootstrap/v2", "Binding": binding,
+		"Schema": "provider-actual-accepted-policy/v3", "Binding": binding,
 		"WorkflowRef": os.Getenv("GITHUB_WORKFLOW_REF"), "RunID": os.Getenv("GITHUB_RUN_ID"), "RunAttempt": os.Getenv("GITHUB_RUN_ATTEMPT"),
-		"AcceptedCommit": bootstrapBase, "AcceptedTree": accepted.Tree, "AcceptedInventorySHA256": bootstrapInventorySHA,
-		"Candidate": scanned, "CheckoutTree": checkoutTree, "SDKRoot": sdk, "SDKComponentsSHA256": sdkPins,
+		"AcceptedFloor": acceptedFloor, "AcceptedFloorInventorySHA256": acceptedPolicyFloorInventorySHA,
+		"AcceptedCommit": binding.Base, "AcceptedTree": accepted.Tree, "Accepted": accepted,
+		"Candidate": scanned, "CheckoutTree": checkoutTree, "CheckoutParents": checkoutParents, "SDKRoot": sdk, "SDKComponentsSHA256": sdkPins,
 		"SDKArchiveURL": bootstrapSDKURL, "SDKArchiveSHA256": bootstrapSDKArchiveSHA, "SDKArchiveBytes": len(sdkArchive), "SDKInventorySHA256": bootstrapHash(sdkInventoryJSON), "SDKFiles": len(sdkInventory),
 		"Compiler": built.GoVersion, "CompilerEnvironment": metadata, "CheckerSHA256": checkerSHA, "CheckerModules": modules,
-		"PolicyAuthorityProposal": proposal, "PolicyAuthorityProposalSHA256": bootstrapReceiptAmendmentSHA,
-		"Outcomes": outcomes, "Admission": "Supporting real candidate and finite proposed context-amendment proof only. Accepted0f72 authority is unchanged and genuinely rejects the exporter. Exact owner admission of the separate proposal, source/SDK provenance and cutover permission are required. Historical Go1264 declarations and GO-2026-5932 remain visible.",
+		"RetirementTransition": retirement, "RetirementTransitionSHA256": acceptedPolicyRetirementSHA,
+		"Outcomes": outcomes, "Admission": "Actual accepted-base checker and maps only; no candidate map or finite proposal override. Complete floorA, event-selected accepted base and exact candidate/checkout histories are separately bound. Initial root execution retains hosted setup-go/TLS trust; subsequent compiler/checker bytes are authenticated against the approved supplier SDK. Source/normal CI and canonical proof are separate acceptance gates; receipt alone is not merge or release authority. Historical Go1264 declarations and GO-2026-5932 remain visible.",
 	}, map[string]any{"Binding": binding, "CandidateTree": scanned.Tree, "SDKArchiveSHA256": bootstrapSDKArchiveSHA, "SDKInventorySHA256": bootstrapHash(sdkInventoryJSON), "CheckerSHA256": checkerSHA, "Outcomes": outcomes})
 }
 
diff --git a/provider_policy_retirement_test.go b/provider_policy_retirement_test.go
new file mode 100644
index 0000000..1b5f8b2
--- /dev/null
+++ b/provider_policy_retirement_test.go
@@ -0,0 +1,290 @@
+package digitalocean_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const acceptedPolicyFloor = "d85f44c7573d66ae64ec003a94158480b24ac4df"
+const acceptedPolicyFloorTree = "99b885d3d5e0eb34c9a59e99810760550140d28a"
+const acceptedPolicyFloorInventorySHA = "28a832e8cc090a16c1895b75529460f6051efbbe1c5f8c3250dbc21d1f81f5bc"
+const acceptedPolicyRetirementSHA = "846e2cc853920612a6dd4f6aa39b658433b202be09e55ef62b5008460d58e4fb"
+const acceptedPolicyWorkflowSHA = "58a01a556fa391928e3bc8a56d517df770fae9479789bcd0758f0834421e8cc4"
+const acceptedPolicyWorkflowContext = "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545"
+const acceptedPolicyRetirementHeadRef = "fix/policytool-go1272-promote-20261009"
+
+type policyRetirement struct {
+	Schema                       string `json:"schema"`
+	Repository                   string `json:"repository"`
+	AcceptedFloor                string `json:"acceptedFloor"`
+	AcceptedFloorTree            string `json:"acceptedFloorTree"`
+	AcceptedFloorInventorySHA256 string `json:"acceptedFloorInventorySHA256"`
+	AcceptedFloorFiles           int    `json:"acceptedFloorFiles"`
+	RetirementPullRequest        int    `json:"retirementPullRequest"`
+	RetirementHeadRef            string `json:"retirementHeadRef"`
+	WorkflowPath                 string `json:"workflowPath"`
+	WorkflowSHA256               string `json:"workflowSHA256"`
+	WorkflowContextSHA256        string `json:"workflowContextSHA256"`
+	HistoricalBootstrapBase      string `json:"historicalBootstrapBase"`
+	Transition                   string `json:"transition"`
+	ReceiptSchema                string `json:"receiptSchema"`
+}
+
+func validatePolicyRetirement(data, workflow []byte) (policyRetirement, error) {
+	var proposal policyRetirement
+	if bootstrapHash(data) != acceptedPolicyRetirementSHA || bootstrapHash(workflow) != acceptedPolicyWorkflowSHA {
+		return proposal, errors.New("reviewed retirement transition or unchanged CI bytes differ")
+	}
+	d := json.NewDecoder(bytes.NewReader(data))
+	d.DisallowUnknownFields()
+	if d.Decode(&proposal) != nil || d.Decode(new(any)) != io.EOF || proposal.Schema != "provider-policy-bootstrap-retirement/v1" || proposal.Repository != bootstrapRepo || proposal.AcceptedFloor != acceptedPolicyFloor || proposal.AcceptedFloorTree != acceptedPolicyFloorTree || proposal.AcceptedFloorInventorySHA256 != acceptedPolicyFloorInventorySHA || proposal.AcceptedFloorFiles != 257 || proposal.RetirementPullRequest != 203 || proposal.RetirementHeadRef != acceptedPolicyRetirementHeadRef || proposal.WorkflowPath != ".github/workflows/ci.yml" || proposal.WorkflowSHA256 != acceptedPolicyWorkflowSHA || proposal.WorkflowContextSHA256 != acceptedPolicyWorkflowContext || proposal.HistoricalBootstrapBase != bootstrapBase || proposal.ReceiptSchema != "provider-actual-accepted-policy/v3" {
+		return proposal, errors.New("reviewed retirement transition identity differs")
+	}
+	return proposal, nil
+}
+
+func acceptedPolicyRetirementProposal(t *testing.T) policyRetirement {
+	t.Helper()
+	data, err := bootstrapRegularFile("testdata/provider-policy-bootstrap-retirement.json", 16*1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	workflow, err := bootstrapRegularFile(".github/workflows/ci.yml", 128*1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proposal, err := validatePolicyRetirement(data, workflow)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return proposal
+}
+
+func acceptedPolicyCommit(value string) bool {
+	return bootstrapCommitPattern.MatchString(value) && value != strings.Repeat("0", 40)
+}
+
+// Retirement removes the one-shot event gate, not the accepted-policy proof.
+// Metadata selects a real prior accepted base; Git inventory and ancestry are
+// independently checked before its checker can be built. Candidate policy is data.
+func bindAcceptedPolicyEvent(name, workflowRef, workflowSHA, checkout, githubSHA, preparationSHA string, event bootstrapEvent) (bootstrapBinding, error) {
+	b := bootstrapBinding{WorkflowSHA: workflowSHA, Checkout: checkout}
+	if event.Repository.FullName != bootstrapRepo || !acceptedPolicyCommit(workflowSHA) || workflowSHA != checkout || githubSHA != checkout || preparationSHA != "" {
+		return b, errors.New("accepted-policy proof requires exact hosted checkout/workflow identities without preparation authority")
+	}
+	switch name {
+	case "pull_request":
+		pr := event.PullRequest
+		if event.Number <= 0 || workflowRef != fmt.Sprintf("%s/.github/workflows/ci.yml@refs/pull/%d/merge", bootstrapRepo, event.Number) || pr.Base.Ref != "main" || pr.Base.Repo.FullName != bootstrapRepo || pr.Head.Repo.FullName != bootstrapRepo || !acceptedPolicyCommit(pr.Base.SHA) || !acceptedPolicyCommit(pr.Head.SHA) || pr.Base.SHA == pr.Head.SHA || checkout == pr.Head.SHA || checkout == pr.Base.SHA {
+			return b, errors.New("accepted-policy PR requires the actual main base and distinct same-repository candidate/synthetic merge")
+		}
+		if event.Number == 203 && (pr.Base.SHA != acceptedPolicyFloor || pr.Head.Ref != acceptedPolicyRetirementHeadRef) {
+			return b, errors.New("retirement PR203 must bind the exact accepted cutover and reviewed candidate ref")
+		}
+		b.Mode, b.Base, b.Candidate, b.Merge = "accepted-policy-pr", pr.Base.SHA, pr.Head.SHA, checkout
+	case "push":
+		if event.Ref != "refs/heads/main" || workflowRef != bootstrapRepo+"/.github/workflows/ci.yml@refs/heads/main" || !acceptedPolicyCommit(event.Before) || event.After != checkout || event.Before == event.After {
+			return b, errors.New("accepted-policy main proof requires distinct exact prior authority and actual main checkout")
+		}
+		b.Mode, b.Base, b.Candidate = "accepted-policy-main", event.Before, checkout
+	default:
+		return b, errors.New("accepted-policy proof has no local, helper, tag or missing-policy event fallback")
+	}
+	return b, nil
+}
+
+func verifyAcceptedPolicyParents(binding bootstrapBinding, parents []string) error {
+	if binding.Mode == "accepted-policy-pr" {
+		if len(parents) != 2 || parents[0] != binding.Base || parents[1] != binding.Candidate || binding.Merge != binding.Checkout {
+			return errors.New("actual PR merge parents do not exactly bind accepted base and candidate in order")
+		}
+		return nil
+	}
+	if binding.Mode != "accepted-policy-main" || len(parents) == 0 || parents[0] != binding.Base || binding.Candidate != binding.Checkout || binding.Merge != "" {
+		return errors.New("actual main checkout does not have the event-selected prior authority as first parent")
+	}
+	return nil
+}
+
+func acceptedPolicyCommitHeaders(data []byte) (string, []string, error) {
+	end := bytes.Index(data, []byte("\n\n"))
+	if len(data) > 128*1024 || end < 0 {
+		return "", nil, errors.New("immutable checkout commit headers exceed the bound or are incomplete")
+	}
+	lines := strings.Split(string(data[:end]), "\n")
+	if len(lines) == 0 || !strings.HasPrefix(lines[0], "tree ") || !acceptedPolicyCommit(strings.TrimPrefix(lines[0], "tree ")) {
+		return "", nil, errors.New("immutable checkout tree header is not exact")
+	}
+	tree := strings.TrimPrefix(lines[0], "tree ")
+	var parents []string
+	closed := false
+	for _, line := range lines[1:] {
+		if strings.HasPrefix(line, "tree ") {
+			return "", nil, errors.New("immutable checkout has a duplicate tree header")
+		}
+		if strings.HasPrefix(line, "parent ") {
+			parent := strings.TrimPrefix(line, "parent ")
+			if closed || !acceptedPolicyCommit(parent) || len(parents) >= 64 {
+				return "", nil, errors.New("immutable checkout parent header is not exact and ordered")
+			}
+			parents = append(parents, parent)
+		} else {
+			closed = true
+		}
+	}
+	return tree, parents, nil
+}
+
+func TestAcceptedPolicyCommitHeadersAcrossRealShallowBoundary(t *testing.T) {
+	root := t.TempDir()
+	env := bootstrapChildEnv("/unused-sdk-no-Go-invocation")
+	bootstrapGit(t, root, env, "init", "--quiet")
+	emptyTree := filepath.Join(root, "empty-tree")
+	if err := os.WriteFile(emptyTree, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	tree := strings.TrimSpace(string(bootstrapGit(t, root, env, "hash-object", "-w", "-t", "tree", emptyTree)))
+	commit := func(name string, parents ...string) string {
+		t.Helper()
+		var data strings.Builder
+		fmt.Fprintf(&data, "tree %s\n", tree)
