fix(ci): validate candidate identity before product proof

[schlessera]

Refs #2118

What changed

Confirmation metadata now applies the existing candidate identity guard after planning and before product discovery or dispatch. An incompatible requested head/base, actual merge checkout or live identity stops metadata before dependent product proof starts. The final aggregate repeats live head/base/readiness and immutable checkout validation because admission cannot freeze refs. Draft and synchronize feedback cadence, fork permissions, proof selections, retention validation, image pins and runtime limits remain intact.

Why this shape

This follows #2118 and the CI decision. The seven-file contribution reuses the existing guard and retains final freshness validation. Reservation #2111 and native event identity #2141 remain separate work. No package behavior or machine contract changes; no changeset is needed.

Proof

Fresh local qualification on head 89e3d72662a13054ebff3f0f95c28fc34822ab27, integrated base 90a95123cfceb169bd2ecf7c213544db742eaed7, tree 81a711f2490944476bfe66871b93fb91f3217252. This is the qualified source head/tree, not an actual hosted synthetic checkout receipt. Independent review of the full seven-file contribution found no actionable defects; source remains unchanged.

• Focused candidate-proof/admission/planner/workflow/hosted-proof and generated-input/stylesheet/theme/inclusion controls: 128 passed / 1,249 assertions. The changed-live-base final-gate negative control remains passing.
• Native diagram input self-tests only: 10 passed / 51,807 assertions, using independently frozen source and installed identity controls. This does not establish native-host qualification or current native producer execution.
• Removing the actual early workflow step makes the real product child dispatch: the named NO_PRODUCT_DISPATCH_BEFORE_CANDIDATE_ADMISSION assertion fails with expected false / received true. Exact workflow-byte restoration passes 3 tests / 15 assertions. The red receipt is behavioral, not a module-load failure.
• Strict repository tsc --noEmit: passed.
• Default actual preflight below: all lint/leakage, metadata and contribution gates passed; 960 fast tests / 6,357 assertions across 48 files and 82 feedback tests / 546 assertions across five files; no failures or reported skips. Actual selection exactly matches the approved global/all-19-workspace plan, SHA-256 c1845924e3fb2d115f906297b15f683619784e4e42fa5d3336a068fbff8f4cb2. Complete selected hosted categories remain pending.

bun run check:pr --base origin/main

Preflight ran 2026-10-19 07:07:05–07:08:53 UTC: 107.050 command-wall seconds / 178.642 child CPU seconds / 2,675,996 KiB maximum child RSS. Full diagnostic SHA-256: d478930c16b931c7343adf87b81dbf62c0745fd31b31055a37539ce2e12bc02e. These are local validation costs, not hosted measurements or performance gains.

Fresh private-cache frozen-lockfile copyfile installation was checked against all 843 installed package identities; no mismatches, external symlink targets or shared regular-file links. Installation hash before/after: 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245 (59,516 files / 1,833,832,361 bytes). Actual local Bun 1.4.3 is distinct from the hosted pin 1.4.2. Tests retain UID/GID 1000, dropped capabilities, a verified separate route-free network namespace, offline preloads, private disk-backed temporary storage/ledger, normal HOME and owned output-lock coordination. Source, manifests, lockfile, base and installation identities remain unchanged after preflight.

Historical hosted evidence retains its original identity

• Run 39108053927, attempt 1, remains failed: 14 successful jobs; browser (2) and aggregate failed. Actual checkout e0cf94becd6aef22e2a355f9aef6fa035b774940, parents base ea4c76c15eee2e23701910b7c2395bdd479b99c6 / head 939922b76cff8e1141e2730c2316daf697e80a16, tree 78019dc3bb65b7489871bab38878eaae737fa657. Admission passed; two WebKit authored-narrow case deadlines failed through the then-open ci: authored narrow grouped diagram notes exceed WebKit case deadline #2386, and the aggregate correctly refused the failed shard. Its 9,049 summed job-wall seconds are failed qualification costs. Delivered ci: authored narrow grouped diagram notes exceed WebKit case deadline #2386/test(ui-react): separate narrow callout geometry and capture #2393 is integrated now; this does not retrospectively qualify that run.
• Earlier stale-admission run 38935262062 rejected stale input in metadata before nine product categories. Its 23-second metadata job is rejection-path evidence, not complete candidate proof.
• Earlier run 39082082794 diagnosis retains its five ci: generated stylesheet self-tests reject legitimate producer drift #2373 fixture failures and final changed-live-base refusal. Delivered fixture corrections do not relabel that failed source/run as green. Earlier local receipts remain attributed to their recorded heads/bases.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. Local proof is complete; hosted proof remains pending.
• Acceptance criteria from the issue are all met, or the gap is named below. Remaining qualification/delivery work is named below.
• The PR and advanced issue retain verified release milestone 0.44.0; read back again before merge.
• No changeset: this changes internal CI/process, not consumer package behavior.
• No personal data in the diff; local lint/leakage gates passed.
• No machine surface moved.
• CI decision and testing documentation reflect the change.
• Nothing on a provider turn path changed; append-only provider history is unaffected.

Anything left open

Keep draft and Refs #2118. The parent coordinator retains claim release044-2118-r2-20261019, the issue assignment, and exclusive authority for the later confirmation/merge window. Complete selected exact-candidate hosted proof, actual metadata admission and every selected job/checkout identity, independent final aggregate/live-base reconciliation, source-bound event/queue/execution receipts, milestone readbacks, matching-head merge and actual-squash/main verification remain pending. This publication requests no ready-candidate confirmation and makes no whole-CI saving or complete qualification claim.

