Support exact manual E2E stack contracts

[ytallo]

Summary

• accept and validate Release Control execution-contract schema v2 while preserving v1 compatibility
• install exact CLI, runtime, target stack and runner pins in the ephemeral workflow, then verify iii.lock
• bind OIDC admission to the canonical execution-contract digest
• add a contract test for an originless manual stack and tampered stack digest

Validation

• python3 -m pytest .github/scripts/tests/ -q (207 passed, 3 subtests passed)
• python3 -m py_compile .github/scripts/harness_e2e_shadow_contract.py
• bash -n harness/tests/e2e/run-shadow-control-ci.sh
• workflow YAML parse and git diff --check

This fixes the production mismatch where Release Control emits schema v2 manual-stack contracts while the published workflow accepted only v1.

Summary by CodeRabbit

• New Features

  • Added support for execution-contract schema version 2, including resolved stack and runtime details.
  • Added contract digest generation, lock verification, and manifest creation.
  • Added command-line options for generating digests and verifying contract locks.
  • Workflow requests now include the execution-contract digest and configured security audience.

• Bug Fixes

  • Added stricter validation for versions, runner pins, stack resolution, provenance, and security settings.
  • Improved end-to-end setup with exact version installation and runtime verification.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview	Aug 20, 2026 1:04pm
workers-tech-spec	Ready	Preview	Aug 20, 2026 1:04pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d35f3aa1-02a0-4b7e-8438-cc261c12f7ea

📥 Commits

Reviewing files that changed from the base of the PR and between e4e9d05 and e53490f.

📒 Files selected for processing (4)

• .github/scripts/harness_e2e_shadow_contract.py
• .github/scripts/tests/test_harness_e2e_shadow_contract.py
• .github/workflows/harness-e2e-shadow.yml
• harness/tests/e2e/run-shadow-control-ci.sh

---

📝 Walkthrough

Walkthrough

The change adds schema v2 execution contracts with canonical digests, resolved stack validation, lock verification, and exact runner pins. The workflow and E2E harness now use schema-aware versions, OIDC audiences, configuration paths, and admission payloads.

Changes

Execution contract v2

Layer / File(s)	Summary
Schema v2 validation and materialization .github/scripts/harness_e2e_shadow_contract.py, .github/scripts/tests/test_harness_e2e_shadow_contract.py	Schema v2 validates resolved stacks, provenance, runtime pins, runner identity, security fields, and target data. Materialization uses resolved stack data and v2 digests. Tests cover manual contracts and tampered resolution digests.
Lock verification and digest commands .github/scripts/harness_e2e_shadow_contract.py	Lock verification compares observed worker versions with contract pins and generates manifests containing canonical contract digests. The digest and verify-lock commands expose these operations.
Workflow contract admission .github/workflows/harness-e2e-shadow.yml	The workflow exports the contract digest and OIDC audience. Admission receives the digest and uses the contract-defined audience.
Schema-aware E2E execution harness/tests/e2e/run-shadow-control-ci.sh	The E2E harness supports schema v2 version fields, exact CLI and runtime pins, iii.config.yaml, post-install repinning, and execution-contract lock verification.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubWorkflow
  participant ExecutionContractTool
  participant AdmissionService
  participant ShadowControlCI
  GitHubWorkflow->>ExecutionContractTool: compute contract digest and OIDC audience
  GitHubWorkflow->>AdmissionService: submit digest and request token with derived audience
  ShadowControlCI->>ExecutionContractTool: verify installed versions against contract
  ExecutionContractTool-->>ShadowControlCI: return lock manifest

Loading

Possibly related PRs

• iii-hq/workers#721: Enforces exact, digest-validated E2E stack and version resolution.
• iii-hq/workers#836: Introduces the execution-contract validator, materializer, workflow, and CI harness extended here.

Poem

A rabbit checks each pinned stack,
With SHA-256 guarding the track.
The runners line up, versions bright,
OIDC guides the flight.
Locks confirm the path is right—
Hop, contract, into the night! 🐇

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/manual-stack-e2e-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

skill-check — worker

0 verified, 62 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.