+		for _, parent := range parents {
+			fmt.Fprintf(&data, "parent %s\n", parent)
+		}
+		data.WriteString("author Fixture <fixture@example.invalid> 1 +0000\ncommitter Fixture <fixture@example.invalid> 1 +0000\n\n" + name + "\n")
+		path := filepath.Join(root, name)
+		if err := os.WriteFile(path, []byte(data.String()), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return strings.TrimSpace(string(bootstrapGit(t, root, env, "hash-object", "-w", "-t", "commit", path)))
+	}
+	base := commit("base")
+	candidate := commit("candidate", base)
+	merge := commit("merge", base, candidate)
+	bootstrapGit(t, root, env, "update-ref", "HEAD", merge)
+	if err := os.WriteFile(filepath.Join(root, ".git", "shallow"), []byte(merge+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := strings.TrimSpace(string(bootstrapGit(t, root, env, "show", "-s", "--format=%P", merge))); got != "" {
+		t.Fatal("regression did not reproduce hidden traversal parents at the real shallow boundary")
+	}
+	actualTree, parents, err := acceptedPolicyCommitHeaders(bootstrapGit(t, root, env, "cat-file", "commit", merge))
+	binding := bootstrapBinding{Mode: "accepted-policy-pr", Base: base, Candidate: candidate, Checkout: merge, WorkflowSHA: merge, Merge: merge}
+	if err != nil || actualTree != tree || verifyAcceptedPolicyParents(binding, parents) != nil {
+		t.Fatal("immutable actual merge object did not retain its exact ordered parents across the shallow boundary")
+	}
+	for _, raw := range []string{"", "tree " + tree, "tree " + strings.Repeat("0", 40) + "\n\n", "tree " + tree + "\nparent invalid\n\n", "tree " + tree + "\nauthor fixture\nparent " + base + "\n\n", "tree " + tree + "\ntree " + tree + "\n\n"} {
+		if _, _, err := acceptedPolicyCommitHeaders([]byte(raw)); err == nil {
+			t.Fatal("malformed, duplicate or reordered immutable headers were admitted")
+		}
+	}
+}
+
+func TestAcceptedPolicyRetirementEventBindings(t *testing.T) {
+	candidate, merge := strings.Repeat("b", 40), strings.Repeat("c", 40)
+	pr := bootstrapEvent{Number: 203}
+	pr.Repository.FullName = bootstrapRepo
+	pr.PullRequest.Head.SHA, pr.PullRequest.Head.Ref, pr.PullRequest.Head.Repo.FullName = candidate, acceptedPolicyRetirementHeadRef, bootstrapRepo
+	pr.PullRequest.Base.SHA, pr.PullRequest.Base.Ref, pr.PullRequest.Base.Repo.FullName = acceptedPolicyFloor, "main", bootstrapRepo
+	workflow := bootstrapRepo + "/.github/workflows/ci.yml@refs/pull/203/merge"
+	b, err := bindAcceptedPolicyEvent("pull_request", workflow, merge, merge, merge, "", pr)
+	if err != nil || b.Base != acceptedPolicyFloor || b.Candidate != candidate || b.Merge != merge {
+		t.Fatal("reviewed retirement candidate/base binding was rejected")
+	}
+	if verifyAcceptedPolicyParents(b, []string{acceptedPolicyFloor, candidate}) != nil {
+		t.Fatal("exact ordered actual merge parents were rejected")
+	}
+	for _, parents := range [][]string{nil, {acceptedPolicyFloor}, {candidate, acceptedPolicyFloor}, {acceptedPolicyFloor, merge}, {acceptedPolicyFloor, candidate, merge}} {
+		if verifyAcceptedPolicyParents(b, parents) == nil {
+			t.Fatal("wrong, absent, reversed or additional actual merge parents were accepted")
+		}
+	}
+	for _, mutate := range []func(*bootstrapEvent){
+		func(e *bootstrapEvent) { e.Number = 0 },
+		func(e *bootstrapEvent) { e.Number = -1 },
+		func(e *bootstrapEvent) { e.Number = 201 },
+		func(e *bootstrapEvent) { e.Repository.FullName = "attacker/repo" },
+		func(e *bootstrapEvent) { e.PullRequest.Base.Repo.FullName = "attacker/repo" },
+		func(e *bootstrapEvent) { e.PullRequest.Base.Ref = "other" },
+		func(e *bootstrapEvent) { e.PullRequest.Base.SHA = candidate },
+		func(e *bootstrapEvent) { e.PullRequest.Head.Repo.FullName = "attacker/repo" },
+		func(e *bootstrapEvent) { e.PullRequest.Head.Ref = "other" },
+		func(e *bootstrapEvent) { e.PullRequest.Head.SHA = "" },
+		func(e *bootstrapEvent) { e.PullRequest.Head.SHA = strings.Repeat("0", 40) },
+		func(e *bootstrapEvent) { e.PullRequest.Head.SHA = merge },
+	} {
+		changed := pr
+		mutate(&changed)
+		if _, err := bindAcceptedPolicyEvent("pull_request", workflow, merge, merge, merge, "", changed); err == nil {
+			t.Fatal("changed retirement PR metadata was admitted")
+		}
+	}
+	for _, values := range [][4]string{{workflow + "wrong", merge, merge, ""}, {workflow, candidate, merge, ""}, {workflow, merge, candidate, ""}, {workflow, merge, merge, candidate}} {
+		if _, err := bindAcceptedPolicyEvent("pull_request", values[0], values[1], merge, values[2], values[3], pr); err == nil {
+			t.Fatal("wrong workflow, checkout SHA or preparation authority was admitted")
+		}
+	}
+	// Later PRs still need their real main base; retirement is not another
+	// finite PR203 gate. Runtime Git checks separately require floor ancestry.
+	later := pr
+	later.Number, later.PullRequest.Base.SHA = 204, strings.Repeat("d", 40)
+	later.PullRequest.Head.Ref = "fix/later"
+	if _, err := bindAcceptedPolicyEvent("pull_request", bootstrapRepo+"/.github/workflows/ci.yml@refs/pull/204/merge", merge, merge, merge, "", later); err != nil {
+		t.Fatal("later real accepted-base event was rejected")
+	}
+	main := bootstrapEvent{Ref: "refs/heads/main", Before: acceptedPolicyFloor, After: candidate}
+	main.Repository.FullName = bootstrapRepo
+	workflow = bootstrapRepo + "/.github/workflows/ci.yml@refs/heads/main"
+	b, err = bindAcceptedPolicyEvent("push", workflow, candidate, candidate, candidate, "", main)
+	if err != nil || b.Base != acceptedPolicyFloor || b.Candidate != candidate || b.Merge != "" || verifyAcceptedPolicyParents(b, []string{acceptedPolicyFloor, merge}) != nil {
+		t.Fatal("actual accepted-main before/after binding was rejected")
+	}
+	if verifyAcceptedPolicyParents(b, nil) == nil || verifyAcceptedPolicyParents(b, []string{merge, acceptedPolicyFloor}) == nil {
+		t.Fatal("wrong main prior-authority parent was admitted")
+	}
+	for _, mutate := range []func(*bootstrapEvent){
+		func(e *bootstrapEvent) { e.Before = strings.Repeat("0", 40) },
+		func(e *bootstrapEvent) { e.Before = "" },
+		func(e *bootstrapEvent) { e.Before = candidate },
+		func(e *bootstrapEvent) { e.After = merge },
+		func(e *bootstrapEvent) { e.Ref = "refs/heads/other" },
+	} {
+		changed := main
+		mutate(&changed)
+		if _, err := bindAcceptedPolicyEvent("push", workflow, candidate, candidate, candidate, "", changed); err == nil {
+			t.Fatal("changed actual main metadata was admitted")
+		}
+	}
+	for _, name := range []string{"workflow_dispatch", "pull_request_target", "unknown", ""} {
+		if _, err := bindAcceptedPolicyEvent(name, workflow, candidate, candidate, candidate, "", main); err == nil {
+			t.Fatal("unsupported event fallback was admitted")
+		}
+	}
+}
+
+func TestAcceptedPolicyRetirementRejectsChangedProposalOrCI(t *testing.T) {
+	data, err := os.ReadFile("testdata/provider-policy-bootstrap-retirement.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	workflow, err := os.ReadFile(".github/workflows/ci.yml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := validatePolicyRetirement(data, workflow); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := validatePolicyRetirement(append(append([]byte(nil), data...), '\n'), workflow); err == nil {
+		t.Fatal("changed reviewed retirement transition was admitted")
+	}
+	if _, err := validatePolicyRetirement(data, append(append([]byte(nil), workflow...), '\n')); err == nil {
+		t.Fatal("changed live CI authority was admitted")
+	}
+}
diff --git a/recovery_workflow_test.go b/recovery_workflow_test.go
index a0179f8..8cdc257 100644
--- a/recovery_workflow_test.go
+++ b/recovery_workflow_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 )
 
-// Exact CI, trust and executable inventory for the reviewed finite Go 1.27.2 receipt-export proposal.
-const recoveryTrustedInventorySHA256 = "048b4c93a8c33b5a7783aedfa4123f28abde37559ce4c5613a410bb016605906"
+// Exact CI, trust and executable inventory after reviewed Go 1.27.2 trust promotion.
+const recoveryTrustedInventorySHA256 = "014c2d07e84a730e0dc6a381f363f0e658b96b3144d5553389ad5d587978ab0f"
 
 func recoveryTrustedInventory(root string) (string, int, error) {
 	var paths []string
diff --git a/testdata/provider-policy-accepted-d85f.json b/testdata/provider-policy-accepted-d85f.json
new file mode 100644
index 0000000..1ec30b8
--- /dev/null
+++ b/testdata/provider-policy-accepted-d85f.json
@@ -0,0 +1,1805 @@
+{
+  "commit": "d85f44c7573d66ae64ec003a94158480b24ac4df",
+  "files": [
+    {
+      "blob": "2409d9882f3083ae129c4c3e00f1442fa3b3d26e",
+      "bytes": 589,
+      "mode": "100644",
+      "path": ".github/ISSUE_TEMPLATE/bug_report.md",
+      "sha256": "cebf08c7a81e372f67a4e1c49d2e68c348b7f8efebd3e82c97e6238684a4afe0"
+    },
+    {
+      "blob": "bfcf5e916ec2a9985f35db8f6e2a62fa19409732",
+      "bytes": 519,
+      "mode": "100644",
+      "path": ".github/ISSUE_TEMPLATE/feature_request.md",
+      "sha256": "f20e97efb7ca999312450976a13bc29a7b6a132fe17c38fd8a1dd2be0d82d39d"
+    },
+    {
+      "blob": "a510115c6f86bb739ae3a748f9f4e8f4aa9725b6",
+      "bytes": 436,
+      "mode": "100644",
+      "path": ".github/PULL_REQUEST_TEMPLATE.md",
+      "sha256": "55e8d0a52ce37f9b5256a763fde52dc619e46beeda82a33c1a4e454dcac3526e"
+    },
+    {
+      "blob": "cfbc18b03102265884f9a1f654375f1963cb709a",
+      "bytes": 8903,
+      "mode": "100644",
+      "path": ".github/public-workflow-action-allowlist.json",
+      "sha256": "82ba8e9e97902e7303833ff64fd01dba33150af8f9d2d16b8d08335e5115da81"
+    },
+    {
+      "blob": "6feb625a5acab53bd05265426a82fbaa75297d86",
+      "bytes": 48388,
+      "mode": "100644",
+      "path": ".github/public-workflow-command-allowlist.json",
+      "sha256": "09a4e37005caf3d6287e4d5bbde304fa5c686cd98621b1341316f7c301d708d0"
+    },
+    {
+      "blob": "0baf2722423e1bd7d0fc66afdce2964077a784f3",
+      "bytes": 2994,
+      "mode": "100644",
+      "path": ".github/public-workflow-executable-allowlist.json",
+      "sha256": "4d587be37f15bad92528a18c4ecd6e7e365a621f3ff631ac222f0b9d4cbad4da"
+    },
+    {
+      "blob": "fcd0be5d515be2fbdf7701ff576921ae77db1229",
+      "bytes": 1183,
+      "mode": "100644",
+      "path": ".github/public-workflow-presence-allowlist.json",
+      "sha256": "a5b38841a5695379f88a3c27e6885bd5f3894df421e5875b0f61e89037adef82"
+    },
+    {
+      "blob": "fe51488c7066f6687ef680d6bfaa4f7768ef205c",
+      "bytes": 3,
+      "mode": "100644",
+      "path": ".github/public-workflow-secret-allowlist.json",
+      "sha256": "37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570"
+    },
+    {
+      "blob": "e6157cbfaed864bb41d19e07d60423fed60b291b",
+      "bytes": 4240,
+      "mode": "100644",
+      "path": ".github/workflows/ci.yml",
+      "sha256": "58a01a556fa391928e3bc8a56d517df770fae9479789bcd0758f0834421e8cc4"
+    },
+    {
+      "blob": "df6392de269b45fd76225416c86549d4892efa65",
+      "bytes": 2826,
+      "mode": "100644",
