Harden the last three workflows, pin exact release comments, and give native-token-e2e discriminating fixtures - #370

Summary

• Hardening. step-security/harden-runner in audit mode (e14015d5… # v2.21.1) is now the first step of the four remaining unhardened jobs:

  • native-token-tools (native-token-e2e.yml)
  • source and destination (native-offhost-app-state.yml)
  • synthetic-restore (native-offhost-restore.yml)

  All 32 ubuntu jobs and 3 of 4 macOS jobs now start with the step, 35 uses in all. The only exemption left is the ownership exemption for hardware-profile-smoke.yml:macos-profile, and HASH_FROZEN is empty. A guard test keeps the four jobs hardened.

• No run has executed the step in these jobs yet.

  • This PR's hosted native-token-tools run is the first. native-token-e2e.yml runs on pull_request with a paths filter. The local --install runs only re-recorded the harness receipts against the new workflow bytes (fb06cf92…); they call native_token_ci.py directly, so no workflow step ran.
  • For each off-host workflow (both workflow_dispatch only), the next dispatch is its first run with the step. The off-host plans had only their prospective bindings refreshed, as 37a3b436 did.
  • That ground differs from the 09-22 record's operative overturn. It needs the coordinator's acceptance, or a dispatch of both workflows on this branch before merge.

• Pin comments. Six major-only comments (# v7/# v8) now name exact releases (# v7.0.1/# v8.0.1); no SHA changed. This prevents a zizmor ref-version-mismatch finding from failing the required validate job when upstream moves v7/v8. A new offline test guards it.

• Discriminating fixtures in scripts/native_token_ci.py. Each tool gets an input on which its real behaviour differs from a passthrough, and is checked against that baseline:

  • Real-tool controls: 13 of 13 as expected. Mutation check: 6 of 6 caught.
  • One of the 12 new checks is an oracle self-check on the committed fixture.
  • A failure in one fixture no longer skips the next fixture of the same tool.

• Docs.
  • docs/foundation-stack.md now follows manifests/stack.json, guarded by the new tests/test_foundation_stack_pins.py.
  • The harden-runner paragraph in docs/github-automation.md states the current coverage and cites only existing tests, guarded by a new test.
• Action pins. 13 actions were checked via gh api; 12 are at their latest release. codeql-action/upload-sarif is on v4.38.1: v4.38.2 (09-24) is inside Dependabot's 7-day cooldown, so 10-05 is the first eligible run. No advisories affect any pinned version. The Dependabot config is untouched.

Lane and merge

• Lane: lane:foundation. manifests/evidence.json changes only by the re-registration protocol: 12 new files and 12 re-hashed, with no receipts[] change. The changed plans are foundation blueprints (blueprints/convergence-practice/).
• Base and head. The branch is based on dde28cc2, which is current origin/main; head is 5c5e2a50. git merge-tree --write-tree origin/main HEAD exits 0 (clean).
• New-machine docs. docs/github-automation.md carries the marker twice and blueprints/convergence-practice/offhost-app-state/README.md once, as "changed after v2026.09.26.2". Both show in scripts/release_due.py's changed list.
• Before merge (see Residuals):
  • Retain this PR's hosted native-token-tools run id and artifact.
  • The coordinator accepts or rejects the prospective-binding ground for the off-host jobs.

What changed

• .github/workflows/native-token-e2e.yml: harden-runner as the first step of native-token-tools, plus exact-release comments.
• .github/workflows/native-offhost-app-state.yml and .github/workflows/native-offhost-restore.yml: harden-runner as the first step of source, destination and synthetic-restore, plus exact-release comments.
• blueprints/convergence-practice/offhost-app-state/plan.json and blueprints/convergence-practice/offhost-restore/hosted-plan.json: prospective workflow-hash bindings refreshed with a corrections line, as 37a3b436 did.
• blueprints/convergence-practice/offhost-app-state/README.md (with the marker) and blueprints/convergence-practice/offhost-restore/README.md: one sentence each.
• scripts/native_token_ci.py: the discriminating fixtures and baselines, with failures isolated per fixture.
• fixtures/ast_grep_shell_calls.py and fixtures/markitdown-multi-element.html (new): the fixture inputs.
• tests/test_native_token_ci.py: fixture and baseline tests.
• tests/test_workflow_hardening.py:
  • the formerly hash-frozen jobs stay hardened
  • exact-release comments
  • test_github_automation_cites_only_existing_tests
  • the HASH_FROZEN check skips while nothing is frozen
• tests/test_foundation_stack_pins.py (new): every release link and gh release view command in docs/foundation-stack.md must name the manifests/stack.json pin of its repository.
• docs/foundation-stack.md: follows the manifest, with a dated history note:
  • ai-memory 2.4.1 (macOS 2.3.2)
  • vLLM 0.30.0, with 0.25.0 kept for rollback
  • the RTK v0.50.0 link and the canonical Headroom link
• docs/github-automation.md: the harden-runner paragraph now states the measured coverage; three dated sentences carry the markers.
• docs/decisions/2026-09-26-token-workflow-hardening.md (new): the decision record, with its alternatives and overturn conditions.
• evidence/artifacts/token-workflow-hardening-20260926/ (9 new files):
  • README.md, runs.json and two receipts
  • controls.json and controls_driver.py
  • mutation_check.py
  • actions_latest.py and actions-latest.json
• manifests/evidence.json: registration only (hot-file protocol, last commit).

