ci: restore GF-only exact-head authority (TIN-2538)

[Jesssullivan]

Superseded landing lane

Closed without merge on 2026-07-25. The reviewed correction patch f2c9ec67f59017097ae0ecbccd8447fff72c80b68db14a6354e19efe7f414601 is now carried by signed #565 head 0a3a9ceceeab497af614e07e80e91780c7f3be47, then composed additively into #567 c6df099f982fac796f95d5caba2f331ddeee086c and #568 ea4db806354a897746dcf531589aa43d9a2712db. Keep this branch as provenance; do not land it separately.

Summary

Restore TCFS first-party CI to exact-head, GloriousFlywheel-only source authority with immutable public-read Attic binding. This remains a draft routing/HOLD lane; it is not durable runner proof or merge authority yet.

Linear: TIN-2538

Changes

• pin the three protected proof workflows to GF merge 693574567f9b879486782f1fb7f432c54a2fe294 and literal shared tinyland-* capability classes
• fail closed on undeclared workflows, hosted runners, bare self-hosted, mutable actions, cache bypasses, stale checkout identity, and legacy hosted/manual workflow source
• make CI and Nix CI instantiate for every pull-request base, including stacked TCFS branches
• add a source-owned exact trigger contract that rejects PR narrowing (branches, types, paths, and ignore variants) and authority expansion (pull_request_target, schedule) even when the topology digest is recomputed
• keep unavailable native Darwin authority explicitly fail-loud under TIN-2998; keep Windows proof source-only and fleet listener proof queue-bound

Exact source state

• Signed, GitHub-verified head: 14979dc4ea1334d529ec4d61fb6be54cecdfab87
• Tree: f4f6355984d04e65b58f3e105d381f8dbfd0fb83
• Reviewed corrective diff SHA-256: f2c9ec67f59017097ae0ecbccd8447fff72c80b68db14a6354e19efe7f414601
• Base: current main 179a3349d67c5f63624ad1d3e99750febeba1d0e

Test plan

• Registered CI authority contract: 12/12
• Recomputed-digest adversarial replay rejects all 36 PR-narrowing probes and all 6 trigger-expansion probes
• Current parsed triggers equal the source-owned contracts; all protected topology digests match
• Actionlint, Ruff check/format, Python compile, strict JSON parse, and git diff --check
• Independent exact-diff rereview: no residual P0/P1
• Both Darwin hold bodies remain byte-identical and terminate fail-closed
• Exact-head sanctioned-pool jobs receive runner assignments and complete

Checklist

• No hosted runner or hosted fallback added
• No credentials, deployment, runtime, plan/apply, or TCFS ceremony entered
• Legacy source retirement is guarded by the contract
• Permanent retirement of the 12 historical workflow IDs is separately attended and proven

Hold

Do not merge this draft yet.

• The six protected executable jobs are queued on tinyland-nix / tinyland-dind with no hosted fallback.
• The two native-Darwin hold jobs intentionally end nonzero, so this PR is not currently capable of an all-green terminal state; TIN-2998 or a separately reviewed hold-policy change must resolve that.
• TIN-3120 must land registry/verifier source and a separately authorized exact 3-create/0-change/0-destroy plan before personal-repo runner enrollment.
• All 12 historical legacy workflow IDs remain live until a separately authorized all-ref confinement and permanent ID-retirement ceremony proves historical dispatch/replay denial.

[Jesssullivan]

Exact-head Nix source-realization fix: 6bb1445fe77f73e98cd0cc03e2d257d2ad77f8f5 (signed, pushed).

Fresh Determinate Nix 2.33 evaluation exposed that cleanSourceWith { src = craneLib.path ./.; } nested two builtins.path calls around a lazy flake tree, leaving the inner /nix/store/...-source unrealized. Passing ./. directly preserves the same Cargo/proto filter while removing that invalid lifetime boundary.

Exact-head evidence: native flake evaluation with eval cache disabled passes; CI-authority contract 11/11, diff check, and redacted gitleaks scan pass. The sanctioned GF/held jobs were re-requested and are queued with no assigned runner. PR remains draft; no durable-green or merge-ready claim.

[Jesssullivan]

Closing as fully superseded by draft PR #565 at exact head 0b7b789b121cbbadcc6c970fc6cfa8230ac0cc83.

All 20 files changed by this PR have identical blob SHAs at #565's current head, including the GF-only CI authority correction and flake source-realization fix. This PR's six sanctioned jobs received no runner assignment and auto-cancelled after 24 hours; rerunning before the personal-owner ARC listener promotion would add no evidence.

No merge is performed and the branch remains available for audit. Durable proof continues only on #565 through tinyland-nix / tinyland-dind; hosted or GitHub-capacity fallback remains forbidden.

[Jesssullivan]

Closed without merge as a superseded landing lane. The exact reviewed correction is now signed on #565 at 0a3a9ce and composed additively through #567 c6df099 and #568 ea4db80. All three protected workflow families now instantiate on the stacked heads. Durable jobs remain pre-assignment/queue-bound pending TIN-3120 repo registration; no hosted fallback, runtime, plan/apply, or control-plane claim is made. The branch is retained for provenance.