+      "path": ".github/workflows/grpc-version-sync.yml",
+      "sha256": "450cbb14403c2a21e7d6eb8cba87b869ae6ddd6daae5a920510e1a5b29c7d2bb"
+    },
+    {
+      "blob": "c34be463bc442b64f7a6edcdd35bfdee8c547b5b",
+      "bytes": 2576,
+      "mode": "100644",
+      "path": ".github/workflows/iac-host-conformance.yml",
+      "sha256": "f8294ab62c0ff5e1b829baf1003ff5e9451edbfdec5870c309618bb503bfd1c2"
+    },
+    {
+      "blob": "0e3cb88b97680e698eae23377047f6a224c402a8",
+      "bytes": 161,
+      "mode": "100644",
+      "path": ".github/workflows/policytool/go.mod",
+      "sha256": "51755e897f3de3cec86ca02e0bc954c019c54b0f807b33c943eadca5860d171b"
+    },
+    {
+      "blob": "ea0e47936acf287abb54ec3bd9e3b93c3c644dfd",
+      "bytes": 1348,
+      "mode": "100644",
+      "path": ".github/workflows/policytool/go.sum",
+      "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c"
+    },
+    {
+      "blob": "159e548645814fe3c374a4b76a9410c9418d1d10",
+      "bytes": 64311,
+      "mode": "100644",
+      "path": ".github/workflows/policytool/main.go",
+      "sha256": "e47f0f53fa91b800809a2cb04fdafca5af4a4a1441772139410ef82a9bd55884"
+    },
+    {
+      "blob": "4269d31a23d1ca0e7f38083531e77e2571b7adc6",
+      "bytes": 25482,
+      "mode": "100644",
+      "path": ".github/workflows/policytool/main_test.go",
+      "sha256": "acf2b56ac0228604844c3241ca05cb07792b45645fb2746d12bcf1698251393b"
+    },
+    {
+      "blob": "e99bc19b64a36cbe0fa4d103c5e614d74a60b7ba",
+      "bytes": 3954,
+      "mode": "100644",
+      "path": ".github/workflows/public-workflow-policy.yml",
+      "sha256": "4b0ad69a1e56b2a27594fcfc3206eb97d1ae56e24de993fed891addc8a00594d"
+    },
+    {
+      "blob": "60068bed87c307c70815aac014a0fe2ec81f35e7",
+      "bytes": 2669,
+      "mode": "100644",
+      "path": ".github/workflows/release.yml",
+      "sha256": "d2769516166ed5a5b14575084c708df1e4c22f6c15cde0d9b4081d108a12065b"
+    },
+    {
+      "blob": "62330735035750d2c75aa4dece005744a7d46c37",
+      "bytes": 2865,
+      "mode": "100755",
+      "path": ".github/workflows/scripts/check-public-workflow-policy.sh",
+      "sha256": "3fbf786aad1448c55a934f3fc3ed22644d5e83fef2a1a299a09b48b803ae7d37"
+    },
+    {
+      "blob": "db5b82cfee13d820559946316f0b27dffa418785",
+      "bytes": 186,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/lifecycle-future.yml",
+      "sha256": "346dbde7b48e262ab8bfb873928a57237d75311d3fa1b4f16f3fc740553c5621"
+    },
+    {
+      "blob": "e9ef7910f1cb70fbb3234354047f0573012ce821",
+      "bytes": 180,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/lifecycle-old.yml",
+      "sha256": "89f1d85407aa3ccf41aa3248c02b3d431d3da6422979e0208b0caea933ab91ad"
+    },
+    {
+      "blob": "6437aa682c63724f070438d47cd4c4c121810eaf",
+      "bytes": 711,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/pass-expression-and-deny-guard.yml",
+      "sha256": "e5b4986658ef9168c1e7fed863a91a0b55bc4e1dd37e45aeec04c464819da9c5"
+    },
+    {
+      "blob": "30a4a91af55e97af25371c9b6b8d1d6e11fd739a",
+      "bytes": 401,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/pass-negative-guard.yml",
+      "sha256": "258c2222d7a7a5b36fec169abee70626816d27ce15e4fdf8346a8f387f9a78a9"
+    },
+    {
+      "blob": "712e67263ba5ef57827d69663f238a27ccf1e306",
+      "bytes": 1591,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/pass.yml",
+      "sha256": "20ddb2c48cd097d2803b799dfb647efb98cb5466fd93407520bb46821035447c"
+    },
+    {
+      "blob": "e3856bff620b4a87ef4290f089869b9970858211",
+      "bytes": 1035,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-command-analysis.yml",
+      "sha256": "589658280ae8623d932e691323b138c439a28fe27a79ea2859be7c00600b6820"
+    },
+    {
+      "blob": "e7e1c86165a5f4635541744f2b689fcc4fa8931b",
+      "bytes": 439,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-deny-pattern-execution.yml",
+      "sha256": "c8475ed82b6fb7ac4ec227f48becc4a148d7d3665a5fdfdbac19096cca7c2165"
+    },
+    {
+      "blob": "4e613c4865003eb2b8e131b496e841dc0f45dc22",
+      "bytes": 487,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-dynamic-secrets.yml",
+      "sha256": "7900842a6adf772396eb4893925d26b71e1a4560053305031d7c4e15b3e2f5f8"
+    },
+    {
+      "blob": "f873ce43a0fa3e3cc71ebf12e5d7c6055d8bead6",
+      "bytes": 472,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-env-indirection.yml",
+      "sha256": "6b524ac4c498f45d68896676f75c8171033558a9a270f5158870ae36604218d7"
+    },
+    {
+      "blob": "ea2515885fb40146626078a71ac9988527641c82",
+      "bytes": 774,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-execution-context.yml",
+      "sha256": "b4deeab49c3c7f427f9c37e35cba927038397108c110cfc38a965a54a5f6d5e2"
+    },
+    {
+      "blob": "64aeceb2db32f998db4393dc6cfeecd159918663",
+      "bytes": 770,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-global.yml",
+      "sha256": "43620c1094cf6a8223f4b35c18bf54a621e09b5f5922b835bd7e22a48f1f205d"
+    },
+    {
+      "blob": "6b30fa9437a346692408adb90ccef3e18730b73c",
+      "bytes": 332,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-guard-suffix.yml",
+      "sha256": "4b5623b44d1dcef0198ce914a16a358180f65d733d5521863b4606178ea20823"
+    },
+    {
+      "blob": "52b8cb6ebb9b9704eb2b4095d61c652ffc34d44e",
+      "bytes": 210,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-missing-shell.yml",
+      "sha256": "58757a1e09107185710dd3a2c401d6a3691d1c11f4db7f41b8a4f8dde57d0574"
+    },
+    {
+      "blob": "89341259a94e1ef438c56286d0fd2732877bec9a",
+      "bytes": 444,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-permissions.yml",
+      "sha256": "24ac3b5c02f97b7b3ec2e06f2d7c7c46035a17dda029ed8918c3e54d8e6933c4"
+    },
+    {
+      "blob": "b495e19d86d1a016b61c4c10313d05bf2d07538e",
+      "bytes": 428,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-provider-uses.yml",
+      "sha256": "3f6a028a527a04b1bcddd087174b56b85916fc347da23cb86b76948b2a006f45"
+    },
+    {
+      "blob": "8a5649cde5457bbd3e88e4dbf2cb44785907ffe2",
+      "bytes": 338,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-runners.yml",
+      "sha256": "cbfec39b289dfcbee247f6fa5a415c01921ab02e03c63bd974df1322a6159050"
+    },
+    {
+      "blob": "3ba1c157dcf041b55a8e7768f2c0dae61057fb43",
+      "bytes": 259,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-script-execution.yml",
+      "sha256": "6e57329ba154ee32a37c2c8227f75db5422d9fdf3487180f4f8d388891c04f62"
+    },
+    {
+      "blob": "2335e156a036f1d02c7d4c1101dafdc39e3c8075",
+      "bytes": 524,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-secret-syntax.yml",
+      "sha256": "3ef3fc0c94a53510069d63e58e7a7eef51de884d7446fe20476d60c4fa078648"
+    },
+    {
+      "blob": "3cbf1c11f8b8d4d1772da4163bc1871ee3151e39",
+      "bytes": 820,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-shell-inheritance.yml",
+      "sha256": "330bc5a511a1c14d6adadd7e7f19a1baacdf47b513a2382e7cfa060babc460e0"
+    },
+    {
+      "blob": "294235e317610f704fdea64de9f9736fd756c3b7",
+      "bytes": 396,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-shell.yml",
+      "sha256": "6dffd2756cf468c9bf4c268bfebfd1c4bfb96e81e30137a7dafbd0d39161df00"
+    },
+    {
+      "blob": "8f3ace225db586994b948aa8feddd29616d7e1fb",
+      "bytes": 1187,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-statement-authority.yml",
+      "sha256": "2ae4ecdde184f102004b81cca0de0e345278c7ebc2aa0993f5a8ef47acf50e91"
+    },
+    {
+      "blob": "9df9845190f681b6a6ed56000077f7fea4838e6c",
+      "bytes": 988,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-unreviewed-uses.yml",
+      "sha256": "4e1a4f1d5c7b147af24dac04448617a77649e711366ab19701d6e878a1c0a274"
+    },
+    {
+      "blob": "fe5a24fdb456b311c71d60f1e729ecf2de5638cc",
+      "bytes": 2355,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-unsafe-programs.yml",
+      "sha256": "5c464126d992dc5305ca68c6ebb0f7086650d0e86dc56aee35ee0de40e6b1f96"
+    },
+    {
+      "blob": "5747e2eef561ef01ea8aff9993f345729e3580c8",
+      "bytes": 758,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject-yaml-structure.yml",
+      "sha256": "e564fe3b6655a68c242038c98f480fe432ed840aa3325caab88e052343352402"
+    },
+    {
+      "blob": "792ef6f379308a367a40006853c32606c63b8a9b",
+      "bytes": 1629,
+      "mode": "100644",
+      "path": ".github/workflows/scripts/fixtures/public-workflow-policy/reject.yml",
+      "sha256": "e98e5b29312f6541e6d71fc532943a055c9164923cd560710d47414ac80aecc1"
+    },
+    {
+      "blob": "53195461a38b2d501c62c6e0d329e6d3ab531cf7",
+      "bytes": 638,
+      "mode": "100755",
+      "path": ".github/workflows/scripts/require-policy-rg.sh",
+      "sha256": "614908108730d6a2f01f42f0e45df1b34b03fe4037fc3ece323152a355d04109"
+    },
+    {
+      "blob": "ffd3438054d563f010eab9ec09bdeaee532ba87f",
+      "bytes": 101351,
+      "mode": "100755",
+      "path": ".github/workflows/scripts/test-public-workflow-policy.sh",
+      "sha256": "70da3f19cd3c288b612d910f5805de24e59a393f186ed6307aeacfd79bfff839"
+    },
+    {
+      "blob": "25c9da1cdcf19f4e72c7dcd600864e875f3b0f98",
+      "bytes": 4941,
+      "mode": "100755",
+      "path": ".github/workflows/scripts/verify-public-workflow-branch-protection.sh",
+      "sha256": "a21c953ee35182f570926ee12bc36cd2d04a5a32f7f17a786deb2a2ce5eb233f"
+    },
+    {
+      "blob": "5801c45ed53f73e9ea6f89e26accdca71ae2a594",
+      "bytes": 54,
+      "mode": "100644",
+      "path": ".gitignore",
+      "sha256": "e4a8b5a076ff752ccb4f021bd9f1688f3c0db623076374211af337dc448cf134"
+    },
+    {
+      "blob": "ced50c8f34b03f50ffbe66386c73a71cb68ad07a",
+      "bytes": 1597,
+      "mode": "100644",
+      "path": ".goreleaser.yaml",
+      "sha256": "4b625eb438226fd335bcdd83cf53fb834ba60f157da876a38a9804de255787f5"
+    },
+    {
+      "blob": "bcc844dcb55014a62bf2b6d04a307e337f7d9622",
+      "bytes": 40479,
+      "mode": "100644",
+      "path": "CHANGELOG.md",
+      "sha256": "c106e51802b8916e19417bd7d0bb42d1d6b8fd00cef0a955ee79955f8c20f56a"
+    },
+    {
+      "blob": "453caab807f510d23073e9ef2d68bf5af6d634cd",
+      "bytes": 793,
+      "mode": "100644",
+      "path": "CONTRIBUTING.md",
+      "sha256": "92e0eb7c66b91589a5950a5211bcd350485ccaa597753e811a96927d538be0cd"
+    },
+    {
+      "blob": "ee1ede98a8cca4e7650d53c6c75e8475515ed6dd",
+      "bytes": 1068,
+      "mode": "100644",
+      "path": "LICENSE",
+      "sha256": "659616b88b400d75d2773c62ebb74a7f2294562627c69fdafe3936117170f013"
+    },
+    {
+      "blob": "c5e6688a9944ce25f1cc7dc6b561d7c2f4bfdbed",
+      "bytes": 7181,
+      "mode": "100644",
+      "path": "README.md",
+      "sha256": "ea55e78eb421b4a6bb36eca5269d313cf5f2a1ec14363cb89f2372253c149fc4"
+    },
+    {
+      "blob": "e2ef0ec23181460d77304e8c6fab22f51b339dce",
+      "bytes": 1251,
