PR-3: GitHub automation hardening and the new-machine handbook (WSL2 accepted, macOS drafted) - #62

publish-catalog.yml now also runs on push: tags: ['v*'] (job condition
extended to startsWith(github.ref, 'refs/tags/v') || refs/heads/main) and
attests a syft 1.52.0 SPDX SBOM alongside the existing archive attestation,
with both verified in-run via gh attestation verify.

adoption/bootstrap-linux.sh ports agent-lab's devcontainer bootstrap into the
catalog: Linux x86_64 Ubuntu/Debian only, refuses root, fails closed on any
null-hash pin, and installs the pinned tools in adoption/pins-linux-x86_64.json
(all ten pins fetched and SHA-256/npm-integrity verified in this worktree, and
the script was run end-to-end into a disposable prefix with
--skip-system-packages: every installed codex/claude/qmd/rtk/ai-memory/
mcporter/context-mode binary matched its pinned version). adoption-bootstrap.yml
exercises the same path on a disposable ubuntu-24.04 runner and is labeled
synthetic/local-integration evidence, not second-machine acceptance.

tests/test_adoption_bootstrap.py adds 18 stdlib tests covering the pins
schema, profile-to-pin coverage, root/null-hash refusal, and workflow
references. Full suite: 1171 tests (1153 base + 18 new), OK.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…ree foundation decisions

Build adoption/bootstrap.md as the single ordered new-machine walkthrough,
the Linux/WSL2 (accepted) and macOS arm64 (drafted, not accepted) platform
pages, and adoption/templates/* plus tools/adoption/render_config.py, which
reproduces this host's live ~/.claude/settings.json, ~/.codex/config.toml
and agent-lab/.codex/config.toml byte-for-byte from nine placeholders
(native_proven: `render_config.py --host wsl-seath --check` reports all
three files byte-identical on this host). Register platform_profiles and a
drafted macos-arm64-foundation profile in adoption/manifest.json, extend
tests/test_adoption_contract.py, and add tests/test_render_config.py.

Add three catalogs/foundation/decisions.json rows (new-pc-bootstrap-ci,
macos-embedding-backend, agent-lab-hosting), each selection: candidate,
review_status: source_review, with named alternatives and an explicit
overturn condition, since none has a native hosted-CI or macOS execution
receipt yet. Record the local verification run and its limits in
docs/tasks/2026-09-22-github-automation-newpc.md and
evidence/receipts/github-automation-newpc-20260922.json, registered in
manifests/evidence.json files[] and rehashed.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

… coverage

- docs/github-automation.md: qualify the "active main ruleset" paragraph as
  the pre-upgrade applied state and point to the "Ruleset upgrade" section,
  since main-ruleset.json was already edited ahead of coordinator application
  and no longer matches what is live.
- docs/github-automation-evidence.json: annotate the settings_after block
  (historical ruleset-application evidence) as describing the prior applied
  state only, not a claim that the current committed main-ruleset.json
  matches the live ruleset.
- tests/test_workflow_security_coverage.py (new): give catalog-freshness.yml
  and supply-chain.yml an offline zizmor pass/fail assertion in
  `python3 -m unittest`, not only in the validate job's directory-wide CI
  step. Added as a new file (not an edit to test_workflow_security.py)
  because that file is a hash-frozen evaluation input for
  blueprints/convergence-practice/ci-security/experiment.json; editing it in
  place broke that pre-existing, out-of-scope evidence record under
  validate_convergence.py.
- manifests/evidence.json: register the new test file and rehash the
  unchanged-content re-verification of test_workflow_security.py.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

