ci: report source citations and align six measured runtime pins - #1006

Scope

Restore #1006's advisory source-citation workflow to current main d8f7e2051b61bde6361a85b64f41413798015353 and reconcile six recorded runtime pins with versions already present on the host. The workflow still runs the real verifier from the trusted PR base in --mode report; it stays advisory and leaves the required sota-sources presence gate intact.

• Base: d8f7e2051b61bde6361a85b64f41413798015353.
• Head: 1aaa7470f175de3f8f78ea7ed82942a9d8a03f74, ONE six-pin commit on the published rebase/adaptation d0aeffc31c45912f4b45b7fb110ed2b52d845505.
• Lane: lane:foundation.
• The rebase restores the historical 20261004 advisory baseline to main's exact bytes and appends a native dated delta/index entry under main's append-only contract. The delta records 357 monitoring reads: the immutable baseline's 332, existing skill accounting's 10 and the report workflow's 15 verifier locations.
• The follow-on commit changes six current stack components, three corresponding Linux bootstrap package pins, the documented current recipes, a versioned Promptfoo install-plan overlay, one qualification receipt, the independently sourced Codex artifact oracle, and native generated reports/bindings. It performs no host installation or client/service/store/configuration change.

systemd's new pin is the observed Ubuntu build 259.5-0ubuntu3.4; upstream 259 release notes and the v259.5 stable release establish its lineage. This does not claim an upstream source-built installation.

SOTA sources

• [mechanism] The six vendor release notes/source commits are linked in the table. SocratiCode 1.16.0 adds opt-in Git-triggered refresh and startup/deletion fixes; Codex 0.162.1 fixes asynchronous-question rendering and explicit feature-override compatibility; Promptfoo 0.124.0 removes hosted ChatKit and makes several provider SDKs opt-in. Those mechanisms were reviewed, with current version/artifact identity measured separately.
• [mechanism] The Linux Codex bootstrap's supported npm path is retained. The verified @openai/[email protected] wrapper maps @openai/codex-linux-x64 to npm:@openai/[email protected]. Wrapper/platform SHA256 values are 0b4b2e33a65883e4f69c903484d8dd7770b3cb8b324f520068b6fd85d42b65ea / 7417711678b464eee70664126e39e88bb3c84c2928da0e71f14b56e04ff5c09f; the platform executable is 628e35487d888a28f0427fc37501da529dd3d81fcbad7a2c3421c1e8670d92e1. Independent SHA512/SHA1 checks match npm registry metadata. The existing alias/version/binary/complete-tree refusal checks remain.
• [mechanism] Native advisory accounting uses patch_policy.GitTree and push_gate.derive_ci_protected at main d8f7e2051b61bde6361a85b64f41413798015353, following blueprints/runtime-workers/openhands/evidence/advisory-gate-deltas.md. A dated delta and its index entry preserve the published baseline and all older entries. The source-report delta binds source tree edf14ca6c599969180213fa9919daf0c02a49ca8; its native derivation records 357.
• [mechanism] github/docs@be38ec5d78e24172587e61b3c6ff40ace1865c71: event-commit workflow selection, pull_request event ref/commit, merge-commit identity and merge ref/SHA. Workflow selection is separate from this job's explicit trusted-base checkout.
• [mechanism] actions/checkout v7.0.1, with persisted credentials disabled. The sole action remains full-SHA pinned.
• [reference] Pin decision, qualification receipt and versioned install-plan overlay. The CC measured inventory used has SHA256 28416fe8891b23964e77ea591a5d1cad871b748c5ab08d2b7e98e2afea459d48; its README is 4d8a23ec6e037e5f7886ba798df3cc88e9fff09e2403ca0658175cfdf4ce9d80, with source base 429f042 and collection at d8f7e20.

Advisory reads retained

The workflow naming tools/sota-sources/verify_sources.py adds exactly the 15 locations below. Their current accounting is a dated delta, not a rewrite of the old baseline. Native shapes are unresolved path expressions, including cache keys and propagated suffixes, rather than a claim that each is an independent filesystem read or request.

Evidence-class table

The six re-pins align the current run records. Historical verdict pins, survivor comparisons, macOS pins, frozen old install plans and earlier acceptance receipts remain dated evidence. The old Promptfoo plan is superseded only for its runtime-version target by the new versioned overlay. No claim of new-host, provider/model, migration, indexing or complete lifecycle acceptance is made.

Commands and verification

All multi-module checks ran in the approved systemd-run --user --scope -p CPUWeight=idle scope. Scratch and TMPDIR are under /var/tmp; betterleaks fixture runs use a private GNU tee shim. No whole-repository discovery or upstream full build ran.

python3 -E -s -B -m unittest tests.test_source_citations_report_workflow tests.test_workflow_hardening tests.test_workflow_security_coverage tests.test_local_pages_policy_grants tests.test_workflow_policy.RepositoryPolicyTests tests.test_runtime_worker_openhands_push_gate tests.test_evidence_manifest tests.test_foundation_stack_pins tests.test_adoption_bootstrap_linux_platform tests.test_adoption_bootstrap tests.test_final_stack
483 reported; moved SocratiCode doc link and Dagu tag representation checks corrected
The affected foundation-pin module (2 tests) and full final-stack module (75 tests) subsequently pass, exit 0; the other executed cases passed in the bounded run. Five existing platform/hash-freeze skips remain.
python3 -E -s -B scripts/validate.py
exit 0; 70 components / 11,803 hashed files / four profiles / 240 receipts
python3 -E -s -B scripts/evidence_manifest.py --check
exit 0
python3 -E -s -B scripts/final_stack.py --check
exit 0; six run pins match their stack/primary Linux sources
python3 -E -s -B scripts/component_matrix.py --check
exit 0
python3 -E -s -B scripts/new_host_grand_list.py --check
exit 0
gitleaks git --redact=100 --log-opts='d8f7e2051b61bde6361a85b64f41413798015353..HEAD'
exit 0; actual three-commit PR range, 100% redaction, no leaks

Decision record

The original W1b source-report workflow remains read-only and advisory, using the base verifier and its frozen fake only for the invoked subset. The new run pins use the vendor paths already in the native stack and the host checks named above. Layer-resolution verdict/wave and latest covering sweep inputs were read; this delta preserves their outstanding comparisons.