+      "mode": "100644",
+      "path": "cmd/plugin/main.go",
+      "sha256": "e30da2dafcdcb42aa5f62df80931ce9c9dd761aedf2c5c52ae2636267ddb38cd"
+    },
+    {
+      "blob": "9416236c99a18d71efc2ddfac66c703ed9610615",
+      "bytes": 12738,
+      "mode": "100644",
+      "path": "cmd/plugin/plugin.json",
+      "sha256": "1ebbb3b37ab592393756eb463ab68e3e881893fc1792b310a546bcaa47039d78"
+    },
+    {
+      "blob": "b31a4832aeca337f66dc4f8a7b4ff3428f5b5252",
+      "bytes": 117,
+      "mode": "100644",
+      "path": "doc.go",
+      "sha256": "4aa76cb7170ed7b985fc3902dbcfdd98aa5f50b4f29557e41b3801ffc0609612"
+    },
+    {
+      "blob": "bb6ca6e04e38e7296939107716b6c6c0d44cc03f",
+      "bytes": 6432,
+      "mode": "100644",
+      "path": "docs/DEPLOYMENT_STRATEGIES.md",
+      "sha256": "498543f3307848c5c09d81f5f12dd3cd8dadd3f08a316e4e4e1074b5b3c13463"
+    },
+    {
+      "blob": "de958d3fb73b4cecd88e0831833972473c55d2fa",
+      "bytes": 8043,
+      "mode": "100644",
+      "path": "docs/container-registry.md",
+      "sha256": "bdae0f85054414369071772331b207a4ec4ac5a9726d68775c9c6801978a635e"
+    },
+    {
+      "blob": "4dc9a0d79222d9554d453f69879ef180c542c281",
+      "bytes": 2289,
+      "mode": "100644",
+      "path": "docs/migrations/spaces-state-backend.md",
+      "sha256": "b2b0ccc63f7d0a20629eb37b2957950fa7abad417d97387841c8f11f2cd14eb8"
+    },
+    {
+      "blob": "59b8f76fe10ab2f9797fab7b4454dc4d30381cb8",
+      "bytes": 10208,
+      "mode": "100644",
+      "path": "docs/plans/2026-04-24-provider-id-state-heal-design.md",
+      "sha256": "f1cd9e9038a57cf1e26d08d46d545a3312612857c655f5cc17233375c9ca076b"
+    },
+    {
+      "blob": "0ecee9e5c3380c1a791d926ff66184d5170242a4",
+      "bytes": 29249,
+      "mode": "100644",
+      "path": "docs/plans/2026-04-24-provider-id-state-heal.md",
+      "sha256": "ccfe256e7b78f52f1f07be5efad953c0bc49752e51e67454a024fb03ab4eecdc"
+    },
+    {
+      "blob": "04c6348280158024dbe8403d6a083ae6be5dde90",
+      "bytes": 16816,
+      "mode": "100644",
+      "path": "docs/plans/2026-05-23-true-blue-green-validation-design.md",
+      "sha256": "7a41597cf9d5de8f9b2ad35b6c8ddce6421f128d181fdf89d661ec8e5cf7ce47"
+    },
+    {
+      "blob": "ab5ccc09075db2e45947680e092ccae43c89b3ed",
+      "bytes": 45759,
+      "mode": "100644",
+      "path": "docs/plans/2026-05-23-true-blue-green-validation.md",
+      "sha256": "4d106ac1ced5c9f7001382313e0e3e989f3dcbf9e172bd8e146f15b77fead08c"
+    },
+    {
+      "blob": "02dfe8cc56544da5d7355c99379b7aa436a29253",
+      "bytes": 65,
+      "mode": "100644",
+      "path": "docs/plans/2026-05-23-true-blue-green-validation.md.scope-lock",
+      "sha256": "1bc89c2c9d5a146e5acccc510b970f6026ab05fb3c3fe2674bebecd21fe2f818"
+    },
+    {
+      "blob": "1b2bb612ef114231140bb585f9915885c87013be",
+      "bytes": 1609,
+      "mode": "100644",
+      "path": "docs/plans/2026-06-12-control-plane-provider-handoff-alignment.md",
+      "sha256": "3e80cfcc8845a394d227344f1ace42c08fb8ecc4f590fbbdeaee45a578e713a3"
+    },
+    {
+      "blob": "8eeed0b30e11abe627b893d093f63f6791928ff6",
+      "bytes": 3400,
+      "mode": "100644",
+      "path": "docs/plans/2026-06-12-control-plane-provider-handoff-design-review.md",
+      "sha256": "ae7bb2ae3b8328d034a42154a52191ab7d3c005f029b4235d7460811d65894ad"
+    },
+    {
+      "blob": "f2a3fde0a88f007e038ac97ceabf34fcc38f0c50",
+      "bytes": 6557,
+      "mode": "100644",
+      "path": "docs/plans/2026-06-12-control-plane-provider-handoff-design.md",
+      "sha256": "e05f6cf6b13180973c0ed650a3d7869ec8d36f061fd7ff0e24fc8a234afed412"
+    },
+    {
+      "blob": "b958cf56e94e897fab6ae9e3da2f1787ee8e3bc1",
+      "bytes": 3843,
+      "mode": "100644",
+      "path": "docs/plans/2026-06-12-control-plane-provider-handoff-plan-review.md",
+      "sha256": "6ed90b56b99cd9999b9c09f7cdea481ebf5ba0ffc57383d7d668aa8444da4b37"
+    },
+    {
+      "blob": "4b49a452cb48ed9fc106fce0f428cdec73a0077c",
+      "bytes": 8579,
+      "mode": "100644",
+      "path": "docs/plans/2026-06-12-control-plane-provider-handoff.md",
+      "sha256": "ed67001e54f01d4e6e12e086054cc689f2e315d9fb4901ec0127244da44cf9fb"
+    },
+    {
+      "blob": "f35d853648f6f32373ca069161f56f676359405b",
+      "bytes": 8718,
+      "mode": "100644",
+      "path": "docs/public-workflow-policy.md",
+      "sha256": "6452887d7f34c04d03c7f9b5fecb06d83c507d52ac6a15fd29c68b556e9a654e"
+    },
+    {
+      "blob": "ca206ad69813bb7c593a40f7725435971b923a88",
+      "bytes": 759,
+      "mode": "100644",
+      "path": "docs/runtime-validation/2026-05-07-do-pin-bump.log",
+      "sha256": "0d97e06ab9d476fa9b43d4ed1234bd5c8b58ade8e2c20976d7775615683aa766"
+    },
+    {
+      "blob": "44f40afafdbaad172448bdb4dd5f627640c29aa1",
+      "bytes": 174,
+      "mode": "100644",
+      "path": "docs/runtime-validation/2026-05-07-droplet-replace-integration.log",
+      "sha256": "ab2140e64c05c919ceab635cf6304bd143355bbcdc842ed4e568a12424231b9a"
+    },
+    {
+      "blob": "19f5f46ac9b8c2d06f46a24ccc7ba4b4ef3b1b3a",
+      "bytes": 1343,
+      "mode": "100644",
+      "path": "docs/runtime-validation/2026-05-07-tc2-equivalent-launch.log",
+      "sha256": "a4e1ca046fdf54e9912530d85dbe72595c93133c2d20a91c9239bc5bee505bb9"
+    },
+    {
+      "blob": "20cfecb6d72a7ec6c8312878b151045cbbb3807b",
+      "bytes": 5493,
+      "mode": "100644",
+      "path": "docs/runtime-validation/2026-05-17-phase2.5-do-finalize-smoke.md",
+      "sha256": "f0b0d1cc5d514e7affae2a26443aa78d42a874b4ff6b09c0e5cd26364f767034"
+    },
+    {
+      "blob": "a7ab664873bcc8090002da691e75b8cce0f5104a",
+      "bytes": 692,
+      "mode": "100644",
+      "path": "examples/minimal/config.yaml",
+      "sha256": "f7c4e772ccf6e0c260776d04686a672783bc575495bf0069a8c4beb3c61936d6"
+    },
+    {
+      "blob": "2a21fb4e652ff6c70e333af8918e36fb4858bc3c",
+      "bytes": 9822,
+      "mode": "100644",
+      "path": "go.mod",
+      "sha256": "a1bad597487bec6dcaf92937f17c01cf10bd6fcf58cee32a42d24b57a4f028e0"
+    },
+    {
+      "blob": "5ddf7483ebdccea4a967ceed64a8c10fe9929f6a",
+      "bytes": 83711,
+      "mode": "100644",
+      "path": "go.sum",
+      "sha256": "d17d1e210a88a6050f5ef8011eea825a0e4cbdfbb863cc097b8ddfe37fcbca08"
+    },
+    {
+      "blob": "3793ebe5e8815080f5227d1e828a55f95c665c79",
+      "bytes": 5202,
+      "mode": "100644",
+      "path": "integration_test.go",
+      "sha256": "da39e37e71799c8df5988f85264ec44be896bd5e842d9d89a18b24c612750966"
+    },
+    {
+      "blob": "a1096783d3f814e4f892e9862605b553577edc0a",
+      "bytes": 3109,
+      "mode": "100644",
+      "path": "internal/api_logger.go",
+      "sha256": "7706dcde5f6de26734f5fb0b37b65fa56304108d565f688a3516549eb7b5a2e7"
+    },
+    {
+      "blob": "099fadcdf37bd4c6df6ee7595953a865bda512c9",
+      "bytes": 1836,
+      "mode": "100644",
+      "path": "internal/api_logger_test.go",
+      "sha256": "5169d0d42cb1bc978a3eef6ccbdf81b52aeace8b5c5605b66525de76bb707051"
+    },
+    {
+      "blob": "086351c13a0977404d3d5b16ff5413029d536c22",
+      "bytes": 27056,
+      "mode": "100644",
+      "path": "internal/app_platform_runner.go",
+      "sha256": "7c85e768c18d9d7aaed4b51c7b667c1ffc22b20045db7a3115ddb07125582c2c"
+    },
+    {
+      "blob": "16d7fc16e12abb41dc04610516f75c28fdb76494",
+      "bytes": 33486,
+      "mode": "100644",
+      "path": "internal/app_platform_runner_test.go",
+      "sha256": "1ea944c27142a2c825b1f0bd653edc8b62a0935fa3b40d3f03402fb72a05eced"
+    },
+    {
+      "blob": "09554901f3371a455d6e72b86f595e1f50a78a90",
+      "bytes": 5642,
+      "mode": "100644",
+      "path": "internal/bootstrap.go",
+      "sha256": "7004aa276b4d9df9b82c32d34be461519640e7f347392f80c3d846463172ffbd"
+    },
+    {
+      "blob": "5dc51bbcc16990bc2b0589bb0d0e28b4bede0a04",
+      "bytes": 7499,
+      "mode": "100644",
+      "path": "internal/bootstrap_test.go",
+      "sha256": "6ff61cbb375eeca078a29c057c5770ec143f6a2332a7a19721bb56403be461d8"
+    },
+    {
+      "blob": "9b584f3aa87cc32bab677ca1cfcbff14a6407981",
+      "bytes": 3543,
+      "mode": "100644",
+      "path": "internal/controlplanehandoff/fixture.go",
+      "sha256": "3563fde222cf10d70c2c9c34fd1400970dad16b9fc0088eb7dbae389616b8a90"
+    },
+    {
+      "blob": "007094668e59775c49ccc433416761bdecb75a4f",
+      "bytes": 5180,
+      "mode": "100644",
+      "path": "internal/controlplanehandoff/fixture_test.go",
+      "sha256": "d8efe7e91084e68dc6515f767263ead7f3f788e175d0ba220f8afd9730a876d6"
+    },
+    {
+      "blob": "ddd7320156f54b8be1c9c96ae7b7cecc96f0375b",
+      "bytes": 2784,
+      "mode": "100644",
+      "path": "internal/deferred_test_helpers_test.go",
+      "sha256": "dc0a1c8ecfefb9e6bac7483bd92901b131f7a42a15b5ac4c7ded0772454619ba"
+    },
+    {
+      "blob": "e37520357cd04b358bc598ed51abffe7c7bd75ff",
+      "bytes": 1520,
+      "mode": "100644",
+      "path": "internal/drivers/actions_wait.go",
+      "sha256": "ac59b0cc594d82ade43a0f376b5b8f303435d933fcfcb2e969a47b571f33b674"
+    },
+    {
+      "blob": "5f91e6fe17e51fb58733e64cdfea889a18af3bda",
+      "bytes": 7577,
+      "mode": "100644",
+      "path": "internal/drivers/api_gateway.go",
+      "sha256": "aad41562da1e4ca735fa148622dc37381efc6c4ba8fd6866e5565a6115173f04"
+    },
+    {
+      "blob": "24e98b152fcf3f3f01f2d6544d3fa802aa7ac9b5",
+      "bytes": 6502,
+      "mode": "100644",
+      "path": "internal/drivers/api_gateway_stateheal_test.go",
+      "sha256": "4a647c0828834894a44b4ec9cbad59ea756c24c140ccf9087f30477f5887e899"
+    },
+    {
+      "blob": "dff296abf9fcfc8d0e8cf05e6edec22ca1befe3e",
+      "bytes": 11870,
+      "mode": "100644",
+      "path": "internal/drivers/api_gateway_test.go",
+      "sha256": "adba9d40ac3bcd4faf6d2c82f7bd599e177901cefc38c2d143459a65c068c19e"
+    },
+    {
+      "blob": "8e208f80db134e59275c92f0f8efa83fcf1dc042",
+      "bytes": 15582,
+      "mode": "100644",
+      "path": "internal/drivers/app_domain.go",
+      "sha256": "c1bb9a64ad760c195f42d8316685f19cdc47821270b595d0960645d149b9260c"
+    },
+    {
+      "blob": "f5db1b2883dd7b2b75d20f43c22c7a45cc5b385c",
+      "bytes": 11471,
+      "mode": "100644",
+      "path": "internal/drivers/app_domain_test.go",
+      "sha256": "240f2be7c5fb62d3f7af26640c1d49da8f62d3812b501a66b0233a5d606cf5d7"
+    },
+    {
+      "blob": "110ba2c6b5e06a5374564165e4045731480b2b0f",
+      "bytes": 73053,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform.go",
+      "sha256": "789a6356b69d4a446990bf543c20bfef21188ff360de32e7c295472f45cfc2da"
+    },
+    {
+      "blob": "adb42f3933bf6bb8d587fd2ad030e604a1d2b975",
+      "bytes": 32141,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_buildspec.go",
+      "sha256": "ae3fee2eacbc7daca9c0c9832cb5dd2531e9989ee413dc50040d70887818d46e"
+    },
+    {
+      "blob": "b1273b0903a7a34df59c9c5761e715e63c72dd4d",
