NRCL-64 Register trusted release candidate validation

[hudsonaikins]

Problem

Neural's release dry-run workflow exists only on the divergent 0.4.1 lineage. GitHub registers manually dispatchable workflows from the default branch, so PR #22's exact-head dry run returns HTTP 404 even though its candidate workflow file supports workflow_dispatch.

Outcome

This PR adds a default-branch-owned, non-publishing release-candidate validation harness that:

• accepts only an immutable 40-character candidate commit SHA;
• requires dispatch from the repository default branch;
• separates candidate-controlled build execution from trusted structural validation;
• validates source contacts, canonical distribution identity, PEP 440 version agreement, wheel and sdist metadata, and strict Twine checks;
• runs wheel and sdist install smokes without dependency substitution;
• promotes 14-day validated artifacts only after both install smokes pass;
• records artifact SHA-256 digests;
• uses a read-only token, no secrets, and no publish or deploy step;
• pins first-party GitHub Actions to immutable commit SHAs;
• supports the repository's declared Python 3.10 floor using the standard tomli compatibility fallback.

Plane: NRCL-64 / NV-003.

Acceptance Criteria

• Workflow is registered by a main-targeting PR.
• Manual input is an immutable full commit SHA.
• Candidate build execution is isolated from trusted validation.
• Contact, name, version, artifact, wheel-install, and sdist-install contracts are deterministic.
• No tag, publication, deployment, DNS, billing, or infrastructure action exists.
• Workflow is merged to main.
• Hosted workflow validates PR NRCL-28 Prepare neural-sdk 0.4.2 contact hotfix #22 head 7aa6c856f5ad18b42375254fe8b52bc50cc868d4.

Validation

Exact base: 3c4621cecb2c6efc83cf91aa6d9cf17f815bb311

Exact candidate: d3f423131ba5e733e6c202186f550f5eb1d9b331

Passed on exact candidate:

• hosted CI: Python 3.10, 3.11, and 3.12;
• hosted documentation check;
• hosted Bandit and dependency-audit advisory checks;
• git diff --check;
• workflow YAML parse;
• Python 3.10 focused release-candidate contract tests: 15 passed;
• Python 3.10 full repository tests: 99 passed, 6 credential-dependent skips, 2 inherited warnings;
• Ruff: passed;
• MyPy: 67 source files passed;
• Black: passed;
• uv lock --check;
• exact PR NRCL-28 Prepare neural-sdk 0.4.2 contact hotfix #22 source scan;
• exact PR NRCL-28 Prepare neural-sdk 0.4.2 contact hotfix #22 wheel and sdist build;
• strict Twine validation;
• canonical artifact name, version, contact, and metadata-path validation;
• wheel and sdist installed-artifact smoke contract;
• adversarial checks for mutable refs, mixed-case blocked domains, invalid artifact identity, unsafe version strings, symlinks, dependency substitution, input interpolation, and premature artifact promotion;
• independent security review converged with no remaining actionable findings.

Residual Risk

GitHub cannot execute this new workflow as a registered workflow_dispatch workflow until it is merged to the default branch. Merge remains separately approval-gated. After merge, dispatch must use --ref main with PR #22's immutable SHA as candidate_sha.

The default branch currently reports separate Dependabot debt. This PR adds only the Python 3.10 development compatibility declaration and does not claim broader dependency remediation.

[github-actions]

📚 Documentation Status

ℹ️ No documentation-related changes detected

---

This comment is automatically generated by the documentation workflow.

[makeplane]

Linked to Plane Work Item(s)

References

• (NRCL-64) [NV-003] Register exact-head release validation on default branch

This comment was auto-generated by Plane

[hudsonaikins]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: d3f423131b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3f423131b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Avoid blocking current candidates on existing docs domains

When candidate_sha points at this branch/main as it stands, this blanket substring block makes validate-source fail before artifact validation because the repo still contains neural-sdk.dev/neural-sdk.com in public files such as pyproject.toml, CONTRIBUTING.md, CODE_OF_CONDUCT.md, and the OpenAPI docs. I verified the new validator exits with those violations, so the registered workflow cannot validate the exact current candidate unless unrelated docs/contact strings are changed or the scan is narrowed to the unsafe contact surfaces intended here.

Useful? React with 👍 / 👎.