Repository navigation
Share trusted admission plumbing while keeping each product's validator local #693
Description
🤖 Generated by the Agentic Engineer
The catalogue and monorepo enrollment, native controls, and two-policy retirement are delivered and published, as recorded in the verified 2026-10-22 receipt below. This does not complete the game migration or retirement of the third singleton.
Maintainer decision (2026-10-24): the remaining workflow-ownership cleanup is explicitly decoupled from World #1495. Keep the performance issue open and its below-900-second acceptance criteria unchanged. Complete native CI, current-head review, trusted enforcement, protected merge and post-merge verification remain mandatory; this is a planning dependency change, not a claim that the performance target passed.
Finish the workflow ownership cleanup without allowing a candidate pull request to replace the validator that judges it. The remaining .github deploy guards, monorepo aggregate guard and World at Ruin regression control currently need independent reviewed sources.
Use one genuinely cross-product, read-only required admission runner. It resolves GitHub's immutable product base and calls that product's fixed local admission action. Product decisions, tests and data collection remain in the product repository; the shared source owns only event/source validation and execution plumbing. Reuse the existing GitHub identity and do not add an App or widen credentials.
Acceptance:
- Product actions share a small candidate-SHA interface; candidate-controlled action files never supply the trusted implementation.
- PR/merge-group base resolution, unknown origin/event/config refusal, immutable checkout and bounded product-owned budgets have executable negative controls.
- Root and .github guards retain their API/data-only candidate treatment; World retains its complete trusted selection and containment boundary.
- Old required gates remain active while the new source and product actions merge. Additive managed enforcement is released, reconciled and read back before positive and tampering controls on real consumer PRs.
- Retire the three singleton organization rules only after those native controls, keeping all unrelated protections. No static fixture or source merge alone completes the cutover.
- Existing CI/runtime blockers remain independent gates; this migration does not waive them.
Part of #287. Monorepo foundation: devantler-tech/monorepo#4407. Existing World runtime blocker: devantler-tech/world-at-ruin#1495.
Metadata
Metadata
Assignees
Type
Fields
Priority
Projects
- Status
Activity
chore: agent-claim #693 nonce=2438f9a2809a368bdb7835ab647860e5
devantler commentedon Oct 22, 2026
The shared source is merged through #694, as
85777b80c72a6302b5f8c8a87414b8d067fbc6d2. Its merged tree matches the reviewed head exactly. Current-head CI, native CodeQL and CodeRabbit were clean before protected merge.The next increment is deliberately additive: enroll monorepo only, keep its original trusted gate active, and require the real executed product result through a repository-owned GitHub Actions binding. Keep this configuration repository unenrolled as a recovery path until real positive and tampering-refusal controls pass. This is staged activation, not completion of #693 or the portfolio cleanup.
The candidate policy regression starts from the real rendered configuration and rejects 37 independent source, scope, producer, bypass, lifecycle and CI-wiring mutations. No App or credential permissions change. Managed publication, native policy readback and actual injected controls still gate retirement of either old source.
chore: agent-claim #693 nonce=2245c6745506d43a35035fe77fecf8b3
chore: agent-claim #693 nonce=2c853ea7e8718de6cefcffa8893a0290
chore: agent-claim #693 nonce=08c98581a844530de8b01123f2a144a7
chore: agent-claim #693 nonce=e1efc90cd3d8942ee51ae526de27f350
chore: agent-claim #693 nonce=0112b06d009f50759fa1fa69f15ccb58
chore: agent-claim #693 nonce=56499d0cec5090b67ff842a31dc54c08
15 remaining items
chore: agent-claim #693 nonce=19d8426138f5483a49e52281f9c5eed6
devantler commentedon Oct 22, 2026
The catalogue and monorepo retirement slice is published and applied:
747b1891a1a41afd89c050dbd7527923de6348d8; release v10.0.5 points to that exact commit.This completes the two-policy retirement slice. #693 remains open for the remaining source/game migration and the third singleton's retirement; this receipt does not complete those gates.
chore: agent-claim #693 nonce=57b5f4a816f38d330b4adfa08cf99cc5
chore: agent-claim #693 nonce=cccfc44128fdd790f0bda4cf230c9106
chore: agent-claim #693 nonce=de51abc5fe569b6cd124c9aabb3071c9
chore: agent-claim #693 nonce=22a5daf15ae2ec5a62eb3d223727b808
chore: agent-claim #693 nonce=801f30372e859d46802daacb0ffb7e54
chore: agent-claim #693 nonce=ccfb5509ba9fa245a01f7a6aa0c461ec
devantler commentedon Oct 22, 2026
The two-policy retirement slice is already delivered: v10.0.5 is published, its exact-source CD run succeeded, and fresh effective-rule reads still require the shared admission runner and the independently bound executed-result checks on the catalogue and monorepo.
The remaining game migration and third singleton retirement are not complete. World runtime-budget issue devantler-tech/world-at-ruin#1495 is still open with its acceptance unmet. Added that native blocking dependency, recorded the resume condition in this issue, and returned the card from In Review to Ready. All original acceptance criteria and prior delivery evidence are retained; this is not a completion receipt for #693.
devantler commentedon Oct 24, 2026
Native overlap validation is in progress in devantler-tech/world-at-ruin#1545. This is a temporary draft and will be closed without merging. Both established and shared gates remain active; source publication alone is not being counted as the cutover.