+      "bytes": 59641,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_buildspec_test.go",
+      "sha256": "65cec4c2b7c58b421c05ae2beb0a1899a8c51143d52523f99417e7ed9f9d2db2"
+    },
+    {
+      "blob": "fea9471365b4c851aa2cc638c7a25d1dd6788498",
+      "bytes": 486,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_export_test.go",
+      "sha256": "22531116a37c9910bc94c9e596b29dbd5cb06b3e869ce86ead698eb4531ab6f9"
+    },
+    {
+      "blob": "23b0c3e4e801bab1a7efe3dc04c8339fb8592b8f",
+      "bytes": 3561,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_image_presence.go",
+      "sha256": "66ac75810aed93eb8bae7efdb2629e63b7bb76b9318fcb2903900e490deb1d81"
+    },
+    {
+      "blob": "97ca9459531a94e8986ec114f62f158487fc1eee",
+      "bytes": 10592,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_image_presence_test.go",
+      "sha256": "5a5852598ad621dc6f56d6dab7b4b51cfafeb6ccf98ab1235ef5089057bf12ef"
+    },
+    {
+      "blob": "ce04629a9a17c9d52cede51c146e641591069e66",
+      "bytes": 5968,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_integration_test.go",
+      "sha256": "9195cb2079662404694106bba2eacb97b72c4fc27740db39498b7f402a4099f4"
+    },
+    {
+      "blob": "d0b84d10a866905c5176cfdfae8988c16fdb3de4",
+      "bytes": 1689,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_lock_test.go",
+      "sha256": "c37f963331e953f698701519eba886a1b58bcb199d8c9c56debe0a49620c4329"
+    },
+    {
+      "blob": "5e5bb77d9a2ce2631408747a9037a94ea2f4806a",
+      "bytes": 19590,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_migration_repair.go",
+      "sha256": "3a2e54000a37e6bbb4b8e35880e96ad85578db33a94a3db45de4d8e954424263"
+    },
+    {
+      "blob": "d6c0f07d61d04bf188973726994953ae7ce5ed1b",
+      "bytes": 49742,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_migration_repair_test.go",
+      "sha256": "5f4661dc74130813484bcba925d331c527d07386a4b4525cfed0c906c8068c29"
+    },
+    {
+      "blob": "052fb5689330b405df8e84a839fa7880bbfe4140",
+      "bytes": 4633,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_readiness.go",
+      "sha256": "b5a1ec741d0a6182ffd619539a4f9df6a0f5dd6313573dc0f830f8e448941f2e"
+    },
+    {
+      "blob": "d5941c9041ee5d98d2b9456c510cc6803f1f3373",
+      "bytes": 2839,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_region.go",
+      "sha256": "56226ddbf93d6d5c4ad65861a2270a849a7e8801648fecc55f124d2b7418dfc6"
+    },
+    {
+      "blob": "a4ea9c7ee9242832becc6209bc0fb0b1cf305d93",
+      "bytes": 3631,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_region_test.go",
+      "sha256": "19725b1e1a29cfa7a36e44b930bae2612e87e3d34380e62f8ab7665b522a253b"
+    },
+    {
+      "blob": "9803156395fae2c0b70bccf337692dab9900f4a4",
+      "bytes": 12895,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_stateheal_test.go",
+      "sha256": "494f4d278ccd53ea86df302f9b770fab5d79fdfbb50bf8dc2509de2ddca195d3"
+    },
+    {
+      "blob": "3fbd934bfa47d3f401eac55ad69303dbdb13251e",
+      "bytes": 109709,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_test.go",
+      "sha256": "befb23bbabca167740e8744c29ac19634aaa61ea101663154f58e0ee272b828b"
+    },
+    {
+      "blob": "4f3616617955eddbb3d3bf5f6a542cebca7b7a4a",
+      "bytes": 21964,
+      "mode": "100644",
+      "path": "internal/drivers/app_platform_troubleshoot_test.go",
+      "sha256": "53577daff44ec0001998e2f0d2d1bee50548f82c6a5bb8406ccd23c16de1e330"
+    },
+    {
+      "blob": "5d94d2ead9362e00d2379bf4d8517c3390236617",
+      "bytes": 7467,
+      "mode": "100644",
+      "path": "internal/drivers/cache.go",
+      "sha256": "fd3f30b487cb9274956361a82af93ecec08ce10c5c61775442222fe34e4a870e"
+    },
+    {
+      "blob": "4e90ba19e9b7699090efc612b0ade318a0c84579",
+      "bytes": 7119,
+      "mode": "100644",
+      "path": "internal/drivers/cache_stateheal_test.go",
+      "sha256": "8ceace4e1d23b33ac99697de8c0670176ece1d8c48a5b74d60903cc80c5c91b7"
+    },
+    {
+      "blob": "ad9ac5d4d928c5faa912c873a2d4a93c3989d3b3",
+      "bytes": 7809,
+      "mode": "100644",
+      "path": "internal/drivers/cache_test.go",
+      "sha256": "03cc126ae794684b41823f41bd495894bbe7db031e19885c0efe090173a49ace"
+    },
+    {
+      "blob": "6103bf02195d946a51688223adf21a722d143b43",
+      "bytes": 5968,
+      "mode": "100644",
+      "path": "internal/drivers/certificate.go",
+      "sha256": "d68744bf9e0c0e65c0598b9c97a42966e9656507b184fceaf9ef08affb8ad14e"
+    },
+    {
+      "blob": "3de8165547517c9a1c2c53166a209c3504fce97c",
+      "bytes": 6157,
+      "mode": "100644",
+      "path": "internal/drivers/certificate_stateheal_test.go",
+      "sha256": "1e7bc906bbbfb01039fb6274a07be314b734f4c1ad834889d9f29dc52c37bf32"
+    },
+    {
+      "blob": "81b2e210c309312a2ae9d78b2914884e19ba6c91",
+      "bytes": 6635,
+      "mode": "100644",
+      "path": "internal/drivers/certificate_test.go",
+      "sha256": "de4ef610fcd254241854bf2ccc71e173b94fb5cb4d7a4e3ea92338c5c9a42e27"
+    },
+    {
+      "blob": "3d8e131f5d1dd4a4b56b44143d974548972511a5",
+      "bytes": 34281,
+      "mode": "100644",
+      "path": "internal/drivers/database.go",
+      "sha256": "dcd21b7c9f524336c1d19330a10ed0738c731d381f799e6dc4e8fb1d8e96243c"
+    },
+    {
+      "blob": "8392c31763f377e0181927ddd58da7ac33fd1116",
+      "bytes": 16079,
+      "mode": "100644",
+      "path": "internal/drivers/database_deferred_test.go",
+      "sha256": "aceeb03be90520b3f4899251b82cba1e4e2d52d27f23af03ce9494605031523e"
+    },
+    {
+      "blob": "098babb45c64b59492a259208241954b15a51556",
+      "bytes": 7217,
+      "mode": "100644",
+      "path": "internal/drivers/database_stateheal_test.go",
+      "sha256": "7b79dec61ec16b90bf5a0d82c2942fc1869923fbbbab739278a2c02771750021"
+    },
+    {
+      "blob": "4886474e5bbf874985064ec9bdc8b794eda5e65b",
+      "bytes": 32285,
+      "mode": "100644",
+      "path": "internal/drivers/database_test.go",
+      "sha256": "c4f90ab3abec04d7bc9b049c9a751ce5e072c35974f2b3f9881d323d23bfed97"
+    },
+    {
+      "blob": "d1e62a916b6c259a4102f6832b56542fe232ae36",
+      "bytes": 3674,
+      "mode": "100644",
+      "path": "internal/drivers/database_trusted_sources_integration_test.go",
+      "sha256": "62ad22f294bdc892029c36744a156f63141831dc35b2cf603be617ada0147c6e"
+    },
+    {
+      "blob": "c5ab65779cfdbf99da717e7803ef61f83ca0265b",
+      "bytes": 14082,
+      "mode": "100644",
+      "path": "internal/drivers/database_user.go",
+      "sha256": "08ddfcbab595c5f2ed1e762aa1ba6d932a0c5a7e4cb64f5165fd016358cc8e33"
+    },
+    {
+      "blob": "22cb97720d696b899972973eebbd04a1d62d5299",
+      "bytes": 28444,
+      "mode": "100644",
+      "path": "internal/drivers/database_user_test.go",
+      "sha256": "49ecb24f8f88487184a6aa73331bd142f84eba1a5af24f8abdeeb1b4b117b782"
+    },
+    {
+      "blob": "2c082ea54ace43dc7aec5bf1071fd6c5ac4e4fd2",
+      "bytes": 24677,
+      "mode": "100644",
+      "path": "internal/drivers/deploy.go",
+      "sha256": "9b705e69f277993aa0765b97bb4015067c58b599604e62dcd5864cf641681ea5"
+    },
+    {
+      "blob": "45f47d92cea81c85280da9003ed23b0425b7217a",
+      "bytes": 8870,
+      "mode": "100644",
+      "path": "internal/drivers/deploy_internal_test.go",
+      "sha256": "47a82f9fa6e1739006b00ff899c7ef64dd294746b3c62cf84caee35a2fa4a81a"
+    },
+    {
+      "blob": "9244fb191b20ae78aac39f6ea63521db077c0774",
+      "bytes": 29420,
+      "mode": "100644",
+      "path": "internal/drivers/deploy_test.go",
+      "sha256": "8a1e1992d708c2ed544416e4c097f27c61726f6fa864cc5bfdf877926de8acb6"
+    },
+    {
+      "blob": "8ec0e4200b10083ac764283cd1b2246e9be5235b",
+      "bytes": 40541,
+      "mode": "100644",
+      "path": "internal/drivers/dns.go",
+      "sha256": "d8501a5d2c4b63307c055a060cbc27a9097fca4e5cceded4dbb631e1383a89f8"
+    },
+    {
+      "blob": "be462930926dfa456abdd555787ee6db10ce2c68",
+      "bytes": 98046,
+      "mode": "100644",
+      "path": "internal/drivers/dns_test.go",
+      "sha256": "cb845b75e848c368c63e175a5483c800d5c6039bfbdb4e431aec42cd30edec3f"
+    },
+    {
+      "blob": "4869e494d2303cadd7225d04874257729e5fcf5c",
+      "bytes": 35249,
+      "mode": "100644",
+      "path": "internal/drivers/droplet.go",
+      "sha256": "121cbd418da351eb023ef1424a8585f272160a51aa07bfcdfdf3c816e518aaf8"
+    },
+    {
+      "blob": "a898baa3e90c2d6ddfa757e56bc939f9aeda991e",
+      "bytes": 6385,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_pricing.go",
+      "sha256": "c2603309230a6eae7ec0d2a578c63e39bd814a346cb34bb88a1e6cba507a50f5"
+    },
+    {
+      "blob": "0ad4e2ffa24102802f88e2685b5cea213464460b",
+      "bytes": 13356,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_pricing_test.go",
+      "sha256": "59cb32d63ac8ecd3ebcc6abea86dc3c4e40c0ef6b5c6e8673ebcb892f2da404a"
+    },
+    {
+      "blob": "36b0d2124d0cb579c421d92a76abbdb9046cde1c",
+      "bytes": 6643,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_replace_fakes_test.go",
+      "sha256": "1a4ff397b839dea7e124a41ee6eb288791977c588a1e6507eb6b64a5dbb71219"
+    },
+    {
+      "blob": "bd83e20f05133f1c6b522e764160b1607a9b18b4",
+      "bytes": 2498,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_replace_helpers_test.go",
+      "sha256": "c85091357cef63af0fbc356cfa3a04fb2c9ec0f710388cac853bd357a0c76606"
+    },
+    {
+      "blob": "6833c312d3b921a65a237e71a842e7bd8fb4d7fa",
+      "bytes": 3072,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_replace_integration_test.go",
+      "sha256": "17389309e8cbe2ddb9192e8b85146a7366d8465b48145bed815259a428a04b96"
+    },
+    {
+      "blob": "70f3dacb3a3e13ead72b9e8b0d6d841364298d52",
+      "bytes": 8207,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_replace_test.go",
+      "sha256": "164a1f25f91aac49a3f0e54159f1e8b57ce2d71e7161bef2cf9645e908311bac"
+    },
+    {
+      "blob": "30fac667e2e3fe6542b235d7ed11a1d2c61d5eb6",
+      "bytes": 47663,
+      "mode": "100644",
+      "path": "internal/drivers/droplet_test.go",
+      "sha256": "94d4ceef237b22b7a68c5fb39c7d6d84390f0c6a8537a426b93f1d39c2181ec5"
+    },
+    {
+      "blob": "35bbfeb7d86c3be406b0ab9c686c0d6e3a70f010",
+      "bytes": 2058,
+      "mode": "100644",
+      "path": "internal/drivers/errors.go",
+      "sha256": "c5bac59e55ee6e366ef8d2f2b75851d9682ee49ced517edeaf53991a82f260ae"
+    },
+    {
+      "blob": "cfba007e873c7e7db177cb4d0ecb42feb1527909",
+      "bytes": 2517,
+      "mode": "100644",
+      "path": "internal/drivers/errors_test.go",
+      "sha256": "ac43f81e9cdf54963bdeddc00de4ca95b4479ef2e11dc103f7f93f15fea6ec82"
+    },
+    {
+      "blob": "3955830ad4eca239207d19094f20fc6146cd9773",
+      "bytes": 343,
+      "mode": "100644",
+      "path": "internal/drivers/export_test.go",
+      "sha256": "82c45d73d583021382f5ced356a3526c27a38e67b2ffac996f6a863407ac6c50"