[schlessera]

Hosted early-admission evidence — 2026-10-16:

Run 38935262062, attempt 1, metadata job 117089050612 actually checked out 216f260d1186dc056d9ab2e8850a7318854c2e4a, parents requested base ff85aca0f86fa3498acc3685bac7173d67b8a0ce and PR head da57760e36fdb087a7b8ddb23c0867a5ad1b6de9, tree 31ffae2edbade15d34b48aef5439e3e03ea79cc8. Immutable GitHub commit evidence agrees with the checkout log.

The actual Validate requested candidate before product proof step ran 17:34:18–17:34:19Z and rejected Candidate became stale: the live PR head, readiness or base changed; request confirmation again. Metadata consumed 23 job elapsed seconds (17:33:59–17:34:22Z). All nine product categories are skipped after that failure; the aggregate remains queued. This is a successful exercise of the stale-admission rejection path, not a passing workflow or complete candidate qualification. No older passing receipt is attributed to the new live base.

Remaining: refresh/verify the live ordinary candidate in an owned confirmation window, establish the passing admission path and all selected actual job/checkout results, then milestone readback and matching-head merge with actual main reconciliation. No unchanged rerun or proof waiver was requested. PR #2176 and its implementation remain preserved.

[schlessera]

Machine handoff — 2026-10-19

Refs #2118; existing draft PR #2176. Campaign claim 044-identity-20261018 remains parent-held. This worker has stopped implementation for the requested machine transition and will not install dependencies, allocate native backing, request confirmation or merge.

Preserved remote branch: fix/2118-admission-refresh-044.
Head: 89e3d72662a13054ebff3f0f95c28fc34822ab27.
Integrated base: 90a95123cfceb169bd2ecf7c213544db742eaed7 (independently queried live main, then fetched).
Head tree: 81a711f2490944476bfe66871b93fb91f3217252.
Head parents: previous refresh faa99ce2ad3f05ad47bedf42e9b00fd90903e36f and integrated base above.

git ls-remote --heads origin refs/heads/fix/2118-admission-refresh-044 reads back the exact head above after successful push. The first push received a generic remote rejection; one verbose retry succeeded, and independent readback confirms preservation. The working tree is clean, there are no unpushed commits on this branch, and this worker leaves no running installation/test/build/native process. No worktree or artifact was deleted during this wrap-up.

PR #2176 itself remains open/draft on its original remote head 939922b76cff8e1141e2730c2316daf697e80a16. The new preservation branch has not replaced that PR head; no new PR was opened. The remote refresh is a source-preservation handoff, not a qualified ready candidate.

Source integration is clean and still has the original seven-file contribution. Delivered #2386/#2393, draft-readiness guard #2398 and native positive-fixture correction #2365/#2374 are integrated. Reservation #2111 and native stacked-event identity #2141 remain independently owned scope. No production pins, scenario selections, permissions, runtime bounds or final freshness checks were weakened.

Completed on head 89e3d72662a13054ebff3f0f95c28fc34822ab27, base 90a95123cfceb169bd2ecf7c213544db742eaed7, tree above:

• git diff --check origin/main: pass.
• bun scripts/check-ci-workflows.ts: pass.
• bun scripts/check-leakage.ts: pass.
• Source-checker mutation: remove the actual early workflow step, then bun scripts/check-ci-workflows.ts exits 1 with metadata: confirmation admission must validate identity after planning and before product discovery. Byte-for-byte restoration exits 0 and leaves the checkout clean. This is source-checker proof only; it does not replace the required real product-child dispatch mutation.

Limitations: this checkout has no installed dependencies. The prior install failed with ENOSPC and its incomplete outputs were removed before this transition. Space subsequently recovered, but the parent reserved installation and native-runtime capacity for another worker. No fresh candidate/admission runtime suite, actual product-dispatch mutation, typecheck or required check:pr has run on this refreshed head. Historical passing receipts remain attributed to their original heads/bases. No current complete hosted green, actual synthetic checkout identity, performance gain or merge qualification is claimed.

Next machine steps:

1. Fetch origin/fix/2118-admission-refresh-044, verify its exact head above, and create a dedicated owned checkout without moving any existing worker. Re-read ci: reject requested checkout identity mismatches before expensive confirmation #2118/fix(ci): validate candidate identity before product proof #2176, ownership, reviews, live main and prerequisite delivery. The coordinator must release or explicitly transfer the parent-held claim; this worker does not remove another owner's shared-account assignment. Last readback: issue open, sole shared-account assignee; PR open/draft; both retain 0.44.0.
2. Once the parent releases installation capacity, perform an owned fresh-cache frozen-lockfile copyfile install with the repository's pinned runtime. Integrate/assess any additional relevant main changes before qualifying. Do not reuse another worker's mutable dependencies.
3. With the repository's ordinary-UID offline harness and owned disk-backed temporary storage, run focused candidate-proof, candidate-admission, ci-plan, ci-workflows, hosted-proof, generated-input/stylesheet/theme/inclusion and native-diagram fixture tests. Preserve the changed-live-base final-gate negative control. Remove the actual early admission workflow step and demonstrate the named NO_PRODUCT_DISPATCH_BEFORE_CANDIDATE_ADMISSION failure from real product dispatch; restore byte-for-byte and pass. Run strict types and bun run check:pr --base origin/main. Native runtime execution still needs the parent's separate resource slot.
4. After successful local proof, recheck PR state/head and safely fast-forward the existing PR head branch from this preserved descendant, or obtain an explicit ownership adjustment. Keep it draft; refresh its description and source-bound receipts. Do not open a duplicate PR or request expensive confirmation during the handoff.
5. Return final exact head/base/tree and proof to the parent for one explicit confirmation/merge window. Complete selected hosted proof, reconcile actual admission/job checkout/aggregate identities and queue/execution receipts, then release milestones and actual-main reconciliation remain required acceptance work. No merge window is requested by this incomplete local qualification.