Merge pull request #8 from SaiFlyBy/flyby/cell-enforcement-pro-20261105

Enforce coordinated target-cell ownership

Author: SaiFlyBy

.github/AGENTS.md

@@ -13,3 +13,13 @@ Code coverage is Rust-only; do not infer Python integration coverage from it. Th
 ## Build environment
 
 Swatinem/rust-cache hashes the CARGO* and RUST* variables visible at the cache step. Workflows sharing a cache must set the same variables before that step. A mismatch restores nothing without failing the job. Keep the existing tests and checks unless an evidence-based change justifies adjusting them.
+
+
+The manual `cell-candidate` gate is the bounded exception for this owner-admitted
+cell-coordination implementation. It uses only the already-qualified repository
+runner `[self-hosted, Linux, X64, worktrunk-docker]`, requires the owner as both
+actor and triggering actor, checks out the fixed implementation branch and
+refuses a SHA mismatch before executing candidate code. Live Actions policy
+10761 must remain active for all workflows, allowing only user 226779263. Normal
+PR/CI routing is unchanged. This gate has contents-read credentials only and
+does not permit arbitrary repositories, refs, commands or fork candidates.

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - worktrunk-docker

.github/actions/self-hosted-setup/action.yaml

@@ -0,0 +1,36 @@
+name: Prepare dedicated Worktrunk Linux runner
+description: Install the pinned Rust toolchain and minimal build dependencies in the owner-only runner.
+runs:
+  using: composite
+  steps:
+    - name: Check runner platform
+      shell: bash
+      run: |
+        test "$RUNNER_OS" = Linux
+        test "$RUNNER_ARCH" = X64
+    - name: Install native Rust dependencies
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends pkg-config libssl-dev
+    - name: Set up Python
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      with:
+        python-version: '3.12'
+    - name: Read checked-in Rust toolchain
+      id: toolchain
+      shell: bash
+      run: |
+        python - <<'PYTHON'
+        import os, tomllib
+        with open("rust-toolchain.toml", "rb") as source:
+            toolchain = tomllib.load(source)["toolchain"]
+        with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+            print("channel=" + toolchain["channel"], file=output)
+            print("components=" + ",".join(toolchain.get("components", [])), file=output)
+        PYTHON
+    - name: Set up Rust
+      uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8
+      with:
+        toolchain: ${{ steps.toolchain.outputs.channel }}
+        components: ${{ steps.toolchain.outputs.components }}

.github/tests/ci_policy_test.py

@@ -25,14 +25,16 @@
     'affected.yaml': {'collect-affected', 'affected-tests'},
     'ci.yaml': {'lint', 'feature-check', 'test', 'fast-checks', 'changes'},
     'coverage.yaml': {'code-coverage'},
-    'mission-control-bridge.yaml': {'bridge'},
+    'mission-control-bridge.yaml': {'bridge', 'cell-candidate'},
     'nightly.yaml': {'gate'},
     'publish-docs.yaml': {'build-docs'},
     'release.yaml': {'plan'},
 }
 ENTRY_GUARD = ("${{ github.event_name != 'pull_request' || "
                "(github.event.pull_request.head.repo.id != null && "
                'github.event.pull_request.head.repo.id == github.event.repository.id) }}')
+BRIDGE_GUARD = "${{ (" + ENTRY_GUARD[4:-3] + ")" + " && (github.event_name != 'workflow_dispatch' || inputs.candidate_sha == '') }}"
+CANDIDATE_GUARD = "${{ github.repository_id == '1443337118' && github.actor_id == '226779263' && github.triggering_actor == 'SaiFlyBy' && github.event_name == 'workflow_dispatch' && inputs.candidate_sha != '' }}"
 AFFECTED_GUARD = ("${{ github.event_name == 'pull_request' && "
                   'github.event.pull_request.head.repo.id != null && '
                   'github.event.pull_request.head.repo.id == github.event.repository.id }}')
@@ -129,7 +131,7 @@ def test_workflow_events_and_no_reporting_services(self):
                 self.assert_events(name, text)
                 for unwanted in ('codecov/codecov-action', 'CODECOV_TOKEN',
                                  'TEND_BOT_TOKEN', 'max-sixty/tend/',
-                                 'gist.github.com/', 'self-hosted',
+                                 'gist.github.com/',
                                  'signpath/github-action-submit-signing-request',
                                  'SIGNPATH_API_TOKEN', 'cargo publish --package worktrunk'):
                     self.assertNotIn(unwanted.lower(), text.lower())
@@ -152,6 +154,8 @@ def assert_pr_jobs_guarded(self, name, text):
                 self.assertIsNotNone(condition, f'unguarded entry job: {name}/{job}')
                 expected = (COLLECT_GUARD if (name, job) == ('affected.yaml', 'collect-affected')
                             else AFFECTED_GUARD if (name, job) == ('affected.yaml', 'affected-tests')
+                            else BRIDGE_GUARD if (name, job) == ('mission-control-bridge.yaml', 'bridge')
+                            else CANDIDATE_GUARD if (name, job) == ('mission-control-bridge.yaml', 'cell-candidate')
                             else ENTRY_GUARD)
                 self.assertEqual(condition.group(1), expected)
             else:
@@ -206,6 +210,42 @@ def test_multiline_or_quoted_job_condition_is_rejected(self):
             with self.subTest(replacement=replacement), self.assertRaises(AssertionError):
                 self.assert_pr_jobs_guarded('ci.yaml', source.replace(old, replacement))
 
