Workflow-reading and immutable-storage substrate: object store, exact-revision GitHub reads, Actions reverse reader, linear base64

[briansrls]

Shared, reusable substrate for reading GitHub workflows at exact revisions and storing immutable records. The acquisition scan, corpus and collector that consume this live in the private overlay (companion gunbc-private PR). This PR has no query roster, scan policy, record family, shortlist or collection entry point.

What lands

std.object_store + extdeps.realization.object_store_git

• Shared store observations. StoreFault, StoreObjectRead and StoreObjectPublish move here from std.materialization_object; they never named an artifact.
• New observations and helpers:
  • StoreObjectListing names the snapshot it lists; no materialization lookup can receive it.
  • Immutable-record put: the name comes from family and key, the write is put-if-absent, and a read-back settles Stored / AlreadyPresent / Conflict / OccupiedByEmptyObject / PublishRefused / ReadBackRefused.
  • Line-field percent-encoding, moved here as one authority.
• Git-branch realization on a caller-named remote and branch:
  • opens on a marker read at a synced head;
  • lists via ls-tree at a commit, where a failure is unavailable, never an empty store;
  • publishes by create-new, commit and push, with a bounded retry that re-reads the name;
  • founds the branch with git worktree add --orphan.

std.encoding

• utf8_octets_well_formed (RFC 3629) decides UTF-8 before the host decode, whose refusal stops a run.
• Base64 encode and decode are now indexed rather than recursive or accumulating. The decoder recursed once per character, so a real 75 KB workflow file hit the 100,000-frame call-depth limit. Both were also quadratic: a 140 KB round trip took 855 s of CPU and now takes 4.6 s. RFC 4648 vectors unchanged.

GitHub reads

• extdeps.github.repositories and extdeps.github.branches are new.
• repository_contents gets repository_file_bytes, which handles the endpoint's line-wrapped base64 and refuses a size mismatch, and repository_octets_text.

Actions model and reverse reader (extdeps.github.actions, extdeps.languages.yaml.gha_workflow_read, ingest.dag)

• Job.strategy with static matrices and GitHub's include/exclude semantics, plus RunnerSpec.RunsOnLabel.
• runs-on is evaluated per matrix instance.
• Every unsupported shape is a located, unresolved outcome.
• The YAML ingest handles the syntax real workflows use.

gunbc.ci_workflow_source_read

• A search hint joins to the repository, its default-branch head, and the file read at that exact commit, refusing on any repository-id disagreement.
• Each repository's head is resolved once.
• HitCanonicalized carries the bytes it canonicalized.
• ci_workflow_scan_producer_frontier_rows stays enrolled: no public production caller walks these reads, and a private-overlay consumer does not dissolve it.

Verification (local, by execution, on this head merged with main)

• Hermetic: ci_workflow_source_read 21/21, dissolution_census_mechanism 8/8, object_store 18/18, base64_rfc4648 11/11, gha_workflow_reverse_read 19/19 (real Biome / OpenObserve / PowerDNS bytes), materialization_store 23/23.
• Wet: object_store_git_wet 5/5 (local bare remote, two clones), materialization_store_local_wet 8/8, random_bytes_csprng 4/4 (its hermetic route has no ReadBytes mock).
• Long: long/base64_large_payload 1/1 (4.9 s).
• Mutation checks: byte comparison, repository-id join and exact-head check each turn their claims red.
• Live GitHub: search, repository, branch and contents reads decoded to real values (head and blob matched gh api). That is one live observation, not the capture-and-replay admission rest_success_and_decode_are_separately_true asks for.
• Direct importers of the reader's modules: the 60 failures also fail, by name, on base d7b7ab96c1f.

Not run locally

• test/claim/long/dissolution_census_witness_test (host memory).
• The full transitive consumer closure.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Yb9agVcWYWzjhPsJ42XQAk

[briansrls]

CI state at 3e8ce5c4217 (wet-lane enrolment + current main merged).

Fixed here: the five object_store_git_wet_witness_test identities build a throwaway local repository, which the hermetic envelope refuses, so the floor planned them and they never reached their subject — reported as unenrolled route gaps rather than verdicts. They are now excluded from the discovery corpus and scheduled on the local-repo wet lane at identity grain.

Two gates still refuse:

1. namespace-wave-admission — 55 unadjudicated deltas, largely TargetChanged bindings moving from std.materialization_object to std.object_store. That is this PR's own move, and it needs authored admission rows (roster const in src/v1/stage0/src/namespace_wave_admission.rs), each naming the exact expected head candidate set.
2. floor — refused with subject=fe461f61ee993b00 modules_resolved=2970 modules_excluded=2; I did not isolate the cause.

heal-generated-artifacts and required-witnesses-build pass.

🤖 Generated with Claude Code

[briansrls]

Closing unmerged to wind down the session. Tracked in #11400, which carries the branch and head (session/workload-discovery-prereqs at 3e8ce5c4217), what the substrate delivers, and the two gates that refuse — the 55 wave deltas this branch genuinely owes, and an unisolated floor refusal. The branch is left in place.