+    },
+    {
+      "blob": "56a190d5c7155cd5feac664c86e398b75d3d82b4",
+      "bytes": 21426,
+      "mode": "100644",
+      "path": "internal/drivers/firewall.go",
+      "sha256": "7ed113e01f6bcfe5694280b4d4ba3bd918a6f1f4ac4b8eeb7bde0b4bc3ed3acd"
+    },
+    {
+      "blob": "c46959402ebb93f8c833a65bc8a44a020f47c76b",
+      "bytes": 6483,
+      "mode": "100644",
+      "path": "internal/drivers/firewall_stateheal_test.go",
+      "sha256": "28db43b5305819c161565fcc5af0e5ef27a561f3a69e7834659e8a76bbbc5adc"
+    },
+    {
+      "blob": "128290f15c011377c447c6564ca9676206a51f06",
+      "bytes": 39870,
+      "mode": "100644",
+      "path": "internal/drivers/firewall_test.go",
+      "sha256": "cdb56254d45932dbb03ec84bc325525ac342b2d03563b87d48a75d4df97f6044"
+    },
+    {
+      "blob": "32a2cad4987e7079add6650e17d224e9be825d20",
+      "bytes": 3267,
+      "mode": "100644",
+      "path": "internal/drivers/iam_role.go",
+      "sha256": "b1a8c74e262231fa3a6c530c5743b890792794578d9519df4735a586264516e7"
+    },
+    {
+      "blob": "788db74514e8b3a618e4865278fe1f8366c0a7d4",
+      "bytes": 2869,
+      "mode": "100644",
+      "path": "internal/drivers/iam_role_test.go",
+      "sha256": "d1fcdd8b571d48b92e16d09518620a2e29ea5dcc447c7723c7c2163b6e61a3dd"
+    },
+    {
+      "blob": "ddce0973dc94b9db6b29c69cd2bda3c6b995e942",
+      "bytes": 6466,
+      "mode": "100644",
+      "path": "internal/drivers/integration_test_helpers_test.go",
+      "sha256": "2d2a6b9b05caedbc8f455c50d61a17c315db23be58455bd2bee6b344998d5b78"
+    },
+    {
+      "blob": "ec39e016d1f7d2380a88f0bfbacd50e133b22f1f",
+      "bytes": 7649,
+      "mode": "100644",
+      "path": "internal/drivers/kubernetes.go",
+      "sha256": "062f72adbc5c217335b2adc82a53a326702ea381398b8050f7bde3b734ba5210"
+    },
+    {
+      "blob": "42c632066d64d7be7102a8c901ef90d6c1701a2c",
+      "bytes": 8420,
+      "mode": "100644",
+      "path": "internal/drivers/kubernetes_stateheal_test.go",
+      "sha256": "025d4e44728af0b4d76f2cf275bb1ba2f682718140a7d1c36c35ef1f49ccadd2"
+    },
+    {
+      "blob": "cd07521a1703681876de603c15cc683c4485c0f9",
+      "bytes": 8745,
+      "mode": "100644",
+      "path": "internal/drivers/kubernetes_test.go",
+      "sha256": "2d45645bafa40903da65d128e754fbeaebf13ec1361360796c1ed3c634ed8659"
+    },
+    {
+      "blob": "c5802fef316e1ebb378471617ca488cc4b608f73",
+      "bytes": 6666,
+      "mode": "100644",
+      "path": "internal/drivers/load_balancer.go",
+      "sha256": "adf5c5466f44d9eeaba766da0cf7b5a8de0cf75c67d0f59e9ca592e332480958"
+    },
+    {
+      "blob": "ee3a497256489343b889086b3784e41cb2b97dc8",
+      "bytes": 6212,
+      "mode": "100644",
+      "path": "internal/drivers/load_balancer_stateheal_test.go",
+      "sha256": "da43e93252ba252a273c24ac3204226c902f4d4bdcea3f7dffe1944cbba5fc8a"
+    },
+    {
+      "blob": "313804a1864d4b16732b847f94bb38e95215cfb3",
+      "bytes": 7487,
+      "mode": "100644",
+      "path": "internal/drivers/load_balancer_test.go",
+      "sha256": "5efad18db0b5277908a4c70393973a36561648f32ae34e27e9a4e561fddb6f4a"
+    },
+    {
+      "blob": "da38f18a53022cbfa0ae8a1d5a657e7a3eb36b7a",
+      "bytes": 3368,
+      "mode": "100644",
+      "path": "internal/drivers/providerid_format_test.go",
+      "sha256": "1c362ca7a650a4d9513c26e63e60d4712a93136df5c9d61eeb52e847b24cda45"
+    },
+    {
+      "blob": "5b44d068b1595611b4f90129c19cae4105688e03",
+      "bytes": 5424,
+      "mode": "100644",
+      "path": "internal/drivers/registry.go",
+      "sha256": "72d17296aa8df36961ef8cad6d59fb80e2726652d9c3467f450afd8e9c50aaf6"
+    },
+    {
+      "blob": "19c8e6fc409ff39253a363fd8dffc8df712ec1a6",
+      "bytes": 5774,
+      "mode": "100644",
+      "path": "internal/drivers/registry_test.go",
+      "sha256": "d5c8a1785deee2a6a5d0f012e6b71ea50db50c1c937d9bd616176939860f5384"
+    },
+    {
+      "blob": "afea1c35bd09df95dacdc0316e196533cbc04222",
+      "bytes": 760,
+      "mode": "100644",
+      "path": "internal/drivers/shared.go",
+      "sha256": "8a252bb50fa7b829abdb5fa5ca62bc58646ef925eeb0567de1cb273640429a8a"
+    },
+    {
+      "blob": "35fafed1d7889b71dc8854631d429f1ed2e01285",
+      "bytes": 1025,
+      "mode": "100644",
+      "path": "internal/drivers/shared_test.go",
+      "sha256": "0c388df0e1d49e8084b4859c1fbb6b4d97f2b44e1d7338cf4a4d5b2284621ea1"
+    },
+    {
+      "blob": "a1f87fc6d91b05a45c64460773ec6424a7a5b8c1",
+      "bytes": 6615,
+      "mode": "100644",
+      "path": "internal/drivers/spaces.go",
+      "sha256": "b684e1be9cfed4e615364b4248752a22d3140e4b1fbe58d2714cbda8b9a9c25d"
+    },
+    {
+      "blob": "b2714a95bb7ed7fcb305fd4219ceb5cf9d482d9b",
+      "bytes": 15171,
+      "mode": "100644",
+      "path": "internal/drivers/spaces_key.go",
+      "sha256": "2d001dd6bd2d1cd44d185639f91f13883942bf87caa1b4e3eeebc50cfbc592d2"
+    },
+    {
+      "blob": "5938114cef03750feac1e258eeb1f590c9f50fb9",
+      "bytes": 30735,
+      "mode": "100644",
+      "path": "internal/drivers/spaces_key_test.go",
+      "sha256": "0a303462d499ad99ed864b8afb1ffc658b38811c6a908c7929b3889e5e8e3e63"
+    },
+    {
+      "blob": "d849d23fdd61ccf295111f44ca144b6f977abb31",
+      "bytes": 4309,
+      "mode": "100644",
+      "path": "internal/drivers/spaces_test.go",
+      "sha256": "6068d01f5b70c1361ecc581c95cb10c5fdd8fa5818cf33209e4cdb7700be3d93"
+    },
+    {
+      "blob": "5a179055c22bed6c64fc28abe930cd681d8bd601",
+      "bytes": 4507,
+      "mode": "100644",
+      "path": "internal/drivers/util.go",
+      "sha256": "2521b985854766332952495bf8d79e869354867ae3177584f547c25ded1ca45c"
+    },
+    {
+      "blob": "47006843cf9aecf3dd6622db4dfc9b1c4f371d11",
+      "bytes": 12278,
+      "mode": "100644",
+      "path": "internal/drivers/volume.go",
+      "sha256": "0764689cb3c3b0a361da285617bbb25dd1391b3195e4039c0416ef425296b883"
+    },
+    {
+      "blob": "cee18824e575b3073f8dd5479990cf976912e525",
+      "bytes": 26822,
+      "mode": "100644",
+      "path": "internal/drivers/volume_test.go",
+      "sha256": "17cc1ce6abbb8ed0ba4cc77d68f314f31176b9db77d4ef84e0c685ba8d158f83"
+    },
+    {
+      "blob": "d20ecd7cdbe42eb3b58a0b197b54e8d427c9d1d7",
+      "bytes": 7421,
+      "mode": "100644",
+      "path": "internal/drivers/vpc.go",
+      "sha256": "a88a7124bbd7e1121a10071d2fc323dfb00e70b05932541420fde987b6407f91"
+    },
+    {
+      "blob": "29d9c6a5427a3b65a81e415f58807aaf028ba69f",
+      "bytes": 6057,
+      "mode": "100644",
+      "path": "internal/drivers/vpc_stateheal_test.go",
+      "sha256": "a058e3f756e98c87c3efc95a6c0b2224153ca899d0d68fc9be482425cc154c21"
+    },
+    {
+      "blob": "2548ba331c279f859888e1e4c6619be469576275",
+      "bytes": 10279,
+      "mode": "100644",
+      "path": "internal/drivers/vpc_test.go",
+      "sha256": "d653e804208bf83b6ba764710ba3f55254b484bce328c7fce86d1f578d78055f"
+    },
+    {
+      "blob": "051bd6d2d805a19865090ed081234ae45bf1edf0",
+      "bytes": 7920,
+      "mode": "100644",
+      "path": "internal/host_conformance_test.go",
+      "sha256": "03dee91cca658497b28aaaece0f4f82032850f7ff132548cadecf0d63cbbee14"
+    },
+    {
+      "blob": "715bfff7330e1dcf92a2706e5dad3c94505fd9e9",
+      "bytes": 35103,
+      "mode": "100644",
+      "path": "internal/iacserver.go",
+      "sha256": "89c6558572e4b83c17943033b26a8c5ccba3a752be2a45f0befd60ee1f454bb6"
+    },
+    {
+      "blob": "4fcd254f577b9b850f44e59b4fa9bd93ae32c360",
+      "bytes": 9254,
+      "mode": "100644",
+      "path": "internal/iacserver_finalize_test.go",
+      "sha256": "02e5c3397e16013384a2fa6d9c28d951c8b1c5275f02663793136f3637433257"
+    },
+    {
+      "blob": "4289356f6bb40f001ff9063097832512e5e8d7cc",
+      "bytes": 10678,
+      "mode": "100644",
+      "path": "internal/iacserver_mapper.go",
+      "sha256": "d9c68880ee29fb7df23915b898fc7d1af8be68046e54f8c2e19034e44d6e9583"
+    },
+    {
+      "blob": "85c7e855a3a32ea6e52b2e5a4b0c1e9a444c1933",
+      "bytes": 7199,
+      "mode": "100644",
+      "path": "internal/iacserver_mapper_test.go",
+      "sha256": "97a35183eaf01e56f144093d0c2294b29f74f83b9cda9c36567804454baead82"
+    },
+    {
+      "blob": "83f7c79b885bb50f422a254e9c0a1eb1ff7a50c0",
+      "bytes": 4623,
+      "mode": "100644",
+      "path": "internal/iacserver_pricing_test.go",
+      "sha256": "b3c7cb7122eec8a026f07c836a2ae63c1516c4110850df91446ee30f6bb1eacf"
+    },
+    {
+      "blob": "65b7dff40a0543d261093424c7992c0ab714a5d5",
+      "bytes": 3048,
+      "mode": "100644",
+      "path": "internal/iacserver_runner.go",
+      "sha256": "846e15443ecaf3f443bf3c5222a50ad401c97abe8f45ce5b49aa3c80e7374445"
+    },
+    {
+      "blob": "aacf5e2605334919a3c3b39f0d8b862759b5420f",
+      "bytes": 15843,
+      "mode": "100644",
+      "path": "internal/iacserver_runner_test.go",
+      "sha256": "3841a05c729a5f7f62e6398c833e490f8e7701058d7dc61105117f9afd03726e"
+    },
+    {
+      "blob": "f600a96d69fba28dcfb3fc3426b96fbea5b4df32",
+      "bytes": 7071,
+      "mode": "100644",
+      "path": "internal/iacserver_test.go",
+      "sha256": "12dfc2b2659085eb684cbea51ff916f674200e807b23fd2eeb5e9350bbf0a1b7"
+    },
+    {
+      "blob": "cf5c016ac1932e30bc59994576d74a5382f73a15",
+      "bytes": 6436,
+      "mode": "100644",
+      "path": "internal/logcapture.go",
+      "sha256": "888987db6e60d60e7cf1ade20ab3a303f8af30a50fe1668e2df879e6a79fdf7e"
+    },
+    {
+      "blob": "b270a0fee74b67572f733acb6156081162ca803d",
+      "bytes": 1815,
+      "mode": "100644",
+      "path": "internal/logcapture_server.go",
+      "sha256": "ae61db026a48379166f0ea80a121f2f0e141228a2a4c256a376608fe2097767a"
+    },
+    {
+      "blob": "60e31627fd14efc0f8beed95f4b001a66439df63",
+      "bytes": 11034,
+      "mode": "100644",
+      "path": "internal/logcapture_test.go",
+      "sha256": "1a989cfae6cd58b659bd3a730d04db7080673afa6d9b7fd6e390a55e6d5973e2"
+    },
+    {
+      "blob": "9a567f7d6bd55844819340dec6ed3c27be9a10fb",
+      "bytes": 10397,
+      "mode": "100644",
+      "path": "internal/ownership.go",
+      "sha256": "71045c5436e81cbcf4b9f85357e36c3b96d7123aa97a0a7598454c03a24d8a1d"
+    },
+    {
+      "blob": "206ec60b4656350496c89c5f70e945521209a911",
+      "bytes": 1257,
+      "mode": "100644",
+      "path": "internal/ownership_server.go",
+      "sha256": "c4de94dab954f787bc205edf994decf0efdc7cb1309897bfb3d736472f095e4d"
+    },
+    {
+      "blob": "960b07b6562bd6300882ce3ddb40935f0d84bff9",
+      "bytes": 12370,
+      "mode": "100644",
+      "path": "internal/ownership_test.go",
+      "sha256": "a967d5006908806d715ab5c8dc334e723c8ba1166dadc5dfd394060c64bc6df2"
+    },
+    {
+      "blob": "95b8bae5f0ee36918ad30b1ec9c73deb6a7485db",
+      "bytes": 9722,
+      "mode": "100644",
+      "path": "internal/plugin_test.go",
