Generated workflow YAMLs declare no provenance in their own bytes, so reviewers correctly apply the hand-shell gate to emitted files

[briansrls]

Summary

Project artifact-local provenance into every committed generated GitHub workflow. gunbc.generated_artifact_emit attaches the provenance projection at the single artifact-bytes boundary and refuses a workflow whose projection is absent.

Each banner names its declared generating module and function, says not to hand-edit the artifact, and cites the canonical tools.generated_artifact_gate main_wet module-qualified symbol as the adjudication and regeneration route. The banner is a citation to executable evidence, not proof that the bytes were generated or that the declared generator is correct; the generated-artifact gate remains the evidence.

Recurrence retired

Four REQUEST_CHANGES cycles reached the same false premise when reviewers encountered shell-bearing generated workflow YAML with no provenance in the diff-visible bytes. The reviews were correct on the evidence presented: generated standing existed only in .gitattributes. This change places a generated citation to that standing in the artifact being reviewed, bringing the workflows in line with the existing docs/design-ledgers.md precedent.

Header attachment is construction rather than a post-hoc all-members validation. ArtifactGenerated workflow content is prepended centrally. If the existing commit-policy registry says GithubActionsWorkflow but the provenance projection answers NotApplicable, generation returns typed ArtifactGenerationRefused; non-workflow artifacts remain unchanged. The three workflow carriers no longer duplicate header production.

The required build lane's generated-artifact drift gate is the executing consumer of the prepend. observe_generated_artifact_population reads each committed artifact, obtains its generated bytes through artifact_generate, and observation_findings compares generated_content == committed_content. Removing the central prepend while the committed YAML retains its banner therefore yields GeneratedArtifactContentDiffers; this is a live discriminating RED over the emitted bytes, not a second provenance oracle. It establishes that the prepend executed and agrees with committed bytes, while making no claim that the projected generator identity is correct.

Rung and evidence boundary

This PR establishes presence, not provenance correctness:

• omission of provenance on a workflow artifact is REFUSED by construction at one emission site;
• disagreement between a projected generator and the actual producer is NOT ADDRESSED.

The artifact dispatch and provenance projection remain independently authored mappings over GeneratedArtifact. The current join therefore makes missing provenance fail closed at rung 3, but cannot adjudicate a plausible-yet-wrong generator citation. An agreement witness would require a machine-readable producer oracle that does not exist; copying that expectation into a test would add another authority rather than execute an agreement.

The rung-4 trigger is fusion of workflow provenance with its generating dispatch in the artifact declaration. Then the visible citation is derivable only from the actual producer, making both omission and disagreement unconstructible. That load-bearing model change is out of scope here.

The prior all-members witness regenerated every workflow and duplicated the drift gate's subject while exceeding the required 500 ms per-claim ceiling. It was removed on the construction climb. An unbannered counterfactual workflow cannot currently be expressed as a fixture without altering the closed GeneratedArtifact authority; the missing counterfactual-artifact fixture harness is therefore the RED-evidence ceiling. The currently unreachable production refusal arm is retained deliberately: it is the zero-cost fail-closed behavior that becomes reachable if the enum grows, not a permanently green check cited as coverage.

Test plan

• Built current merged gunbc locally with two jobs and no sccache.
• Ran canonical tools.generated_artifact_gate main_wet twice after the final authority cleanup; both passes succeeded and the second preserved diff digest 44d1ebc4394f7379a251a9ec726eadf5ae9ecb14699835e40b449bd8017adc93 byte-for-byte.
• Confirmed centralizing emission is net-zero relative to the previous PR head: it preserves the same six banner lines while moving their production from three carriers to one bytes boundary. Relative to main, this PR intentionally adds those six generated lines.
• Ran ordinary tools.generated_artifact_gate main; passed with committed bytes matching generated bytes.
• Ran exact cli_run::nfr_tests::nfr_roster_receipt before the centralization; passed. The retained provenance projection remains its enrolled site, and the new central join uses exhaustive arms.
• cargo fmt --all -- --check; passed.
• Verified src/v1/stage0/src/gunbc_rust_source_type_bindings.rs SHA-256 begins f2450c8d076de5b2 after merging main.

The previous-head CI run 33619274554 also completed with build, Rust unit, and fabric-evidence green. Its floor refusal had unexpected_failures=0, changed_witnesses=0, and 15 unrelated budget interruptions; the wording-only final commit starts a fresh run.

[gunbai-bot]

Review 58634 is correct: generated_workflow_provenance and artifact_generate_unadorned are independently authored mappings, so the current join refuses missing provenance but cannot detect a plausible-yet-wrong generator citation. I have narrowed the PR claim to presence, explicitly recorded disagreement as unaddressed, and widened the dissolution trigger to require provenance fused with generating dispatch so both omission and disagreement become unconstructible. I am not adding a copied agreement oracle: no machine-readable producer fact exists today, so that would be specification without execution. The load-bearing fusion is the stated rung-4 follow-up boundary, not a claim made by this rung-3 repair. — sent from eager-bee-66