ci: check bundled model config provenance

.github/actions/build-platform-wheel/action.yml

@@ -91,6 +91,23 @@ runs:
         mv repaired-wheelhouse/*.whl wheelhouse/
         python python/aisimulate/tools/verify_release_wheels.py wheelhouse
 
+    - name: Check exact wheel configuration provenance
+      shell: bash
+      run: |
+        python scripts/ci/check_bundled_configs.py extract --check \
+          --wheel wheelhouse/*.whl \
+          --output-dir "${RUNNER_TEMP}/bundled-configs-platform"
+
+    - name: Preserve wheel configuration inventory
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: bundled-configs-platform-${{ inputs.build_method }}-${{ inputs.python_architecture }}
+        path: |
+          ${{ runner.temp }}/bundled-configs-platform/bundled-deps.csv
+          ${{ runner.temp }}/bundled-configs-platform/bundled-provenance.json
+          ${{ runner.temp }}/bundled-configs-platform/extracted-files.json
+        if-no-files-found: error
+
     - name: Verify installed unified wheel
       shell: bash
       run: |

.github/codeowners/areas.yaml

@@ -121,6 +121,7 @@ areas:
       - tests/test_e2e_hf_measurements.py
       - tests/test_e2e_accuracy_workflow.mjs
       - tests/test_source_compliance.py
+      - tests/test_bundled_configs.py
 
 # More-specific shared entries are emitted after base area rules, preserving
 # GitHub's last-match-wins behavior. As in AIConfigurator, the maintainer team

.github/workflows/ci.yml

@@ -616,6 +616,20 @@ jobs:
       - run: python -m pip install --require-hashes -r scripts/release/requirements.txt
       - name: Build the application test wheel once
         run: python scripts/release/build_manylinux_wheel.py --output-dir application-test-dist
+      - name: Check exact wheel configuration provenance
+        run: |
+          python scripts/ci/check_bundled_configs.py extract --check \
+            --wheel application-test-dist/*.whl \
+            --output-dir "${RUNNER_TEMP}/bundled-configs-application"
+      - name: Preserve wheel configuration inventory
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bundled-configs-application-${{ matrix.arch }}
+          path: |
+            ${{ runner.temp }}/bundled-configs-application/bundled-deps.csv
+            ${{ runner.temp }}/bundled-configs-application/bundled-provenance.json
+            ${{ runner.temp }}/bundled-configs-application/extracted-files.json
+          if-no-files-found: error
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: application-test-wheel-${{ matrix.arch }}

.github/workflows/fast-ci.yml

@@ -75,6 +75,19 @@ jobs:
         run: |
           python scripts/ci/check_copyright.py
           python scripts/ci/check_packaged_legal_files.py
+      - name: Check bundled configuration provenance
+        run: |
+          python -m pytest -c /dev/null tests/test_bundled_configs.py -q \
+            -p no:cacheprovider --override-ini="addopts=" --override-ini="filterwarnings=error" \
+            --override-ini="markers=unit: Unit tests"
+          python scripts/ci/check_bundled_configs.py \
+            --output-dir "${RUNNER_TEMP}/bundled-configs-source"
+      - name: Preserve bundled configuration inventory
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bundled-configs-source
+          path: ${{ runner.temp }}/bundled-configs-source/*
+          if-no-files-found: error
       - name: Check documentation destinations
         run: |
           python -m unittest discover -s scripts/ci -p test_documentation_links.py

.github/workflows/nightly-ci.yml

@@ -410,6 +410,9 @@ jobs:
           sparse-checkout: |
             /scripts/release/apply_dev_version.py
             /scripts/release/build_release_artifacts.py
+            /scripts/ci/check_bundled_configs.py
+            /scripts/ci/bundled_configs.json
+            /scripts/ci/bundled_config_legacy.json
           sparse-checkout-cone-mode: false
           persist-credentials: false
 
@@ -529,6 +532,30 @@ jobs:
           # canonical, so drop this leg's duplicate before upload.
           rm "${DIST_DIR}"/*.crate
 
+      - name: Check exact wheel configuration provenance
+        run: |
+          set -euo pipefail
+          inventory_args=()
+          if [[ ! -f scripts/ci/bundled_configs.json ]]; then
+            # Historical sources may use only the byte-identical subset of
+            # the trusted workflow's catalog. Unknown or changed bytes fail.
+            inventory_args=(--inventory release-tooling/scripts/ci/bundled_configs.json --allow-subset)
+          fi
+          "${TOOLS_DIR}/venv-build/bin/python" release-tooling/scripts/ci/check_bundled_configs.py extract --check \
+            --root . "${inventory_args[@]}" --wheel "${DIST_DIR}"/*.whl \
+            --output-dir "${RUNNER_TEMP}/bundled-configs-nightly"
+      - name: Preserve wheel configuration inventory
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bundled-configs-nightly-${{ matrix.arch }}
+          path: |
+            ${{ runner.temp }}/bundled-configs-nightly/bundled-deps.csv
+            ${{ runner.temp }}/bundled-configs-nightly/bundled-provenance.json
+            ${{ runner.temp }}/bundled-configs-nightly/extracted-files.json
+          if-no-files-found: error
+          retention-days: 30
+          overwrite: true
+
       # The wheel's name is a contract: stamped dev version (catches a
       # silent stamping failure) and cp311-abi3-manylinux_2_28 tags for this
       # arch (catches a build-container regression that would mistag wheels).
@@ -811,6 +838,11 @@ jobs:
         with:
           name: nightly-crate-inventory
           path: ${{ runner.temp }}/license-artifacts
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: bundled-configs-nightly-*
+          merge-multiple: false
+          path: ${{ runner.temp }}/license-artifacts/bundled
       - name: Generate license compliance evidence
         env:
           GH_API_TOKEN: ${{ github.token }}
@@ -830,6 +862,19 @@ jobs:
                                    "version": r["Version"], "spdx_license": r["License"]})
           if not rows:
               raise SystemExit("missing Python dependency inventories")
+          bundled = sorted(glob.glob(f"{outdir}/bundled/**/bundled-deps.csv", recursive=True))
+          expected_bundled = [
+              f"{outdir}/bundled/bundled-configs-nightly-{arch}/bundled-deps.csv"
+              for arch in ("amd64", "arm64")
+          ]
+          if bundled != expected_bundled:
+              raise SystemExit("missing or duplicate architecture-specific bundled configuration inventories")
+          for filename in bundled:
+              with open(filename, newline="") as f:
+                  inventory = list(csv.DictReader(f))
+              if not inventory or any(r["dependency_type"] != "bundled_model_config" for r in inventory):
+                  raise SystemExit("invalid bundled configuration inventory")
+              rows.extend(inventory)
           with open(f"{outdir}/cargo-metadata.json") as f:
               meta = json.load(f)
           workspace = set(meta.get("workspace_members") or [])

CODEOWNERS

@@ -115,6 +115,7 @@
 /tests/test_agentx_curves.py                             @ai-dynamo/aisimulate-infra-codeowners
 /tests/test_agentx_inputs.py                             @ai-dynamo/aisimulate-infra-codeowners
 /tests/test_agentx_accuracy.py                           @ai-dynamo/aisimulate-infra-codeowners
+/tests/test_bundled_configs.py                           @ai-dynamo/aisimulate-infra-codeowners
 /tests/test_ci_qualification.py                          @ai-dynamo/aisimulate-infra-codeowners
 /tests/test_e2e_accuracy_ui.mjs                          @ai-dynamo/aisimulate-infra-codeowners
 /tests/test_source_compliance.py                         @ai-dynamo/aisimulate-infra-codeowners