Share native verification prerequisites with protected publication

.github/actions/verify-native/action.yml

@@ -0,0 +1,99 @@
+name: Verify native owning candidate
+description: Prepare the original disposable host and execute all owner prerequisites and existing component scenes.
+runs:
+  using: composite
+  steps:
+    - run: npm prune --ignore-scripts --no-audit --no-fund --workspaces=false
+      shell: bash
+    - name: Fetch exact existing Reviewer runner
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        repository: treeseed-ai/reviewer
+        ref: 001329f305c79beb6c1c8dfb9b85a36c6360e3eb
+        path: .treeseed/tools/reviewer
+    - name: Install the executing Reviewer suite dependencies
+      run: npm ci --prefix .treeseed/tools/reviewer --ignore-scripts --no-audit --no-fund
+      shell: bash
+    - name: Measure the executing Reviewer prerequisite custody
+      id: reviewer-prerequisites
+      run: node --import ./.treeseed/tools/reviewer/node_modules/tsx/dist/loader.mjs .treeseed/tools/reviewer/scripts/scene-action-prerequisites.ts
+      shell: bash
+    - name: Install Reviewer native prerequisite toolchain
+      if: steps.reviewer-prerequisites.outputs.toolchain-ready != 'true'
+      uses: erlef/setup-beam@v1
+      with:
+        otp-version: 27.3.4.18
+        elixir-version: 1.17.3
+    - name: Install the executing Reviewer exact SDK artifact
+      uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@8702e0285622276d850250a5f8637b6d704318d1
+      env:
+        NODE_ENV: production
+      with:
+        github-token: ${{ github.token }}
+        commit: ${{ steps.reviewer-prerequisites.outputs.sdk-commit }}
+        paths: .treeseed/tools/reviewer/node_modules/@treeseed/sdk
+    - name: Build the executing Reviewer archive assets
+      run: npm run --prefix .treeseed/tools/reviewer build:dist
+      shell: bash
+    - name: Reproduce executing Reviewer installed archives before full suites
+      working-directory: .treeseed/tools/reviewer
+      run: sudo --preserve-env=GITHUB_WORKSPACE,NPM_CONFIG_CACHE,PATH "$(command -v node)" node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/integration/guarantees/installed-custody.test.ts -t '^executes actual production-installed Reviewer and owner archives and retains denied checkout imports and missing-helper failures before exact retry$'
+      shell: bash
+    - name: Build original capacity host installer
+      run: npm run build:deb
+      env:
+        TREESEED_APT_SUITE: development
+        TREESEED_INTEGRATION_RELEASES: https://raw.githubusercontent.com/treeseed-ai/platform/be36cd24299c0381a4e1c81c420823f6340ca136/config/integrations/stable.release.json,https://raw.githubusercontent.com/treeseed-ai/platform/be36cd24299c0381a4e1c81c420823f6340ca136/config/integrations/development.release.json
+      shell: bash
+    - name: Initialize disposable native capacity host
+      run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT,GITHUB_REPOSITORY,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" --import tsx scripts/verify-native-host.ts
+      env:
+        TREESEED_PRIVILEGED_CACHE_TESTS: "1"
+      shell: bash
+    - name: Prepare native development image before timed tests
+      run: |
+        node node_modules/tsx/dist/cli.mjs --eval '
+          import {execFileSync} from "node:child_process";
+          import {resolveDevelopmentRuntimeImage} from "./src/supervisor/development-container.ts";
+          const image="mirror.gcr.io/library/node@sha256:51b1100cc2a83d370c6a60952e3f2989c8a43159d0e38586e090f3b3326efefd";
+          const docker=(args:readonly string[])=>execFileSync("/usr/bin/docker",[...args],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});
+          docker(["pull","--quiet",image]);
+          const expected=docker(["image","inspect",image,"--format","{{.Id}}"]).trim();
+          docker(["tag",image,"node:24-bookworm-slim"]);
+          const resolved=resolveDevelopmentRuntimeImage((_executable:string,args:readonly string[])=>docker(args));
+          if(resolved!==expected)throw new Error("Native development image readback differs from its held manifest.");
+        '
+      shell: bash
+    - name: Reproduce public host inspection before the complete native suites
+      run: sudo --preserve-env=GITHUB_ACTIONS,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" node_modules/vitest/vitest.mjs run tests/sandbox-host-inspection-native.test.ts tests/warm-sandbox-pool.test.ts tests/sandbox-vm-custody.test.ts
+      env:
+        TREESEED_PRIVILEGED_CACHE_TESTS: "1"
+      shell: bash
+    - run: sudo --preserve-env=GITHUB_ACTIONS,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH bash -euo pipefail -c 'npm run verify:direct'
+      env:
+        TREESEED_PRIVILEGED_CACHE_TESTS: "1"
+      shell: bash
+    - name: Execute coded sandbox component scenes
+      shell: bash
+      run: |
+        sudo --preserve-env=GITHUB_WORKSPACE,GITHUB_RUN_ID,GITHUB_RUN_ATTEMPT,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" --import ./.treeseed/tools/reviewer/node_modules/tsx/dist/loader.mjs \
+          .treeseed/tools/reviewer/src/verifiers/guarantees/command.ts \
+          --workspace "$GITHUB_WORKSPACE" --environment local --ids guarantee.deployment.golden.component-boundaries \
+          --run-id "actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+      env:
+        TREESEED_PRIVILEGED_CACHE_TESTS: "1"
+    - name: Retain coded scene evidence
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      with:
+        name: scene-evidence-${{ github.sha }}-${{ github.run_attempt }}
+        path: .treeseed/guarantees/runs/actions-${{ github.run_id }}-${{ github.run_attempt }}/
+        if-no-files-found: error
+        include-hidden-files: true
+        retention-days: 7
+    - name: Return disposable npm cache to the packaging user
+      run: |
+        set -euo pipefail
+        test "$NPM_CONFIG_CACHE" = "$GITHUB_WORKSPACE/.treeseed/npm-cache"
+        sudo chown --no-dereference --recursive -- "$(id -u):$(id -g)" "$NPM_CONFIG_CACHE"
+      shell: bash