+
+    def test_cell_qualification_route_is_owner_only_fixed_branch_and_exact_sha(self):
+        files = workflows()
+        labels = '[self-hosted, Linux, X64, worktrunk-docker]'
+        lint_config = (ROOT / '.github/actionlint.yaml').read_text(encoding='utf-8')
+        self.assertEqual(['worktrunk-docker'], re.findall(r'(?m)^    - (.+)$', lint_config))
+        for name, source in files.items():
+            if name != 'mission-control-bridge.yaml':
+                self.assertNotIn('self-hosted', source)
+        workflow = files['mission-control-bridge.yaml']
+        parsed = jobs(workflow)
+        block = parsed['cell-candidate']
+        self.assertNotIn('self-hosted', parsed['bridge'])
+        self.assertEqual(1, workflow.count(labels))
+        self.assertIn('    runs-on: ' + labels, block)
+        self.assertIn('ref: refs/heads/flyby/cell-enforcement-pro-20261105', block)
+        self.assertIn('repository: SaiFlyBy/worktrunk', block)
+        self.assertIn('ref: ${{ github.workflow_sha }}', block)
+        self.assertIn('[[ "$EXPECTED_CANDIDATE" =~ ^[0-9a-f]{40}$ ]]', block)
+        self.assertIn('test "$(git rev-parse HEAD)" = "$EXPECTED_CANDIDATE"', block)
+        self.assertLess(block.index('test "$(git rev-parse HEAD)" = "$EXPECTED_CANDIDATE"'),
+                        block.index('cargo build --locked --bin wt'))
+        self.assertIn('python tools/run_template_suite.py --expected-sha "$EXPECTED_CANDIDATE" --require-clean', block)
+        self.assertIn('MC_SOURCE_PROOF_REPO="$RUNNER_TEMP/../worktrunk-cell-fixtures/29efd0ffcac21717fd789da2c7020a7e02501e00/', block)
+        self.assertIn('WORKTRUNK_PRIVATE_PROOF="$HOME/worktrunk-cell-private-proof/', block)
+        self.assertIn('          umask 077', block)
+        self.assertIn('persist-credentials: false', block)
+        self.assertNotIn('secrets.', block)
+        self.assertNotIn('pull_request_target', workflow)
+        setup = (ROOT / '.github/actions/self-hosted-setup/action.yaml').read_text(encoding='utf-8')
+        actions = re.findall(r'(?m)^\s*(?:-\s*)?uses:\s*([^\s#]+)', block + setup)
+        self.assertTrue(actions)
+        for action in actions:
+            if action != './.github/actions/self-hosted-setup':
+                self.assertRegex(action, r'@[0-9a-f]{40}$')
+
     def test_coverage_and_test_artifacts_are_retained(self):
         files = workflows()
         self.assertIn('cargo llvm-cov nextest --features shell-integration-tests', files['coverage.yaml'])

.github/tools/cell_proof_receipt.py

@@ -0,0 +1,62 @@
+"""Publish proof metadata while retaining original-fixture log contents privately."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+
+def checksum(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def retain(private_root: Path, public_root: Path, expected_sha: str, provenance: dict) -> dict:
+    canonical = private_root / "canonical"
+    manifest = json.loads((canonical / "manifest.json").read_text(encoding="utf-8"))
+    summary = json.loads((canonical / "summary.json").read_text(encoding="utf-8"))
+    if manifest["observed_head"] != expected_sha or manifest["expected_head"] != expected_sha:
+        raise ValueError("private proof does not identify the approved candidate")
+    if public_root.exists() and any(public_root.iterdir()):
+        raise ValueError("public receipt destination is occupied")
+    public_root.mkdir(parents=True, exist_ok=True)
+    public_manifest = {key: manifest.get(key) for key in (
+        "schema", "started_at", "finished_at", "result", "origin_url", "branch", "observed_head",
+        "observed_tree", "expected_head", "dirty", "python", "platform", "runner", "layer_order",
+    )}
+    fixture = {key: provenance[key] for key in ("repository", "commit", "tree", "sealed_checksums")}
+    layers = []
+    for layer in summary.get("layers", []):
+        commands = []
+        for command in layer.get("commands", []):
+            row = {key: command.get(key) for key in (
+                "state", "exit_code", "timed_out", "elapsed_seconds", "started_at", "finished_at",
+                "stdout_sha256", "stderr_sha256",
+            )}
+            raw = command["command"]
+            row["command_sha256"] = hashlib.sha256(json.dumps(raw, separators=(",", ":"), ensure_ascii=True).encode()).hexdigest()
+            row["command"] = ["<verified-original-source>/archive/mission-control-v6" if index and raw[index-1] == "--mission-root" else value
+                              for index, value in enumerate(raw)]
+            commands.append(row)
+        layers.append({"layer": layer["layer"], "required": layer["required"], "state": layer["state"], "commands": commands})
+    receipt = {"state": summary["state"], "started_at": summary.get("started_at"),
+               "finished_at": summary.get("finished_at"), "layers": layers,
+               "log_contents_published": False, "private_evidence_retained": True,
+               "runner_stdout_sha256": checksum(private_root / "runner.stdout.txt"),
+               "runner_stderr_sha256": checksum(private_root / "runner.stderr.txt")}
+    for name, value in (("manifest.json", public_manifest), ("summary.json", receipt), ("fixture-provenance.json", fixture)):
+        (public_root / name).write_text(json.dumps(value, indent=2) + "\n", encoding="utf-8")
+    return receipt
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--private-root", required=True, type=Path)
+    parser.add_argument("--public-root", required=True, type=Path)
+    parser.add_argument("--candidate", required=True)
+    parser.add_argument("--provenance", required=True, type=Path)
+    args = parser.parse_args()
+    result = retain(args.private_root, args.public_root, args.candidate,
+                    json.loads(args.provenance.read_text(encoding="utf-8")))
+    print(json.dumps({"state": result["state"], "layers": [{"layer": row["layer"], "state": row["state"]} for row in result["layers"]],
+                      "log_contents_published": False}))