ci: pin TEPP foundation and documentation callers to central self-hosted suppliers

.coveragerc

@@ -3,6 +3,7 @@ branch = True
 relative_files = True
 source =
     scripts.check_workspace_contract
+    scripts.effective_ci_source
     scripts.check_docstrings
     scripts.check_coverage
     scripts.prepare_agent_pr_message

.gitattributes

@@ -0,0 +1,3 @@
+# This raw signed Git object is immutable binary evidence, not editable text.
+# Its exact bytes (including signature whitespace) are authenticated by Git OID.
+tests/fixtures/central-ci/9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de/commit.object binary

.github/workflows/ci.yml

@@ -38,229 +38,9 @@ concurrency:
   group: tepp-rust-foundation-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-env:
-  CARGO_TERM_COLOR: always
-  RUSTFLAGS: -Dwarnings
-  RUSTDOCFLAGS: -Dwarnings
-  CARGO_NEXTEST_VERSION: "0.9.140"
-  CARGO_DENY_VERSION: "0.19.7"
-  CARGO_LLVM_COV_VERSION: "0.8.6"
-
 jobs:
-  repository-contracts:
-    name: Repository contracts and Python branch coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout exact head
-        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
-        with:
-          persist-credentials: false
-      - name: Install pinned Python quality dependency
-        run: python3 -m pip install --disable-pip-version-check --no-deps --require-hashes -r requirements-quality.txt
-      - name: Exercise repository tooling with branch coverage
-        run: python3 -m coverage run --branch -m unittest discover -s tests/quality -p 'test_*.py'
-      - name: Enforce repository tooling coverage
-        run: python3 -m coverage report --fail-under=100 --show-missing
-      - name: Validate workspace contract
-        run: python3 scripts/check_workspace_contract.py
-      - name: Validate Rust documentation contract
-        run: python3 scripts/check_docstrings.py
-      - name: Generate and validate release SBOM/provenance evidence
-        run: |
-          python3 scripts/release_evidence.py generate \
-            --repository-root . \
-            --output-directory "${RUNNER_TEMP}/tepp-release-evidence" \
-            --git-commit "${GITHUB_SHA}"
-          python3 scripts/release_evidence.py validate \
-            --evidence-directory "${RUNNER_TEMP}/tepp-release-evidence" \
-            --repository-root . \
-            --expected-git-commit "${GITHUB_SHA}"
-
-  rust-quality:
-    name: Format, lint, test, rustdoc, and dependency policy
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout exact head
-        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
-        with:
-          persist-credentials: false
-      - name: Install pinned Rust toolchain
-        run: rustup toolchain install 1.98.0 --profile minimal --component clippy --component rustfmt
-      - name: Restore pinned Rust quality tools
-        id: rust-tools-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.cargo/bin/cargo-nextest
-            ~/.cargo/bin/cargo-deny
-          key: ${{ runner.os }}-${{ runner.arch }}-tepp-rust-tools-nextest-${{ env.CARGO_NEXTEST_VERSION }}-deny-${{ env.CARGO_DENY_VERSION }}
-      - name: Install pinned Rust quality tools
-        if: steps.rust-tools-cache.outputs.cache-hit != 'true'
-        run: |
-          cargo install cargo-nextest --locked --version "$CARGO_NEXTEST_VERSION"
-          cargo install cargo-deny --locked --version "$CARGO_DENY_VERSION"
-      - name: Verify pinned Rust quality tool versions
-        run: |
-          cargo nextest --version | grep -F "$CARGO_NEXTEST_VERSION"
-          cargo deny --version | grep -F "$CARGO_DENY_VERSION"
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      - name: Run Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-      - name: Run test suite without retries
-        run: cargo nextest run --workspace --all-features
-      - name: Run doctests separately
-        run: cargo test --doc --workspace --all-features
-      - name: Build warning-free documentation
-        run: cargo doc --workspace --all-features --no-deps
-      - name: Enforce dependency, license, advisory, and source policy
-        run: cargo deny check
-
-  production-coverage:
-    name: Production line and branch coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - name: Checkout exact head
-        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
-        with:
-          persist-credentials: false
-      - name: Install pinned Rust toolchain with LLVM tools
-        run: rustup toolchain install 1.98.0 --profile minimal --component llvm-tools-preview
-      - name: Install pinned nightly with LLVM tools
-        run: rustup toolchain install nightly-2026-08-21 --profile minimal --component llvm-tools-preview
-      - name: Restore pinned cargo-llvm-cov
-        id: llvm-cov-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.cargo/bin/cargo-llvm-cov
-          key: ${{ runner.os }}-${{ runner.arch }}-tepp-cargo-llvm-cov-${{ env.CARGO_LLVM_COV_VERSION }}
-      - name: Install cargo-llvm-cov
-        if: steps.llvm-cov-cache.outputs.cache-hit != 'true'
-        run: cargo install cargo-llvm-cov --locked --version "$CARGO_LLVM_COV_VERSION"
-      - name: Verify pinned cargo-llvm-cov version
-        run: cargo llvm-cov --version | grep -F "$CARGO_LLVM_COV_VERSION"
-      - name: Generate exact line coverage with region diagnostics
-        id: line-report
-        # mlx_native_receipt is excluded exactly like sqlx_live.rs: it is a
-        # macOS/MLX-only device receipt probe whose success path cannot
-        # execute on the Linux coverage runner (see ADR 0025). Its macOS
-        # behaviour is covered by the crate's cfg(macos) tests.