.github/workflows/publish.yml

@@ -28,6 +28,7 @@ permissions:
   id-token: write
   attestations: write
   packages: write
+  actions: read
 
 concurrency:
   group: ${{ inputs.suite }}-apt-publication
@@ -36,10 +37,11 @@ concurrency:
 jobs:
   publish:
     environment: ${{ inputs.suite == 'stable' && 'production' || 'staging' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     env:
       TREESEED_APT_SUITE: ${{ inputs.suite }}
       TREESEED_INTEGRATION_RELEASES: ${{ inputs.stable_lock_url }},${{ inputs.development_lock_url }}
+      NPM_CONFIG_CACHE: ${{ github.workspace }}/.treeseed/npm-cache
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
@@ -67,7 +69,7 @@ jobs:
         run: test -n "$APT_SIGNING_KEY"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
-          node-version: 24
+          node-version: 24.12.0
           cache: npm
       - run: npm ci
       - name: Restore exact release assets for APT-only resume
@@ -115,8 +117,15 @@ jobs:
           else
             gh release upload "${{ inputs.tag }}" "${catalog[0]}"
           fi
-      - run: npm run verify:direct
+      - uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@cbc03314871d271bce7275c5cee71d950397a0c3
+        env:
+          NODE_ENV: production
+        with:
+          github-token: ${{ github.token }}
+        if: ${{ !inputs.resume_apt_only }}
+      - name: Verify native owning candidate
         if: ${{ !inputs.resume_apt_only }}
+        uses: ./.github/actions/verify-native
       - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
         if: ${{ false }}
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

.github/workflows/verify.yml

@@ -3,7 +3,7 @@ name: Verify
 on:
   pull_request:
   push:
-    branches: [staging, main]
+    branches: [ staging, main ]
 
