test(release): define protected-main acceptance entrypoint

[seonghobae]

Protected-main Release Acceptance — ACTIVE DRAFT

This Draft implements #200 as a bounded test-first protected-main release-acceptance entrypoint. Fresh protected main is exact b84f0c94154043a3473939c01bb6471de5a129ae; current branch feat/protected-main-release-acceptance-b84f0c9 is unchanged at exact head 327d45bf86a8cfa28c92c95d88b2daf6466dbcde. Relative changes remain only .github/workflows/release-acceptance.yml and tests/test_release_acceptance_workflow.py; protected main was not mutated.

Bounded contract

Manual acceptance is allowed only for refs/heads/main, resolves and validates the live protected-main SHA, rejects stale dispatch identity, reuses the reproducible wheel/sdist job, and rechecks protected main immediately before acceptance evidence upload. Both GitHub ref reads are bounded with curl --connect-timeout 10 --max-time 30. Checkout credentials remain disabled and the workflow grants no contents/package/OIDC/attestation write authority.

Predecessor Advanced Security findings on direct curl | python -c response pipelines were repaired test-first. RED eeb3ec38d7e4226d4933792264c40a6608e98bb0 rejects the pipeline shape; GREEN 327d45bf86a8cfa28c92c95d88b2daf6466dbcde writes each bounded API response to a unique RUNNER_TEMP file, parses JSON only through stdin redirection, and removes the temporary file under an EXIT trap. Both original threads are resolved/outdated.

Exact-head evidence — refreshed 2026-08-30

For unchanged exact 327d45bf86a8cfa28c92c95d88b2daf6466dbcde:

• Release Acceptance 32256321532: terminal success and exact-head evidence for the bounded release-acceptance contract.
• CI 32256321486: terminal failure only at repository aggregate 100% statement/branch coverage. Python 3.10/3.12/3.14, container/PostgreSQL smokes, compile, Ruff, public-docstring coverage and the test body passed before the inherited protected-main weakref callback coverage gap stopped the workflow. Those two missing protected-main arcs are owned by dependency-root test(recovery): cover stale evidence registry cleanup #233. Steps after the failing aggregate coverage gate do not become passing CI evidence merely because a dedicated release workflow succeeded.
• Security Scan 32256321411: workflow conclusion success, but non-passing under the repository exact-source contract. Trivy job-log inspection proved default checkout fetched and checked out synthetic refs/pull/247/merge@73335e9334f9c023310c97c162a494ca4c9acdf0; Trivy scanned . from that synthetic workspace, not contributor head 327d45b.... The zero CRITICAL/HIGH/MEDIUM result therefore remains merge-preview evidence only.
• SAST Semgrep 32256321571: workflow conclusion success, but likewise historical synthetic evidence. Semgrep job logs proved checkout fetched and checked out the same synthetic refs/pull/247/merge@73335e9334f9c023310c97c162a494ca4c9acdf0 before scanning. Its 15 explicitly suppressed / 0 retained findings describe that synthetic workspace and are not exact-head SAST evidence for 327d45b....

The former central exact-source repair has since integrated and dependency-root #233 has independently regenerated exact-contributor-head Security/SAST evidence. Neither fact retroactively repairs this PR's 2026-08-19 synthetic scanner workspaces or transfers any gate to 327d45b.... Mutable central security/reviewer/scheduler state is intentionally not duplicated here; pg #244 is the sole pg-owned live ledger and read-only .github#1222 remains central acceptance tracking. This PR must reacquire its own exact-final-head scanner evidence after dependency integration and final-base reconciliation.

Fresh formal review inventory still contains only a COMMENTED GitHub Advanced Security submission; there is no qualifying APPROVED review. Fresh inline review inventory contains exactly the two prior Scorecard threads, both resolved and outdated. COMMENTED/status/bot evidence is not approval.

Dependency / integration boundary

Keep this PR Draft. #233 must first become protected-main authority. #233 now has regenerated exact-contributor-head CI, Release Acceptance, Security Scan, SAST Semgrep, and bounded Strix evidence on unchanged 5951b7a4d779903b8924abaef2a387cae50b7f54, so the old central exact-source-repair prerequisite is no longer a valid #233 blocker. #233 nevertheless remains non-passing because its active same-head OpenCode CHANGES_REQUESTED has not been superseded and no qualifying approval exists under live governance.

After #233 integrates, reconcile this branch against the then-current protected main and reacquire every invalidated gate. In particular, unchanged final-head scanner execution must prove the actual analyzed HEAD equals the final contributor head under then-protected central exact-source semantics.

Do not duplicate #233's tests, reinterpret current CI/Security/SAST conclusions as exact-head success, transfer predecessor/synthetic evidence, manufacture head churn, self-approve, or use admin bypass as acquisition evidence.

Merge only an unchanged final current-base head after every then-live CI/security/SAST/package/provenance/release gate is terminal-success with required checkout/source identity, zero valid findings/threads remain, and the then-live qualifying independent approval rule is satisfied. This capability creates acceptance evidence only; it does not publish, sign, attest, promote, deploy, create a release, or authorize a later protected-main tip.

Refs #200, #233, #244, #250, #251, #252; read-only central tracker .github#1222.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh control-plane correction to the PR body’s historical central-security paragraph: both exact-source scanner-owner repairs are now protected central authority.

• .github#897 is merged (b18ee32057c991428973e99a6ce84702123771cb) and protected central Security has post-integration exact-head consumer evidence.
• .github#941 is merged (7dd8a22bdd0ce9aa4a636eb410715134129f5c4d) and owns the protected exact-submitted-head SAST contract.
• Protected central main is currently 6c8ee24046d743b3981c566c6e29f99f09137f6a.

This does not retroactively upgrade this PR’s historical Security/SAST runs: #247@327d45bf86a8cfa28c92c95d88b2daf6466dbcde still has only the old synthetic-workspace Security/Semgrep evidence described in the body and therefore must reacquire those scanners after its #233 dependency is integrated/reconciled. The correction only removes the stale claim that the central Security repair itself is not protected authority.

Current #247 review state remains non-passing for integration: Draft/mergeable, one COMMENTED Advanced Security review, both historical inline findings resolved/outdated, and no qualifying APPROVED review. CI also remains historically blocked by the #233-owned repository coverage arcs. Keep this branch stable; do not churn it merely to manufacture scanner/review events.