fix(trust): roll forward audited central workflow source

ARCHITECTURE.md

@@ -28,7 +28,7 @@ Routes have different meanings: `/health` is liveness, `/ready` is offline confi
 
 This revision exposes both `ALLOWED_WORKFLOW_REF_PREFIX` and `ALLOWED_WORKFLOW_SHA`. Despite the legacy ref-binding name, `src/worker.ts` parses `ALLOWED_WORKFLOW_REF_PREFIX` as one **exact full workflow ref** and compares decoded `job_workflow_ref` or `workflow_ref` for exact equality. Wildcard, comma, whitespace, and prefix-sharing configuration forms are rejected. `src/runtime-entrypoint.ts` performs readiness dispatch and delegates `/exchange`; `src/entrypoint.ts` applies the distributed rate limiter before `src/worker.ts` performs its denial-only exact workflow-ref precheck. `src/index.ts` independently enforces the exact workflow ref/repository plus immutable `job_workflow_sha` or fallback `workflow_sha` after cryptographic verification. Missing, malformed, mismatched, or non-canonical configured source identity fails closed.
 
-`wrangler.toml` pins `ALLOWED_WORKFLOW_SHA` to protected central `.github` commit `3a7941aa92de00b8b39fd11cbe7bf3da2fbbeddc`, audited after the central scheduler-only movement from predecessor `e03f473723dbcc15080fd580f46c0f8d409c939d`. The trusted `.github/workflows/noema-review.yml` blob remains byte-identical at `5c60782adb8be11d6538caea269a4bdfab7ab4d1`. The current central commit itself is not represented here as signed provenance; this is an explicit protected-ref plus exact-workflow-content trust decision, not a claim that unrelated central tree changes or future revisions are equivalent. GitHub OIDC `job_workflow_sha` binds the caller to the repository commit identity, so every later central commit movement still requires a new explicit Noema trust roll-forward and fresh exact-head evidence. The central repository remains a read-only dependency from Noema; known central consumer/scanner defects remain owned and repaired there rather than by weakening Noema verification.
+`wrangler.toml` pins `ALLOWED_WORKFLOW_SHA` to protected central `.github` commit `1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5`. The exact trusted `.github/workflows/noema-review.yml` blob at that protected commit remains Git blob `064c4e5aeedcbb188196bd4800a0b918abd6da27`. Movement from `c8cc68a34bd19a91e2544acf08f2ead142ba702b` to current `1cbb6a...` leaves the workflow bytes unchanged but modifies the materialized trusted source tree in `scripts/ci/noema_review_gate.py` and its focused tests, adding one bounded correction attempt when the trusted verdict validator rejects an invalid changed-line/adversarial verdict. Because `noema-review.yml` materializes the complete trusted central source tree at its immutable workflow SHA and then executes `python3 -m scripts.ci.noema_review_gate`, this source-tree change is trust-relevant even though the workflow blob is unchanged; Noema re-audited the exact protected one-commit delta before accepting the new repository commit identity. More generally, Noema re-audits both the exact workflow blob and every relevant protected central delta before each repository-commit movement; ancestry alone is insufficient because GitHub OIDC `job_workflow_sha` binds the caller to that exact repository commit identity. The central repository remains a read-only dependency from Noema. The protected central OIDC consumer still reads a top-level `.token` from the exchange response while Noema's stable success envelope exposes the credential under `data.token`; that consumer defect remains central-owned and is not repaired by weakening or reshaping Noema's stable envelope.
 
 The configured workflow ref and source SHA are operator authority bytes, not normalization input. The protected workflow-ref parser and authoritative verifier do not trim whitespace from these trust values before validation/comparison. A whitespace-bearing value therefore fails as unusable configuration rather than being normalized into a different trusted identity. On an active PR head this statement is candidate truth if the corresponding source delta is not yet on the live protected base.
 
@@ -152,4 +152,4 @@ Root README/customer copy may have a separate active owner; the canonical archit
 
 The default shape is **small credential-exchange service + explicit state coordinators + external orchestration/review planes**. New model orchestration, artifact processing, repository mutation, or deployment authority should first be evaluated as a separate bounded component rather than folded into `/exchange`.
 
-Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.
+Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.

test/trusted-workflow-source-rollforward.test.ts

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
 const auditedCentralWorkflowSourceSha =
-  "3a7941aa92de00b8b39fd11cbe7bf3da2fbbeddc";
+  "1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5";
 
 describe("trusted central workflow source revision", () => {
   it("binds the deployed OIDC trust configuration to the audited central source commit", () => {
@@ -12,4 +12,4 @@ describe("trusted central workflow source revision", () => {
       `ALLOWED_WORKFLOW_SHA = "${auditedCentralWorkflowSourceSha}"`,
     );
   });
-});
+});

wrangler.toml

@@ -24,7 +24,7 @@ ALLOWED_AUDIENCE = "cwl-noema-review"
 ALLOWED_REPOSITORY_OWNER = "ContextualWisdomLab"
 ALLOWED_WORKFLOW_REPOSITORY = "ContextualWisdomLab/.github"
 ALLOWED_WORKFLOW_REF_PREFIX = "ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main"
-ALLOWED_WORKFLOW_SHA = "3a7941aa92de00b8b39fd11cbe7bf3da2fbbeddc"
+ALLOWED_WORKFLOW_SHA = "1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5"
 GITHUB_API_BASE = "https://api.github.com"
 NOEMA_RATE_LIMIT_PER_MINUTE = "60"
 NOEMA_OIDC_JWKS_CACHE_TTL_SECONDS = "300"