- publish-catalog.yml: cd into PUBLICATION_DIR before hashing the SBOM
  (it was written to $RUNNER_TEMP/catalog-publication, not the workspace);
  pin --predicate-type https://spdx.dev/Document on the SBOM's
  gh attestation verify (gh defaults to the SLSA provenance predicate);
  give the archive and SBOM upload-artifact steps distinct explicit
  names so the second upload no longer 409-conflicts with the first.
- docs/github-automation.md: add the same --predicate-type flag to the
  operator verify snippet so it doesn't fail the way the workflow did.
- adoption-bootstrap.yml: install Python 3.13 (actions/setup-python)
  before running scripts/adoption_status.py, matching
  adoption/manifest.json's supported_platforms; ubuntu-24.04's default
  python3 is 3.12, so the status step always exited 2 without this.
- adoption/bootstrap-linux.sh: export bin_dir onto PATH before any pin
  installs (not after), so npm-kind and uv-tool-kind pins resolve the
  node/npm and uv symlinks just installed rather than a pre-existing
  or absent host copy on a clean machine; replace the fixed five-tool
  version report with a loop over every symlink actually placed in
  bin_dir so the retained evidence log matches what really ran.
- tests/test_adoption_bootstrap.py: add regression tests for all of
  the above (PATH-export ordering, version-report coverage, SBOM hash
  working directory, predicate-type pinning, unique upload-artifact
  names, doc snippet, and the Python 3.13 setup step).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

… kind/registration, embedding port/model conflation, adoption_status.py run, and CI gate disclosure

- render_config.py: replace the hardcoded catalog-checkout default for
  project.codex.config.toml's --check path with a resolver that honors
  ADOPTION_PROJECT_ROOT or falls back to cwd, since the catalog checkout has
  no .codex/config.toml and the old default could never exit 0. Document
  --live-codex-project explicitly in bootstrap.md step 4, with a new
  trust-state warning about the rendered config's inherited project-trust
  and hook trusted-hash entries. Added two regression tests.
- Reclassified the new receipt's kind from the unregistered "local_integration"
  to "native_cli_e2e" (in RECEIPT_KINDS), gave it non-empty component_ids, and
  registered it plus the nine other new publication files in
  manifests/evidence.json files[]/receipts[], then rehashed.
- Corrected the macOS embedding-backend framing: port 8231 in the Linux
  profile serves the 2048-dim Nemotron RAG endpoint, not the 768-dim
  embeddinggemma QMD index model it was conflated with. macOS default now
  uses a distinct port 8232, and the acceptance test names a Linux
  llama.cpp embeddinggemma reference vector rather than an undefined
  cross-dimension comparison. Applied consistently in
  catalogs/foundation/decisions.json and the task record.
- Actually ran scripts/adoption_status.py (overall and
  --profile macos-arm64-foundation) and recorded the exit codes, confirming
  the Python-version mismatch predates this unit and the new macOS profile
  correctly reports its commands absent on Linux.
- Disclosed that scripts/build_ecosystem.py --check currently fails on this
  branch (new decisions/profile missing from the unregenerated
  docs/ecosystem/index.html) as an unresolved CI merge gate for the
  coordinator, not only a documentation limitation.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…h (automation interfaces and doc sections unioned)

…e the object separator lost in the automation.json union

… grand catalog

Adds the scheduled catalog-freshness lane, the secret-scan job and examples byte-identity check in validate.yml, the supply-chain SBOM/vulnerability lane, tag-triggered publication with an SPDX attestation, the adoption bootstrap lane and pinned Linux bootstrap script, CODEOWNERS/SECURITY.md/PR template, the ruleset upgrade files (not yet applied), the new-machine handbook (bootstrap page, Linux/WSL2 accepted and macOS arm64 drafted-not-accepted profiles, config templates and renderer), three foundation decisions and the dated record. Coverage test updated for the workflow added by a sibling unit; automation.json union separator restored. Explorer regenerated and evidence rehashed; validators, zizmor, actionlint, shellcheck and 1,193 tests pass.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…ion rows unioned

…rded size exclusion

The first hosted secret-scan run was cancelled by its timeout while re-diffing the generated explorer HTML on every commit. The job now uses .gitleaks.toml (the existing QuantConnect-hash rule allowlist plus global allowlists for 64-hex/40-hex digests and opaque pagination cursors, the only shapes a classified full-history scan produced) and --max-target-megabytes 2; the explorer HTML is therefore not scanned and docs/github-automation.md records that as incomplete coverage with the measured numbers (522 commits, 777 MB, 34 s, 251 → 0 findings).

Co-Authored-By: Claude Fable 5.1 <[email protected]>