Seal admitted attempt subjects with validated revisions and public standing

[gunbai-bot]

An attempt can now retain a typed AttemptAdmissionSubject in gunbc.roadmap_dispatch_destination describing what it was admitted against: node identity, existing destination identity, admitted base revision with actor/date, public dependency revision and standing, and historical execution roots. Admission refuses missing inputs, and joining a stored seal against current admission refuses changed fields instead of allowing the attempt to inherit a different claim. The structural identity and stale-field comparison derive from one JSON field projection.

This PR is based on main, independent of #10994. node_dispatch_destination(RoadmapNode) -> DispatchDestination survives that PR's NodeSizing unbundling unchanged. #10994 retains WorkItemDispatch for its dispatchability binding; AttemptAdmissionSubject is a different fact. DispatchSpawnOrigin remains the observation of what happened at spawn.

Both revisions are extdeps.git.object_store.GitObjectId. Merely declaring that type is insufficient: mint and join re-enter parse_git_object_id_wire, which invokes the Git authority's validating SHA-1/SHA-256 constructors and handles their optional refusal. Join also revalidates the stored seal, so raw digest construction cannot grandfather malformed revisions into admission. Identity retains the family-tagged Git representation. It is a structural fingerprint, not a cryptographic authentication claim.

PublicRevisionStanding and public_revision_standing_text relocate unchanged together from gunbc-private 32d7a145. The mechanism follows that head's strategy.plan_item_dispatch finding-2 seal: standing contributes to identity and changes refuse even at a fixed SHA. The private owner deletes its definitions on the coordinated #60 recut; this PR changes no private files.

WorkItemExecutionContract remains the authored source-root authority. Admission consumes its roots directly, with no independent roots parameter. sealed_source_roots is the historical fact the live owner cannot recover after it moves. It must never answer what the current roots are. The join is sealed-versus-current, never current-versus-current. Admission actor/date use the existing acceptance-receipt convention of nonempty attribution text; they do not authenticate an actor or validate a calendar timestamp.

The executing public consumer is test.claim.attempt_admission_subject_witness_test, through claim_batch. The source declares the production frontier as List<FrontierRow> and enrolls it in census_closure_frontier_row_groups for the existing dissolution census. Its triggers: private #60 recuts to this typed durable subject, and the separate public belt follow-up stores/reads the seal and binds worktree creation and publication to its destination/base. Neither production route is claimed to execute in this closure.

Executed validation: required-witnesses-floor, run 34797606465 assigns parse, namespace-wave-admission, and floor to the witnesses lane; the build lane explicitly routes those phases there. The PR head is 11d16f97ac821957fa86afe6eca80c8053815469; CI checked its synthetic merge 6d0c06d8d8 into base 23f600f7097ff9096148c4b7245093088abb81d1. At 02:42:19 UTC every following witness reports standing=planned-and-passed disposition=planned_as_changed_witness outcome=passed:

• each_other_sealed_axis_moves_identity_and_refuses
• missing_current_standing_refuses_the_join
• missing_inputs_refuse_at_the_node_and_field
• moved_standing_refuses_the_join
• raw_digest_paths_refuse_at_mint_and_join
• sha256_admits_without_becoming_sha1
• unchanged_subject_admits
• unobserved_destination_never_defaults_to_gunbc

All four required checks passed. This establishes executed witness coverage of mint, identity, and stale/invalid/missing-input refusal, not an unforgeable-construction claim or private/belt production consumption. The separately proposed standing-omission source mutation did not execute and supplies no evidence. Earlier BuildBuddy attempts were killed before verdicts (the 6 GiB attempt recorded oom_kill=2); the completed CI verdicts above are the runtime evidence.

Review 65837's frontier-enrollment finding was fixed in 11d16f97ac8; review 65853 approves that head with no further requested changes. git diff --check and the pre-push formatting check pass.

[gunbai-bot]

Fixed review 65837 in 11d16f97ac821957fa86afe6eca80c8053815469. The standalone frontier was indeed unread: it is now attempt_admission_subject_frontier_rows: List<FrontierRow>, imported and enrolled in census_closure_frontier_row_groups. That feeds census_closure_frontier_rows() and the existing dissolution census well-formedness/expiry checks. The consumer and dissolution trigger text are preserved.

git diff --check passes. Runtime evidence remains pending the required CI lanes; the PR retains its first-line do-not-land marker. No additional local or BuildBuddy witness run was started.

— sent from fierce-swift-702