+      "sha256": "902184bda5a017bb3e1786cbfe7490c6e118a74dc24ac7d26affe524f97db337"
+    },
+    {
+      "blob": "419a8e5980fee9003e1d7381a0c568887a8b8c60",
+      "bytes": 34854,
+      "mode": "100644",
+      "path": "internal/provider.go",
+      "sha256": "9ca7902d4293c4bd8e7e9b14eaba3e5cd446ee55f8d954a696b8c93146a5e460"
+    },
+    {
+      "blob": "1b3457e998712da1c214365b553402db628d0945",
+      "bytes": 3731,
+      "mode": "100644",
+      "path": "internal/provider_conformance_test.go",
+      "sha256": "07ab6f4215ee7e040f454b980c695251bc64ad0d4a7e082ef119f4ec3d5cda7f"
+    },
+    {
+      "blob": "62af16df184712ec795fdecfb4741d00bb918563",
+      "bytes": 20716,
+      "mode": "100644",
+      "path": "internal/provider_detect_drift_test.go",
+      "sha256": "6ef7c79b78223b20b8221cc474e12e44fe5402a00c5324ba3d8480bb18c7e083"
+    },
+    {
+      "blob": "9aabe3c48e1f523ffae4028edef0b0d69c1f0b31",
+      "bytes": 1592,
+      "mode": "100644",
+      "path": "internal/provider_enumerator_live_test.go",
+      "sha256": "1a9cc95b64bc94e25466714fbae3093f49eee88ec71a83311d130d18bd46d5bc"
+    },
+    {
+      "blob": "4c6c0d596251e09b64f248bb8b36d7951fdf4334",
+      "bytes": 14770,
+      "mode": "100644",
+      "path": "internal/provider_enumerator_test.go",
+      "sha256": "9159ca8f590994b35723b3926355f792a6a4ef70651ed68159b235b44cb886f6"
+    },
+    {
+      "blob": "9ab7ac1f7beb3b7d162746ecb828865b15241aa5",
+      "bytes": 4962,
+      "mode": "100644",
+      "path": "internal/provider_revoke_test.go",
+      "sha256": "5e7d36fc5c9de0af93e61ca43645bbd0ace6e4356bea68984cddbebacc85e378"
+    },
+    {
+      "blob": "3050fa012e61c7efb4266ed1f5b9882f9a1c9ea9",
+      "bytes": 27871,
+      "mode": "100644",
+      "path": "internal/provider_test.go",
+      "sha256": "3ed4ee2efc92bd79950d675ff14bc7262b7cb69ec5feffaddd035501d96b0323"
+    },
+    {
+      "blob": "e9db857608c26841e910ac55ee83efd4469b585f",
+      "bytes": 1794,
+      "mode": "100644",
+      "path": "internal/region_lister.go",
+      "sha256": "0ec46ee050e77afdb6e45a8a195ee2aba63b68415e9c78b0d88c89bc70d3a4d0"
+    },
+    {
+      "blob": "6f68c7b51d668267ca77bf205de50a58ae44a1aa",
+      "bytes": 4166,
+      "mode": "100644",
+      "path": "internal/region_lister_test.go",
+      "sha256": "ea95875a661fcec2664899f13e581d5c7f0086e242585e215fdeb7a9f65eab07"
+    },
+    {
+      "blob": "d3975a078cd8bf3e459fa3745de75b74f0b73176",
+      "bytes": 33089,
+      "mode": "100644",
+      "path": "internal/released_host_test.go",
+      "sha256": "dbb8d7856d4f0a0fe18b330ffe33ca0522e15e02b55e54261ef413c1f33310c6"
+    },
+    {
+      "blob": "96654fa1a170b8764a3bb0f434897f4f6f86f8ca",
+      "bytes": 34817,
+      "mode": "100644",
+      "path": "internal/resourcedriver_sensitive_inputs_test.go",
+      "sha256": "238881b9e6f3de11d154e0746a35502678fb1af7667361c8735c2217b81fed0d"
+    },
+    {
+      "blob": "6dd5ac08f6d6b3b0f1b39579a3de39c059358c8e",
+      "bytes": 12440,
+      "mode": "100644",
+      "path": "internal/resourcedriver_server.go",
+      "sha256": "252f8acf522421b022a1ec4b5f428e74ca2b32442b6c8b2a41bd552b66019489"
+    },
+    {
+      "blob": "8358a22b8a1a8379be65a797f08f172107c4bf05",
+      "bytes": 7908,
+      "mode": "100644",
+      "path": "internal/resourcedriver_server_test.go",
+      "sha256": "557dbd408db932ec96a8f01710d0567b89469c1bfd4259e6e466c53421f4786b"
+    },
+    {
+      "blob": "9d67735f29cefb96672696e9e8e0706168eff21f",
+      "bytes": 3529,
+      "mode": "100644",
+      "path": "internal/sizing.go",
+      "sha256": "fd38b3e9e7a50ed20c9ce206d42fa076d1690e1089f4468839a8414a2d7ef6f6"
+    },
+    {
+      "blob": "aae7b902a16446c9044de1ec9b25440576f54eed",
+      "bytes": 2429,
+      "mode": "100644",
+      "path": "internal/sizing_test.go",
+      "sha256": "3a0fdd3ef0f56aa5975fecfd5e3442b43ca2ec0858ec9134c15a45c7d719795c"
+    },
+    {
+      "blob": "9a7bad88d6023f72a83da9c9a91b25d4a44c61b5",
+      "bytes": 13653,
+      "mode": "100644",
+      "path": "internal/statebackend/spaces.go",
+      "sha256": "3c50b06b514fa91cd419d8281d6870d6ef77d66f32c71f44868782f627192f51"
+    },
+    {
+      "blob": "a06a7124291966628465d2c102d0a08b837c45c4",
+      "bytes": 1636,
+      "mode": "100644",
+      "path": "internal/statebackend/spaces_lock_test.go",
+      "sha256": "8f4f52c6eba48a935c7bf39502eed51568815883bcb24b26a2f0e5e87acf5b58"
+    },
+    {
+      "blob": "6def53022e77071bf1905addce08ed36ece8cce7",
+      "bytes": 14465,
+      "mode": "100644",
+      "path": "internal/statebackend/spaces_test.go",
+      "sha256": "8d6add1c925bf43794b066e3c6676702a7ad543f7194e892570bede2869271fe"
+    },
+    {
+      "blob": "bbdc4dfe06ad56aef6bb81ce90305c6edf9fbe09",
+      "bytes": 10030,
+      "mode": "100644",
+      "path": "internal/statebackend_server.go",
+      "sha256": "5d003b88eb27e3d74c4fbab538b4693ded169a4afb98c136674eb2923876b9ca"
+    },
+    {
+      "blob": "09d1ffe26fb9ce0ae3297418813f48cc29453d86",
+      "bytes": 7906,
+      "mode": "100644",
+      "path": "internal/statebackend_server_test.go",
+      "sha256": "6e881613e6e784261d61e5a897e930fe056f06887bb0bfb0166b025221e10992"
+    },
+    {
+      "blob": "038e70591313214b9b2321d166a17cedf949327b",
+      "bytes": 10850,
+      "mode": "100644",
+      "path": "internal/step_router.go",
+      "sha256": "ee42a0493374e4f9453c956d38a392b5f3c53efc551557d4787e4d823dd4aa07"
+    },
+    {
+      "blob": "e1ff32a25a827b678e3d4501bade3d1dbb62762c",
+      "bytes": 9638,
+      "mode": "100644",
+      "path": "internal/steps/iac_logs.go",
+      "sha256": "1a7d9ce50bf1ddd9cfdb988d7e8e34cd4b3f0fd513b2acc245483e406d0c8ed2"
+    },
+    {
+      "blob": "2ea57916f1fbd1484e8e530f3dad490fa5f6c166",
+      "bytes": 10973,
+      "mode": "100644",
+      "path": "internal/steps/iac_logs_test.go",
+      "sha256": "a93ba6b05d691f22efade153284137d6ac3b193e071fda5cab6e56d1d684c184"
+    },
+    {
+      "blob": "9a0607734c44044ec1a20f12c846e2c02b5b1002",
+      "bytes": 9432,
+      "mode": "100644",
+      "path": "internal/steps/iac_scale.go",
+      "sha256": "53f643c5835595216a726483b28060ecad9a8a1aa30510bafa0db2614c5fd7a9"
+    },
+    {
+      "blob": "2e6170fe11df1b971d07b783728e113c2aa5f101",
+      "bytes": 13163,
+      "mode": "100644",
+      "path": "internal/steps/iac_scale_test.go",
+      "sha256": "de91349ec53cbab8d34d840f5996aecfcbda3e87e49ea4e5424c3bc7f09b32d5"
+    },
+    {
+      "blob": "f845520f10563c6f2692e8ab9e2b2fe2882a9cc2",
+      "bytes": 1584,
+      "mode": "100644",
+      "path": "internal/testdata/app-platform-runner/main.go",
+      "sha256": "3b2d3ba00526c560522cc78d374301c79ece9dcd50bf283612f68ba488335bf1"
+    },
+    {
+      "blob": "cb65d87ee1f134ac46bf5a3a61a4bcd04d78de4c",
+      "bytes": 19280,
+      "mode": "100644",
+      "path": "internal/validate_plan.go",
+      "sha256": "4b1f9c7fd58c64450a84a2a70531815999635c27358cb9f982e238f1b7ce77a2"
+    },
+    {
+      "blob": "14828f5d560a2b3793e41c319df1fb27a1289de6",
+      "bytes": 9439,
+      "mode": "100644",
+      "path": "internal/validate_plan_pricing_test.go",
+      "sha256": "74f0636f6f615e82a62c8802af99eeb9947ac9cb352a02c34c216b3cdc1bafaf"
+    },
+    {
+      "blob": "6dd3156a3b66624864235341256fd7d1cd713211",
+      "bytes": 22934,
+      "mode": "100644",
+      "path": "internal/validate_plan_test.go",
+      "sha256": "c8db865867ab425ff45e92067c912fe94c26444dad7b0aa910235782658303dd"
+    },
+    {
+      "blob": "1ecc941914ca94cf9823fe62b76bf454788e808f",
+      "bytes": 696,
+      "mode": "100644",
+      "path": "plugin.contracts.json",
+      "sha256": "7a6154c32e062e6b4e437ab231747a18d8edae4e42294320ea173ff676dc8aaa"
+    },
+    {
+      "blob": "9416236c99a18d71efc2ddfac66c703ed9610615",
+      "bytes": 12738,
+      "mode": "100644",
+      "path": "plugin.json",
+      "sha256": "1ebbb3b37ab592393756eb463ab68e3e881893fc1792b310a546bcaa47039d78"
+    },
+    {
+      "blob": "3a5721482132c55c0653c174e508f9fab5297803",
+      "bytes": 6354,
+      "mode": "100644",
+      "path": "proto/digitalocean.pb.go",
+      "sha256": "84aa0661aa321962d0ce6dc0b092b82992b61e0aa89db671e6db9fed403d3bbf"
+    },
+    {
+      "blob": "3a99586bc24a1b512ed6101dcbca072f10e2f9d2",
+      "bytes": 1611,
+      "mode": "100644",
+      "path": "proto/digitalocean.proto",
+      "sha256": "88b2dcb741ee836d00d088932217d3bc1c3e66be8fd77f612d76e6de07c93c4f"
+    },
+    {
+      "blob": "d6b730b082df1cddd729f3b954f6a4aa41cbfd28",
+      "bytes": 727,
+      "mode": "100644",
+      "path": "proto/generate.go",
+      "sha256": "e9639362d01ea467b8a55e01f1a544d409cd1b9f224954596b8459394d50d16b"
+    },
+    {
+      "blob": "5ba6ea46709dbe7643d7e0d00fcba57cc2548894",
+      "bytes": 35853,
+      "mode": "100644",
+      "path": "provider_policy_bootstrap_test.go",
+      "sha256": "7fc6a870d63bee9d6a6c1090a63d3775a613035014e3a5dab772b129baeecc2b"
+    },
+    {
+      "blob": "b27192f41be28e28ebbae216cb1f67d3c9195bee",
+      "bytes": 6053,
+      "mode": "100644",
+      "path": "provider_public_workflow_assertions_test.go",
+      "sha256": "5f6625b80d7bb4c3fa80a94b21be54f37c98efa550c9202a9bec3890cd8af593"
+    },
+    {
+      "blob": "e29f20def94b433f39d7b3cf6c912aa47549c191",
+      "bytes": 12007,
+      "mode": "100644",
+      "path": "provider_sdk_bootstrap_test.go",
+      "sha256": "611212494220d5757a0756a5325aee4f3f291f34e79fabd1360c5e65a2677347"
+    },
+    {
+      "blob": "31e321f435a35e9b7a20f123bc1268caa31ec1d6",
+      "bytes": 19661,
+      "mode": "100644",
+      "path": "provider_security_proof_test.go",
+      "sha256": "953ce836a0ed78e46acef68a31a56b6899bd24fe4c91bfb9e0ab9c9ffed83693"
+    },
+    {
+      "blob": "a0179f86b0715e3300f6f521b81d03cd96901214",
+      "bytes": 2620,
+      "mode": "100644",
+      "path": "recovery_workflow_test.go",
+      "sha256": "1dfaabc69f00cb108fcfcaeaab48debf47346ef4fb6d1d1e5f4ea7f31c862ae5"
+    },
+    {
+      "blob": "62e6aa3f4fad000dfedcbf410064a8f629af048e",
+      "bytes": 893,
+      "mode": "100755",
+      "path": "scripts/workflow-iac-host-conformance.sh",
+      "sha256": "5066dea5a461524cbda244f7ca00cdd85127457406af9966fd638d3648fd276a"
+    },
+    {
+      "blob": "18b2d93de04fbca6a7d63c5287b8b26a77dcd3bf",
+      "bytes": 8466,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/public-workflow-action-allowlist.json",
+      "sha256": "3c3b2ed406d81389fd2b9c044b606f04fe20df8d5d0356f90a6c354969736d73"
+    },
+    {
+      "blob": "77ea8911c3b6415084e80c9d6248d9aca27f8099",
+      "bytes": 47209,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/public-workflow-command-allowlist.json",
+      "sha256": "ea3dea5aea452e72a843ab45a11100555bfa670538f2bb28da56ed0e1c7f1b22"
+    },
+    {
+      "blob": "93ca2c492315ba182579ca6a56ef3b6753851ada",
+      "bytes": 2587,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/public-workflow-executable-allowlist.json",