-        run: cargo llvm-cov --workspace --all-features --json --output-path coverage.json --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
-      - name: Export exact authored line coverage
-        run: cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
-      - name: Enforce complete authored line coverage
-        run: python3 scripts/check_coverage.py coverage.lcov --kind lines --format lcov
-      - name: Show exact missing line diagnostics
-        if: ${{ failure() && steps.line-report.outcome == 'success' }}
-        run: |
-          LLVM_COV_FLAGS="--show-line-counts-or-regions" cargo llvm-cov report --text --show-missing-lines --show-instantiations
-          test -f coverage.lcov || cargo llvm-cov report --lcov --output-path coverage.lcov --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
-          python3 - <<'PY'
-          import json
-          from pathlib import Path
-
-          report = json.loads(Path("coverage.json").read_text(encoding="utf-8"))
-          for data in report.get("data", []):
-              for file_record in data.get("files", []):
-                  filename = file_record.get("filename", "<unknown>")
-                  lines = file_record.get("summary", {}).get("lines", {})
-                  covered = int(lines.get("covered", 0))
-                  count = int(lines.get("count", 0))
-                  if covered < count:
-                      print(f"INCOMPLETE_FILE {filename} {covered}/{count}")
-                  for segment in file_record.get("segments", []):
-                      if len(segment) < 6:
-                          continue
-                      line_number, column_number, execution_count = segment[:3]
-                      has_count, is_region_entry, is_gap_region = segment[3:6]
-                      if (
-                          has_count
-                          and is_region_entry
-                          and not is_gap_region
-                          and int(execution_count) == 0
-                      ):
-                          print(
-                              "UNCOVERED_REGION "
-                              f"{filename}:{line_number}:{column_number}"
-                          )
-              for function_record in data.get("functions", []):
-                  if int(function_record.get("count", 0)) != 0:
-                      continue
-                  filenames = function_record.get("filenames", [])
-                  filename = filenames[0] if filenames else "<unknown>"
-                  print(
-                      "UNCOVERED_FUNCTION "
-                      f"{filename} {function_record.get('name', '<unknown>')}"
-                  )
-
-          current_source = None
-          for raw_line in Path("coverage.lcov").read_text(encoding="utf-8").splitlines():
-              if raw_line.startswith("SF:"):
-                  current_source = raw_line[3:]
-              elif raw_line.startswith("DA:") and current_source is not None:
-                  line_number, count, *_ = raw_line[3:].split(",")
-                  if int(count) == 0:
-                      print(f"UNCOVERED_LINE {current_source}:{line_number}")
-          PY
-      - name: Upload exact line coverage diagnostics
-        if: ${{ failure() && steps.line-report.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: line-coverage-diagnostics
-          path: |
-            coverage.json
-            coverage.lcov
-          if-no-files-found: error
-          retention-days: 1
-      - name: Generate exact branch coverage
-        id: branch-report
-        if: ${{ !cancelled() }}
-        run: cargo +nightly-2026-08-21 llvm-cov --branch --workspace --all-features --json --output-path coverage-branches.json --ignore-filename-regex 'sqlx_live\.rs|mlx_native_receipt'
-      - name: Enforce complete branch coverage
-        if: ${{ !cancelled() && steps.branch-report.outcome == 'success' }}
-        run: python3 scripts/check_coverage.py coverage-branches.json --kind branches
-      - name: Show exact missing branch diagnostics
-        if: ${{ failure() && steps.branch-report.outcome == 'success' }}
-        run: cargo +nightly-2026-08-21 llvm-cov report --branch --text --show-missing-lines
-      - name: Upload exact branch coverage diagnostics
-        if: ${{ failure() && steps.branch-report.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: branch-coverage-diagnostics
-          path: coverage-branches.json
-          if-no-files-found: error
-          retention-days: 1
-
-  live-postgres:
-    name: Live PostgreSQL integration
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    services:
-      postgres:
-        image: postgres:16.9-alpine
-        env:
-          POSTGRES_USER: tepp
-          POSTGRES_PASSWORD: tepp_ci
-          POSTGRES_DB: tepp
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U tepp -d tepp"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-    env:
-      TEPP_LIVE_POSTGRES: "1"
-      DATABASE_URL: postgres://tepp:tepp_ci@localhost:5432/tepp
-    steps:
-      - name: Checkout exact head
-        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
-        with:
-          persist-credentials: false
-      - name: Install pinned Rust toolchain
-        run: rustup toolchain install 1.98.0 --profile minimal
-      - name: Run live-sqlx PostgreSQL integration
-        run: cargo test -p persistence_postgres --features live-sqlx --test live_postgres -- --nocapture
+  foundation:
+    name: TEPP Rust Foundation supplier
+    uses: ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml@9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de
+    permissions:
+      contents: read

