ci: maintain native research automation and attest catalog archives - #26

Routine checks previously ran twice for feature-branch updates, workflow lint was optional, and the repository had no required checks or catalog provenance path. This change makes routine validation predictable, gives dependency updates one owner, and adds a manual trusted-main catalog archive using GitHub's native attestations.

Result

• Ordinary pushes run only on main; PR/manual events remain. Only routine validate/token-report PR runs cancel superseded runs. Native filters, completion and failure evidence are preserved.
• Weekly grouped Dependabot Action updates, at most two open version-update PRs; no auto-merge or automatic catalog adoption.
• Required validate and token-report checks from the GitHub Actions app are active in ruleset 23739774. No strict freshness or human approval count was added. Reviewed configuration and rollback are versioned.
• The existing required validate job now runs checksum-pinned upstream actionlint 1.7.12 alongside locked zizmor and the integrity validators. Two existing apt-log redirections use tee under Bash pipefail; native argv and retained logs are preserved.
• Manual main-only publication packages the exact validated Git commit, attests it with actions/attest, verifies identity/source, rejects altered bytes, and matches the raw upload digest. Verification/failure logs and detached bundle are retained separately. No model, release, registry or Pages deployment is enabled.

The catalog links a concise handbook covering ownership, source revisions, supported commands, rollback and qualification limits. The existing active daily Codex maintenance task remains the sole agentic owner. A source-cited Nautilus catalog migration/interval-safety proposal is evaluated without changing accepted rc5, runtime services, recovery experiments, models/accounts, IBKR or Alpaca behavior. gh-aw/agentics and Renovate were reviewed; no competing schedule or paid engine was enabled.

Evidence

The original implementation at aeaf477 was independently reviewed before expanding it: no actionable findings. Its unchanged local qualification was reused. Separate GitHub observation confirmed exactly four successful PR runs and zero push duplicates: validate, token report, native token, native foundation.

Integrated local validation: all five content validators passed; 77 validation/security/explorer tests passed; actionlint returned empty output and strict offline zizmor returned [] for all seven workflows. Separate GET rules/branches/main confirmed the app-bound required checks. The publication worker replayed exact packaging steps, rejected a dirty checkout and verified a real upstream artifact with original/modified/original results 0/1/0. These are local structural/integration and upstream consumer checks, not this repository's hosted issuance.

The research handbook reuses a frozen native Codex/Claude baseline: 8/8 content passes, 6/8 full protocol passes. It retains both failures, elapsed times, available usage and accounting limits. No model reruns or new session/lifetime savings claims.

Remaining qualification

Final independent review found no actionable implementation or reconciliation findings at 341af9316ef746796394ead5967bd025206dab95. Its evidence registry is the exact 1,021-path union of both parent branches; reserved foundation recovery files are unchanged. All four final PR runs passed: validate, 37s, token report, 4s, native token, 35s, offline engine, 33s. Both Socket checks passed. Exactly four PR runs and zero duplicate push runs were observed for this revision.

Merged without bypass on 2026-09-20 at d0fe136c218fedff93c93ac674e302ae19b2d924. All four post-merge push workflows succeeded: validate, token report, native token, offline engine. No unchanged native trial was rerun merely to qualify documentation.

Hosted publication and separate consumer observation

Trusted-main publication run 35541322881 succeeded in 23 seconds. It issued native provenance for the exact merge commit, verified source/workflow/ref/hosted-runner identity, rejected altered bytes, reverified the original, uploaded it without a ZIP wrapper and matched its digest. Independent review of the retained signed output confirmed the subject, source SHA, workflow, hosted runner and run/attempt identity agree across all three successful verifications. Non-main dispatch 35541389048 was skipped with zero job steps.

• Catalog archive artifact 10615080901: 3,958,567 bytes; SHA-256 93935ba33efcf578694973ba8e915318536bff2dc5eb2f9223397703dea5f69f.
• Evidence artifact 10614957057: 42,975 bytes; validation logs, signed bundle, verification outputs, negative control and upload digest. Both artifacts have seven-day retention; provenance is not permanent artifact hosting.
• Separate native consumer downloaded the archive via gh api repos/seathatflowsinourveins/native-agent-stack/actions/artifacts/10615080901/zip; sha256sum --check evidence/archive.sha256 returned OK. Plain-file artifacts require raw download: this CLI's gh run download assumes ZIP and was used only for the evidence artifact.
• Native gh attestation verify against the expected repository, publishing workflow, main ref and exact source SHA returned 0. Detached verification with independently fetched trusted roots returned 0 / 1 / 0 for original / altered / original. The issuer error alone is not the assertion: identical offline policy succeeds before and after the modified-byte rejection.
• Extracted archive scripts/validate.py --root ... returned 0: 68 components, 1,021 hashed files, 4 profiles, 100 receipts, status passed. This is content integrity, separate from provenance and practical research usefulness.

Dependency maintenance observation

The first hosted Dependabot scans 35541330440 and 35541327481 succeeded. Logs applied the minor/patch group selector and found no matching grouped updates. Exactly two major-version PRs were observed open: setup-python #29 and setup-go #30. These are proposals, not accepted upgrades; hashes and relevant compatibility still need review. No auto-merge or privileged PR writer was added.

Still unobserved: actual cancellation of overlapping superseded PR runs, the Monday weekly timer, and a nonempty grouped minor/patch update. The manual agentic pilot remains source research with proposed unrun acceptance commands; gh-aw/agentics hosted execution and Renovate remain deferred. New hosted-model spend is disabled ($0). Provenance does not establish native runtime activation, broker readiness, useful research output or token savings.

During coordination, an earlier merge request for PR28 was initially refused despite displayed green checks; it succeeded after GitHub reported CLEAN with no rule change or bypass. Initial Actions listings for two PR26 pushes were also empty before runs arrived. These are retained platform-propagation observations, not evidence that required-check integrity should be weakened.

Implementation records: handbook, task record, provenance, research acceptance, upstream pilot. Historical failures and scope limits are retained.