Verification

These are the final acceptance commands at head 5c5e2a50 (repair round 2), run with the CI venv's Python. The worktree held only two untracked notes files.

$ python scripts/validate.py                    # rc 0: {"components": 69, "hashed_files": 7002, "profiles": 4, "receipts": 159, "status": "passed"}
$ python scripts/evidence_manifest.py --check   # rc 0: {"files": 7002, "status": "passed"}
$ python scripts/component_matrix.py --check    # rc 0: {"rows": 32, "status": "checked"}
$ python scripts/new_host_grand_list.py --check # rc 0: {"status": "passed", "layers": 32, "winners": 66}
$ python scripts/build_ecosystem.py --check     # rc 0: "status": "passed"
$ python scripts/host_receipts.py validate      # rc 0: {"receipts": 167, "status": "passed"}
$ python -m unittest tests.test_workflow_hardening tests.test_native_token_ci tests.test_foundation_stack_pins \
    tests.test_active_recovery_plans tests.test_adoption_docs_consistency tests.test_release_pin_contents tests.test_gitleaks_config
                                                # rc 0: Ran 178 tests in 121.465s, OK (skipped=2)
$ sha256sum --check --strict SHA256SUMS         # rc 0 (examples/claude-native/workflows, Node v24.21.0)
$ node --check <each .mjs>                      # passed on all 8
$ node test-envelope.mjs; node test-contract-mutations.mjs; node test-child-usage.mjs; node test-usage-receipts.mjs; node test-codex-envelope.mjs
                                                # 214/214, 47/47, 51/51, 18/18, 7 PASS 0 FAIL
$ python -m unittest discover -s tests -q       # rc 0: Ran 6268 tests in 679.877s, OK (skipped=643)

• Skips.
  • The two unit-module skips are test_hash_frozen_exemptions_are_still_pinned (no workflow is hash-frozen) and the existing conditional test_the_cell_check_rejects_wrong_and_missing_release_notes.
  • The full suite skipped 643 here and 644 in round 1 on the same commit. One conditional skip resolved differently between the two host runs.
  • test_pre_commit_gate passed the first time, and /tmp/.git was absent before and after.
• Static and secret scans (build and round 1).
  • The zizmor 1.30.1 offline gate command found nothing.
  • actionlint 1.7.12: rc 0.
  • gitleaks with the repository config found no leaks, through the pre-commit hook on both commits.
• Harness.
  • Two clean-environment --install runs gave 108 commands and 42/42 checks each.
  • The only failure is the known, by-design codebase-memory-mcp refusal: the scratch TMPDIR is too long for its socket path, and the hosted runner covers it.
  • The 25 added commands took 0.510 s and 0.539 s.
• Failing-first (round 1).
  • test_foundation_stack_pins: before, FAIL ['akitaonrails/ai-memory 2.3.2 (manifest: 2.4.1)'] != []; after, ok.
  • test_github_automation_cites_only_existing_tests: failed before, ok after.
  • The release-marker check: rc 1 before, rc 0 after.
• Evidence classes.
  • local_integration: harness runs and real-tool controls.
  • Local static analysis: zizmor, actionlint and gitleaks.
  • Documented API checks: gh api releases, tags, advisories and runs.
  • synthetic: the unit tests.
  • No hosted run of the new step yet.

Reviews

Adversarial review (Claude Opus) of the build: 1 medium and 4 low defects, 6 nits. It found no defect in the harness code, the workflows or the tests. Round 1 (816a879d and 5c5e2a50) fixed or corrected all of them; none was rejected.

Cross-family review (GPT-6) of 5c5e2a50: verdict NO DEFECTS.

• Reviewer: Codex CLI 0.157.1, model gpt-6-astra, reasoning effort max, sandbox read-only, approval never.
• Scope: head 5c5e2a50 against base dde28cc2.
• rc 0, as relayed by the review runner; no retained file records it. The transcript has no usage-limit, rate-limit or 429 text, and ends with the verdict, the Stop hooks and Codex's counter: 340,394 tokens used.
• Nothing changed after this review, so the head stays 5c5e2a50.

Residuals

These are copied verbatim from the notes. Repair round 2 is the final round and carries round 1's items 1-5 unchanged.