+      "sha256": "5f7adfecd81a1fd49dfbc4cc1b2df751f59c42658d23d2dfa4db69b5d9955f2e"
+    },
+    {
+      "blob": "9ed0f3b3cb045b22ec6726fc65a6078142877c4b",
+      "bytes": 1183,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/public-workflow-presence-allowlist.json",
+      "sha256": "4a9868ac7d21d453cfbbc29c9541407e0c2805c343f8baab32b08e8704019db1"
+    },
+    {
+      "blob": "c110b2d090b5e48aaf9f86c52429f03c4a532cc0",
+      "bytes": 3613,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/workflows/ci.yml",
+      "sha256": "0f120206a3b5e8058b7ae6bcb8effaaa1a69531bb1f96fc7ee9b693687439c76"
+    },
+    {
+      "blob": "0e3cb88b97680e698eae23377047f6a224c402a8",
+      "bytes": 161,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/adopt/.github/workflows/policytool/go.mod",
+      "sha256": "51755e897f3de3cec86ca02e0bc954c019c54b0f807b33c943eadca5860d171b"
+    },
+    {
+      "blob": "62330735035750d2c75aa4dece005744a7d46c37",
+      "bytes": 2865,
+      "mode": "100755",
+      "path": "testdata/policytool-go127-transition/adopt/.github/workflows/scripts/check-public-workflow-policy.sh",
+      "sha256": "3fbf786aad1448c55a934f3fc3ed22644d5e83fef2a1a299a09b48b803ae7d37"
+    },
+    {
+      "blob": "ec6edb3b8d8dbee081a8d3a23f46d2ba467d1d27",
+      "bytes": 6220,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/public-workflow-action-allowlist.json",
+      "sha256": "d63dd97ad93a9fc919fbf1f14e0d16d4959686d37a78cc22ac87d088cdd1052f"
+    },
+    {
+      "blob": "f2e8de374fd308b8114e30473b8a3803c7307684",
+      "bytes": 39642,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/public-workflow-command-allowlist.json",
+      "sha256": "21628abb9062563b5b4fd381d53a560a32e9ddf77ebefa3aa1e4e1534869a9ac"
+    },
+    {
+      "blob": "1966df0e59b2d1ca2f33279cf16d7d0327e1f772",
+      "bytes": 1685,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/public-workflow-executable-allowlist.json",
+      "sha256": "892951b2ec9f3512344ec5a13639b7014743d5aad8d5aabf562d4e3429bedfbe"
+    },
+    {
+      "blob": "ccbec1843bd358cb490759aa0ae80b624b411906",
+      "bytes": 996,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/public-workflow-presence-allowlist.json",
+      "sha256": "2252acf055a6b0009ca4fe65afc45dc69e9c440b7d044917eab61b1bd12e788c"
+    },
+    {
+      "blob": "fe51488c7066f6687ef680d6bfaa4f7768ef205c",
+      "bytes": 3,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/public-workflow-secret-allowlist.json",
+      "sha256": "37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570"
+    },
+    {
+      "blob": "7f9b5e87a08a67f8926df6a3b3c5370cdbec5662",
+      "bytes": 3619,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/ci.yml",
+      "sha256": "f08f741574b67751e119e885d55bff350afa6fb7a35d90db59ea3696b88c8af0"
+    },
+    {
+      "blob": "df6392de269b45fd76225416c86549d4892efa65",
+      "bytes": 2826,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/grpc-version-sync.yml",
+      "sha256": "450cbb14403c2a21e7d6eb8cba87b869ae6ddd6daae5a920510e1a5b29c7d2bb"
+    },
+    {
+      "blob": "c34be463bc442b64f7a6edcdd35bfdee8c547b5b",
+      "bytes": 2576,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/iac-host-conformance.yml",
+      "sha256": "f8294ab62c0ff5e1b829baf1003ff5e9451edbfdec5870c309618bb503bfd1c2"
+    },
+    {
+      "blob": "e3c258753a6092cfb0a1dc41f84d4a386bf83394",
+      "bytes": 161,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/policytool/go.mod",
+      "sha256": "ddbfb09771aa824f859940c0a937f2eeb900cf0786b3cbf4a3ea741a0302b46e"
+    },
+    {
+      "blob": "ea0e47936acf287abb54ec3bd9e3b93c3c644dfd",
+      "bytes": 1348,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/policytool/go.sum",
+      "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c"
+    },
+    {
+      "blob": "159e548645814fe3c374a4b76a9410c9418d1d10",
+      "bytes": 64311,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/policytool/main.go",
+      "sha256": "e47f0f53fa91b800809a2cb04fdafca5af4a4a1441772139410ef82a9bd55884"
+    },
+    {
+      "blob": "4269d31a23d1ca0e7f38083531e77e2571b7adc6",
+      "bytes": 25482,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/policytool/main_test.go",
+      "sha256": "acf2b56ac0228604844c3241ca05cb07792b45645fb2746d12bcf1698251393b"
+    },
+    {
+      "blob": "e99bc19b64a36cbe0fa4d103c5e614d74a60b7ba",
+      "bytes": 3954,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/public-workflow-policy.yml",
+      "sha256": "4b0ad69a1e56b2a27594fcfc3206eb97d1ae56e24de993fed891addc8a00594d"
+    },
+    {
+      "blob": "60068bed87c307c70815aac014a0fe2ec81f35e7",
+      "bytes": 2669,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/release.yml",
+      "sha256": "d2769516166ed5a5b14575084c708df1e4c22f6c15cde0d9b4081d108a12065b"
+    },
+    {
+      "blob": "6c79b0cee6748ae160c87ce07c220cd58e2f6578",
+      "bytes": 2865,
+      "mode": "100755",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/scripts/check-public-workflow-policy.sh",
+      "sha256": "297b344d854f461a61e9c85475b528c335ccba3f27f0a039d2a6944f84c1f8b7"
+    },
+    {
+      "blob": "7537aaadff43c518bc12f71879af18eb13844849",
+      "bytes": 100802,
+      "mode": "100755",
+      "path": "testdata/policytool-go127-transition/baseline/.github/workflows/scripts/test-public-workflow-policy.sh",
+      "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9"
+    },
+    {
+      "blob": "62e6aa3f4fad000dfedcbf410064a8f629af048e",
+      "bytes": 893,
+      "mode": "100755",
+      "path": "testdata/policytool-go127-transition/baseline/scripts/workflow-iac-host-conformance.sh",
+      "sha256": "5066dea5a461524cbda244f7ca00cdd85127457406af9966fd638d3648fd276a"
+    },
+    {
+      "blob": "ca427f9c12a6fa873af3f1ff9b9dddb566c95d5b",
+      "bytes": 5868,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/manifest.json",
+      "sha256": "1bf6d910d7c7b88205c473acf517b4976970efe76fb3338b75a2231da23db2c5"
+    },
+    {
+      "blob": "21d36637b33de4bcbd00d541e7429db7a31a497f",
+      "bytes": 6400,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/promote/.github/public-workflow-action-allowlist.json",
+      "sha256": "d2d65cd64533aa7d6f83b8a059000b945a5a8779931d4f0f7b10d93989834474"
+    },
+    {
+      "blob": "82745d6622e58dee5c5b72db9e57e5f2f7007672",
+      "bytes": 40326,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/promote/.github/public-workflow-command-allowlist.json",
+      "sha256": "514263a1ad86030ca5c20d498f998694568b9002d82935855664ebda36ec8fa6"
+    },
+    {
+      "blob": "debcc8f5d335ca47db5323760454797f7afaa945",
+      "bytes": 1757,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/promote/.github/public-workflow-executable-allowlist.json",
+      "sha256": "01f437b049eb832583b388f07ce0ce7481d1cefab65d565b535e9f603b7a84a1"
+    },
+    {
+      "blob": "46d44e9e20da07e4bc7847f351d47741f8ab5dc4",
+      "bytes": 996,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/promote/.github/public-workflow-presence-allowlist.json",
+      "sha256": "d0c673c5c5f38a6e5a1685284196e1b4dfd2370d3f8ec9901443883ce5a96639"
+    },
+    {
+      "blob": "18b2d93de04fbca6a7d63c5287b8b26a77dcd3bf",
+      "bytes": 8466,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/stage/.github/public-workflow-action-allowlist.json",
+      "sha256": "3c3b2ed406d81389fd2b9c044b606f04fe20df8d5d0356f90a6c354969736d73"
+    },
+    {
+      "blob": "77ea8911c3b6415084e80c9d6248d9aca27f8099",
+      "bytes": 47209,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/stage/.github/public-workflow-command-allowlist.json",
+      "sha256": "ea3dea5aea452e72a843ab45a11100555bfa670538f2bb28da56ed0e1c7f1b22"
+    },
+    {
+      "blob": "17abd620de69fb3f5960bfc75f9951ad9fe001fd",
+      "bytes": 2587,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/stage/.github/public-workflow-executable-allowlist.json",
+      "sha256": "49a90cf5c91735ad3693b7c3b6c0e2fc35a9e42f0f0d8cd5ac45a67b2d44b54f"
+    },
+    {
+      "blob": "9ed0f3b3cb045b22ec6726fc65a6078142877c4b",
+      "bytes": 1183,
+      "mode": "100644",
+      "path": "testdata/policytool-go127-transition/stage/.github/public-workflow-presence-allowlist.json",
+      "sha256": "4a9868ac7d21d453cfbbc29c9541407e0c2805c343f8baab32b08e8704019db1"
+    },
+    {
+      "blob": "310b4be462101d569d9bbb1125d8cea0927663a2",
+      "bytes": 3879,
+      "mode": "100644",
+      "path": "testdata/provider-normal-receipt-context-amendment.json",
+      "sha256": "21768299f64e630faba4b994c4086964242a4921793eff296aee24c2dcf0b47a"
+    },
+    {
+      "blob": "750dde639fd66106190ecb2ca7bd8604363b6a84",
+      "bytes": 56009,
+      "mode": "100644",
+      "path": "testdata/provider-policy-bootstrap-accepted-0f72.json",
+      "sha256": "691f7b85863123faea3f3ce1139b5fb4153ede520377e566e7ced5c4cfd62d14"
+    },
+    {
+      "blob": "44b07b2caaa7adb386e6f8d2d9ce3821dfe0b048",
+      "bytes": 1932,
+      "mode": "100644",
+      "path": "testfixture/tc2-equivalent/infra.yaml",
+      "sha256": "77d4c517b16d8060d9cd63894015837c65a04a0bf24fdcee55daf5b6593dbbe6"
+    },
+    {
+      "blob": "ce8705723f5dbd4654c4d249069eb79e6d2844f1",
+      "bytes": 954,
+      "mode": "100644",
+      "path": "testfixture/tc2-equivalent/state.json",
+      "sha256": "036ffbd0e7cfb964b709c9e397ca0cc5a8966d4f3ab5aa8747cae2c360e993e3"
+    }
+  ],
+  "tree": "99b885d3d5e0eb34c9a59e99810760550140d28a"
+}
diff --git a/testdata/provider-policy-bootstrap-retirement.json b/testdata/provider-policy-bootstrap-retirement.json
new file mode 100644
index 0000000..8a8734a
--- /dev/null
+++ b/testdata/provider-policy-bootstrap-retirement.json
@@ -0,0 +1,16 @@
+{
+  "acceptedFloor": "d85f44c7573d66ae64ec003a94158480b24ac4df",
+  "acceptedFloorFiles": 257,
+  "acceptedFloorInventorySHA256": "28a832e8cc090a16c1895b75529460f6051efbbe1c5f8c3250dbc21d1f81f5bc",
+  "acceptedFloorTree": "99b885d3d5e0eb34c9a59e99810760550140d28a",
+  "historicalBootstrapBase": "0f72e69febaf02e512abb075c3547f5b2eeac5ad",
+  "receiptSchema": "provider-actual-accepted-policy/v3",
+  "repository": "GoCodeAlone/workflow-plugin-digitalocean",
+  "retirementHeadRef": "fix/policytool-go1272-promote-20261009",
+  "retirementPullRequest": 203,
+  "schema": "provider-policy-bootstrap-retirement/v1",
+  "transition": "PR203 must bind exact acceptedFloor to its actual event candidate and ordered synthetic merge parents. After acceptance, real main/PR event bases must contain acceptedFloor. Only the full actual accepted-base checker and maps are executable authority; candidate source and manifests remain inert scanner data.",
+  "workflowContextSHA256": "ae860e737fff0acf1e835ff2a0539ef8ac0c187fb2f1e3f9042af16ab72fe545",
+  "workflowPath": ".github/workflows/ci.yml",
+  "workflowSHA256": "58a01a556fa391928e3bc8a56d517df770fae9479789bcd0758f0834421e8cc4"
+}