.github/workflows/docs-quality.yml

@@ -32,16 +32,8 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  validate:
-    name: Validate planning and governance contracts
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout exact head
-        uses: actions/checkout@631c942040754b6e095e929c1677c07e10ed4f87
-        with:
-          persist-credentials: false
-      - name: Validate documentation
-        run: python3 scripts/validate_documentation.py
-      - name: Reject whitespace errors
-        run: git diff --check HEAD^ HEAD || git diff --check
+  documentation:
+    name: TEPP Documentation supplier
+    uses: ContextualWisdomLab/.github/.github/workflows/tepp-documentation-quality.yml@9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de
+    permissions:
+      contents: read

CHANGELOG.md

@@ -38,6 +38,16 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ## [Unreleased]
 
+### Fixed
+
+- Resolve the effective Rust CI contract from the reviewed immutable central
+  supplier offline. Authenticate retained commit/tree/blob evidence and the
+  caller/workflow SHA-256 digests; preserve coverage diagnostics, pinned tools,
+  live PostgreSQL, and shared isolated-runner checks without duplicating jobs.
+  Include resolver corruption and gate-weakening controls in the unchanged
+  100% Python statement/branch coverage gate. The separate inherited hourly
+  schedule contract is not waived.
+
 - Removed the repository-local hourly PR-maintenance caller now covered by the central required scheduler, retired stale workflow registrations, narrowed documentation triggers, keyed PR concurrency by fixed workflow name, repository, and pull-request number without cancelling non-PR runs, and combined line/branch coverage on one sequential runner while preserving both 100% gates and diagnostics.
 
 - `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability.

README.md

@@ -127,6 +127,32 @@ an unstable compiler capability. A zero denominator is reported explicitly for
 any crate whose lane still ships no executable behavior; it must never conceal
 uncovered production behavior.
 
+## Centralized CI contract source
+
+`.github/workflows/ci.yml` dispatches the reviewed central workflow
+`ContextualWisdomLab/.github/.github/workflows/tepp-rust-foundation-ci.yml`
+at `9dab3c2a607ddef69b5ff8cb0f761e90f6bc28de`. Executable jobs remain owned by
+that supplier; frozen files under `tests/fixtures/central-ci/` are evidence only,
+not workflows installed in `.github/workflows/`.
+
+`scripts/effective_ci_source.py` resolves the caller and supplier offline for the
+workspace, coverage diagnostics, and shared-runner contract checks. It verifies
+the exact reviewed caller SHA-256, the original Git commit object and each tree
+on the supplier path, the workflow blob identity, and its independent SHA-256.
+Missing evidence, changed pins, disabled dispatch, extra caller jobs, or modified
+supplier bytes fail closed. It needs neither Git metadata nor network access.
+The original coverage, reproducible toolchain, PostgreSQL service/test, and
+runner-isolation contracts remain enforced; tooling coverage includes the
+resolver at the unchanged 100% statement/branch threshold.
+
+To update the supplier, review the new immutable central commit and executable
+body, export its original commit/tree/blob objects, and update the reviewed pin
+and digest constants together with positive and negative contract controls.
+Never hand-author supplier fixtures, substitute a moving branch, or resolve from
+live CI during static tests. These local source checks do not prove hosted jobs
+ran successfully. The inherited hourly schedule contract is separate and is not
+waived by this resolver.
+
 ## Normative documents
 
 - `AGENTS.md`

scripts/check_workspace_contract.py

@@ -12,6 +12,11 @@
 from pathlib import Path
 from typing import Any, Iterable, Mapping, Sequence
 
+if __package__:
+    from .effective_ci_source import effective_ci_source
+else:  # pragma: no cover - direct CLI entry point
+    from effective_ci_source import effective_ci_source
+
 EXPECTED_CRATES: tuple[str, ...] = (
     "evidence_core",
     "semantic_core",
@@ -234,6 +239,10 @@ def _validate_ci_contract(root: Path) -> list[str]:
         return [".github/workflows/ci.yml is missing"]
 
     ci_text = ci_path.read_text(encoding="utf-8")
+    try:
+        ci_text = effective_ci_source(root)
+    except (OSError, ValueError) as error:
+        errors.append(f"CI supplier source validation failed: {error}")
     for snippet in REQUIRED_CI_SNIPPETS:
         if snippet not in ci_text:
             errors.append(f"CI workflow is missing required command: {snippet}")