1. The PR's hosted native-token-tools run is the step's first execution and completes that job's overturn. Retain its run id and artifact before merge.
2. Off-host jobs: the coordinator accepts or rejects the prospective-binding ground. If it is rejected, dispatch both workflows on the PR branch (this needs the fixture Actions secret) and cite the run ids before merge, or take the step out as the decision's overturn section says.
3. zizmor's online audits run only in the PR's validate job.
4. Confirm that wt-ws2 and wt-ws2b are abandoned.
5. Unchanged from the build report: qmd's single-document index, the /tmp/.git creator on the host (absent during this round's runs as well), and the items owned elsewhere.
6. New: the GPT-6 verdict exists only in the scratchpad (codex-rev/review-pb-wp10.md and .err, with the scope in pbrev/gpt6-scope-wp10.md), which is not evidence of record. Before merge, the coordinator should carry the reviewer, model, head 5c5e2a50, rc 0, verdict and token count into the PR body or a sanitized receipt. This round did not add a receipt, because that would need a commit and re-registration outside its brief.

Item 6 is now covered: the Reviews section above carries the reviewer, model, head, rc, verdict and token count.

The items owned elsewhere, verbatim from the build report as it stood then. The MEMORY.md item was withdrawn in round 1 as already fixed.

• manifests/stack.json claude-code 2.1.278 and codex 0.155.1 (upstream v2.1.283 / rust-v0.157.1), with grand-catalog-handbook.md:200,202,602,619,631,637 (and verdict excerpts at 1176–1193, 1588, 1685, 1706), recipes/claude-native-profile.md:31 and recipes/README.md:86: u4/u5.
• socraticode 1.14.0 against upstream v1.15.0: owner of mcporter 0.14.1 cutover record corrected (leftover 0.13.13 daemon retired); socraticode mixed-version procedure #345.
• docs/token-efficiency-stack.md:179 ("RTK 0.49.0 gives Codex instructions, not a hook") and the redirected Headroom links at token-efficiency-stack.md:39 and token-session-handbook.md:130: new-machine files, also edited by the u-units.
• docs/stack.md: a labelled 09-19 snapshot, 11 rows behind.
• Hosted-model catalog (catalogs/us-equities/models.*, no Opus 5.5 entry): needs a decision.
• codex_job.py:15,273 --search: landscape sweep owner.
• foundation-stack.md:199 claude/claude-opus-5 and opus[1m] in the settings template: user model choice.
• context-mode SKILL.md:17 and the gpt-5-4-prompting skill: upstream text.

SOTA sources

• step-security/harden-runner v2.21.1:
  • Pinned commit e14015d583714f6e62063499dc959a02595150a1; tag v2.21.1 resolves to this commit, checked with gh api.
  • Release: https://github.com/step-security/harden-runner/releases/tag/v2.21.1.
  • Docs and egress-policy: audit usage: https://github.com/step-security/harden-runner.
• zizmor v1.30.1 (https://github.com/zizmorcore/zizmor, stack pin 99a054ed):
  • crates/zizmor/src/audit/ref_version_mismatch.rs and crates/zizmor/src/models/version.rs: why a moving major-tag comment raises a Medium finding.
  • Docs: https://docs.zizmor.sh/audits/#ref-version-mismatch.
• GitHub Dependabot options reference, cooldown (https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference): the 7-day cooldown behind the codeql-action v4.38.2 timing.
• rtk-ai/rtk v0.50.0 (https://github.com/rtk-ai/rtk/tree/v0.50.0): src/cmds/git/git_cmd.rs (the default 10-commit window, the trailer filter and the [+N lines omitted] form the RTK oracle follows) and src/core/guard.rs.
• markdownify 1.2.3 escaping options (https://pypi.org/project/markdownify/): it escapes _, which hid a leaked marker in the first control run.
• ast-grep pattern syntax (https://ast-grep.github.io/guide/pattern-syntax.html), at stack pin 0.45.3.
• Repomix code compression (https://repomix.com/guide/code-compress), at stack pin 1.18.1.
• TOON @toon-format/cli 4.1.1 (https://github.com/toon-format/toon/releases/tag/v4.1.1): the tabular encoding. The encoder is bundled, with no runtime dependencies.
• MarkItDown 0.1.8 (https://github.com/microsoft/markitdown/releases/tag/v0.1.8), the stack pin that the multi-element fixture exercises.
• GitHub REST API (https://docs.github.com/en/rest): releases, git tags, security advisories and workflow runs, used for the action-pin freshness and dispatch checks.
• This repository:
  • docs/decisions/2026-09-22-actions-hardening-fix-round.md: the operative overturn, "a re-run of that evidence which re-pins the workflow with the step in place".
  • Commit 37a3b436 (2026-09-20): the precedent for refreshing prospective bindings.
  • docs/lanes.md: the hot-file protocol.
  • docs/acceptance-evidence-policy.md: evidence classes.

🤖 Generated with Claude Code