 permissions:
   contents: read
@@ -64,89 +64,8 @@ jobs:
           NODE_ENV: production
         with:
           github-token: ${{ github.token }}
-      - run: npm prune --ignore-scripts --no-audit --no-fund --workspaces=false
-      - name: Fetch exact existing Reviewer runner
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          repository: treeseed-ai/reviewer
-          ref: 001329f305c79beb6c1c8dfb9b85a36c6360e3eb
-          path: .treeseed/tools/reviewer
-      - name: Install the executing Reviewer suite dependencies
-        run: npm ci --prefix .treeseed/tools/reviewer --ignore-scripts --no-audit --no-fund
-      - name: Measure the executing Reviewer prerequisite custody
-        id: reviewer-prerequisites
-        run: node --import ./.treeseed/tools/reviewer/node_modules/tsx/dist/loader.mjs .treeseed/tools/reviewer/scripts/scene-action-prerequisites.ts
-      - name: Install Reviewer native prerequisite toolchain
-        if: steps.reviewer-prerequisites.outputs.toolchain-ready != 'true'
-        uses: erlef/setup-beam@v1
-        with:
-          otp-version: "27.3.4.18"
-          elixir-version: "1.17.3"
-      - name: Install the executing Reviewer exact SDK artifact
-        uses: treeseed-ai/sdk/.github/actions/install-exact-sdk@8702e0285622276d850250a5f8637b6d704318d1
-        env:
-          NODE_ENV: production
-        with:
-          github-token: ${{ github.token }}
-          commit: ${{ steps.reviewer-prerequisites.outputs.sdk-commit }}
-          paths: .treeseed/tools/reviewer/node_modules/@treeseed/sdk
-      - name: Build the executing Reviewer archive assets
-        run: npm run --prefix .treeseed/tools/reviewer build:dist
-      - name: Reproduce executing Reviewer installed archives before full suites
-        working-directory: .treeseed/tools/reviewer
-        run: sudo --preserve-env=GITHUB_WORKSPACE,NPM_CONFIG_CACHE,PATH "$(command -v node)" node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/integration/guarantees/installed-custody.test.ts -t '^executes actual production-installed Reviewer and owner archives and retains denied checkout imports and missing-helper failures before exact retry$'
-      - name: Build original capacity host installer
-        run: npm run build:deb
-        env:
-          TREESEED_APT_SUITE: development
-          TREESEED_INTEGRATION_RELEASES: https://raw.githubusercontent.com/treeseed-ai/platform/be36cd24299c0381a4e1c81c420823f6340ca136/config/integrations/stable.release.json,https://raw.githubusercontent.com/treeseed-ai/platform/be36cd24299c0381a4e1c81c420823f6340ca136/config/integrations/development.release.json
-      - name: Initialize disposable native capacity host
-        run: sudo --preserve-env=GITHUB_ACTIONS,RUNNER_ENVIRONMENT,GITHUB_REPOSITORY,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" --import tsx scripts/verify-native-host.ts
-        env:
-          TREESEED_PRIVILEGED_CACHE_TESTS: '1'
-      - name: Prepare native development image before timed tests
-        run: |
-          node node_modules/tsx/dist/cli.mjs --eval '
-            import {execFileSync} from "node:child_process";
-            import {resolveDevelopmentRuntimeImage} from "./src/supervisor/development-container.ts";
-            const image="mirror.gcr.io/library/node@sha256:51b1100cc2a83d370c6a60952e3f2989c8a43159d0e38586e090f3b3326efefd";
-            const docker=(args:readonly string[])=>execFileSync("/usr/bin/docker",[...args],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});
-            docker(["pull","--quiet",image]);
-            const expected=docker(["image","inspect",image,"--format","{{.Id}}"]).trim();
-            docker(["tag",image,"node:24-bookworm-slim"]);
-            const resolved=resolveDevelopmentRuntimeImage((_executable:string,args:readonly string[])=>docker(args));
-            if(resolved!==expected)throw new Error("Native development image readback differs from its held manifest.");
-          '
-      - name: Reproduce public host inspection before the complete native suites
-        run: sudo --preserve-env=GITHUB_ACTIONS,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" node_modules/vitest/vitest.mjs run tests/sandbox-host-inspection-native.test.ts tests/warm-sandbox-pool.test.ts tests/sandbox-vm-custody.test.ts
-        env:
-          TREESEED_PRIVILEGED_CACHE_TESTS: '1'
-      - run: sudo --preserve-env=GITHUB_ACTIONS,GITHUB_WORKSPACE,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH bash -euo pipefail -c 'npm run verify:direct'
-        env:
-          TREESEED_PRIVILEGED_CACHE_TESTS: '1'
-      - name: Execute coded sandbox component scenes
-        shell: bash
-        run: |
-          sudo --preserve-env=GITHUB_WORKSPACE,GITHUB_RUN_ID,GITHUB_RUN_ATTEMPT,TREESEED_PRIVILEGED_CACHE_TESTS,NPM_CONFIG_CACHE,PATH "$(command -v node)" --import ./.treeseed/tools/reviewer/node_modules/tsx/dist/loader.mjs \
-            .treeseed/tools/reviewer/src/verifiers/guarantees/command.ts \
-            --workspace "$GITHUB_WORKSPACE" --environment local --ids guarantee.deployment.golden.component-boundaries \
-            --run-id "actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
-        env:
-          TREESEED_PRIVILEGED_CACHE_TESTS: '1'
-      - name: Retain coded scene evidence
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: scene-evidence-${{ github.sha }}-${{ github.run_attempt }}
-          path: .treeseed/guarantees/runs/actions-${{ github.run_id }}-${{ github.run_attempt }}/
-          if-no-files-found: error
-          include-hidden-files: true
-          retention-days: 7
-      - name: Return disposable npm cache to the packaging user
-        run: |
-          set -euo pipefail
-          test "$NPM_CONFIG_CACHE" = "$GITHUB_WORKSPACE/.treeseed/npm-cache"
-          sudo chown --no-dereference --recursive -- "$(id -u):$(id -g)" "$NPM_CONFIG_CACHE"
+      - name: Verify native owning candidate
+        uses: ./.github/actions/verify-native
       - run: npm run verify:deb
         env:
           TREESEED_APT_SUITE: development

guarantees/agent/golden/scenes/component-boundaries.scene.yaml

@@ -847,3 +847,6 @@ workflow:
   - id: package-proxy-custody-native
     action: { verifier: deployment.golden.package-proxy-custody-native }
     expect: { status: passed }
+  - id: native-publication-shared-prerequisites-unit
+    action: { verifier: deployment.golden.native-publication-shared-prerequisites-unit }
+    expect: { status: passed }

guarantees/verifiers/golden.verifiers.yaml

@@ -1390,3 +1390,9 @@ verifiers:
     ownerPackage: "@treeseed/deployment"
     testFile: tests/package-proxy-native.test.ts
     testName: "reads the real immutable release through guest authentication and denies foreign, missing and expired authority"
+
+  deployment.golden.native-publication-shared-prerequisites-unit:
+    kind: vitestCase
+    ownerPackage: "@treeseed/deployment"
+    testFile: tests/native-publication-workflow.test.ts
+    testName: "shares the complete original native prerequisites suites and scenes before verification or release packaging"