Host evidence

Measured current versions and selected binary/package identities only. No live tool installation, host unit/property change, client configuration, credential access, memory-store mutation or trading-resource operation. The separately pinned Codex Python SDK/worker is unchanged.

Checklist

• Rebase onto assigned main and native append-only adaptation completed in one leased publication.
• Historical baselines and older observations retain their bytes.
• Six current runtime pins cite vendor releases and individual host checks.
• Native archive/alias/binary checks and independently measured hashes retained.
• Native generated reports/evidence and bounded checks verified.
• Both review families, correction-head CI and CC landing.

Follow-ups

• After Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003 and this workflow land, retain an eligible hosted PR-event receipt using the real verifier; local CLI-contract tests remain synthetic.

• Release-tag and extended-SWHID verifier expansion remains in Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003's phase-B follow-ups.

• The step summary can exceed GitHub's 1 MiB per-step limit (github/docs@be38ec5:content/actions/reference/workflows-and-actions/workflow-commands.md:L935).

• Astra P3: the observer-boundary test misses a list-leading action declaration; extend the boundary coverage.

• Astra P3: the frozen fake exercises the invoked argument subset but does not establish future compatibility with Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003; retain a real-verifier compatibility/hosted receipt after landing.

• Astra P3: a timeout or cancellation can end a report before a summary is emitted; review how the advisory workflow records an interrupted report.

• Astra P3: existing unpinned line locators already point away from their named helpers; refresh or pin those helper references.

• Astra P3: pre-existing machine-name labels remain a follow-up, counted only; their values are not reproduced here.

• Claude P3: with Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003 landed, qualify the fake against the real verifier and its recorded fixtures, including the public summary heading.

• Claude P3: distinguish checkout failure from a base that lacks the dependency in the advisory summary.

• Claude P3: document each job permission for zizmor's pedantic/auditor personas.

• Claude P3: pin the remaining live GitHub-docs citations so phase A can check them.

• Claude P3: address the actions/checkout mirror-registry gap through the CC's mirror owner.

• CC process follow-up: a rebase across a dependency landing needs broader validation; patch-id equality alone did not establish suite equality here.

• Claude delta P3: docs/sota-source-report.md:8 still describes Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003 as needing to land, while the later paragraph records it as landed; update that dependency wording in a follow-up.

• Claude delta P3: narrow the actions/checkout input citations from L7-L13 to L7-L11 and L52-L58 to L52-L54; the current ranges contain the named inputs and additional neighbouring inputs.

• Claude delta P3: refresh the older conditional Follow-up about both PRs landing; Verify the code citations in a PR's SOTA sources (W1b phase A, report-only) #1003 is landed and an initial hosted receipt exists, so retain a post-landing receipt for this workflow.

• Claude delta P3: clarify hosted execution as being for PR head 6f9e1c1, from trusted base 7718599; the run's head SHA and the executed verifier's base SHA are distinct.

• Claude delta P3, pre-existing: refresh blueprints/runtime-workers/openhands/RESOLVER.md:157-159, which still describes the older 321-location/29-script monitoring snapshot; the reviewed baseline now records 347 locations in 32 scripts.

• Astra fix1 P3 at de9cd70: The documentary correction has no fail-before repository regression.

• Astra fix1 P3 at de9cd70: The previously reported standalone observer-boundary mutation gap remains.

• Astra fix1 P3 at de9cd70: The synthetic fixture still does not establish future verifier compatibility.

• Astra fix1 P3 at de9cd70: Checkout failure and cancellation still have limited reporting.

Rebase validation (2026-10-13)

CC-authorized rebase onto main 329985de1c8dccf0df7491373d0d9932eaa723d4. All eight added files, including the dated six-pin receipt, versioned install overlay and gate-read delta, remain byte-identical. The gate-delta index appends this PR's existing delta while retaining all current main entries; final-stack and grand-list were regenerated through their native producers. Twenty ORIG_HEAD-listed changed rows were re-registered. Promptfoo 0.124.0 matches #870's selected version and both dated evidence records remain intact.

Full idle-class validator: exit 0, 71 components, 11,928 hashed files, 4 profiles, 241 receipts. Post-resolution merge-tree and whitespace checks: exit 0. Actual three-commit range gitleaks: exit 0, no leaks. Registry-excluded cumulative patch-id differs: 5eb2c8a6f0935e331b98ff8c5559a060e327e41b → 0c9b85280049af6d8451319531244b5eabce53d8, reflecting the append-only index adaptation and native projections against the newer base; no patch-identical claim.

Both independent review families and green CI at the actual correction head are required before CC landing. Historical review at bd9d46f does not qualify this head.

Scoped idle-class regression verification also passed: python3 -m unittest tests.test_source_citations_report_workflow tests.test_adoption_bootstrap_linux_platform tests.test_final_stack, 112 tests, exit 0.