[codex] Ship v1.5 conformance and package docs

.github/workflows/ci.yml

@@ -1,12 +1,9 @@
 # Lattice PR-Time CI Workflow
-# Closes CI-01 (install + typecheck + test + test:types + lint:packages) and CI-02 (40-char SHA pinning).
-# Decisions traced to .planning/phases/25-pr-time-ci-workflow/25-CONTEXT.md:
-#   D-01 ubuntu-only, D-02 Node 24 only, D-03 sequential gate order,
-#   D-04 tarball leak audit, D-05 source-import rename audit, D-06 workflow safety audit,
-#   D-07 pnpm-store cache only, D-08 single ci job ubuntu-latest, D-09 PR-only cancel concurrency,
-#   D-10 contents: read root permissions, D-11 hard ban on the pwn-request trigger,
-#   D-12 40-char SHA pinning, D-13 pnpm/action-setup + setup-node order.
-# This workflow has ZERO OIDC capability and ZERO secrets references.
+# The primary job runs deterministic workspace gates on Node 24. Packed
+# consumers run separately on every supported Node line so package exports are
+# exercised exactly as downstream applications load them.
+# Third-party actions are pinned to full commit SHAs. Root permissions are
+# read-only, and this workflow has no OIDC capability or secrets references.
 name: ci
 
 on:
@@ -74,3 +71,32 @@ jobs:
 
       - name: Audit workflows for OIDC and PR-target drift
         run: node scripts/check-workflow-safety.mjs
+
+      - name: Validate production comment hygiene
+        run: pnpm check:comment-hygiene
+
+  packed-consumer:
+    name: packed-consumer-node-${{ matrix.node }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['24', '26']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate packed runtime and CLI consumer
+        run: pnpm check:packed-consumer

.github/workflows/conformance.yml

@@ -0,0 +1,131 @@
+name: conformance
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "spec/**"
+      - "conformance/**"
+      - "clients/python/**"
+      - "packages/lattice/src/receipts/**"
+      - "packages/lattice/src/replay/materialize.ts"
+      - "packages/lattice/src/replay/materialize.test.ts"
+      - "packages/lattice/src/storage/fingerprint.ts"
+      - "packages/lattice/src/index.ts"
+      - "packages/lattice/src/audit.ts"
+      - "packages/lattice/package.json"
+      - "packages/lattice/tsdown.config.ts"
+      - "packages/lattice-cli/**"
+      - "scripts/check-protocol-package-consumer.mjs"
+      - "scripts/lib/packed-packages.mjs"
+      - "scripts/check-package-version-surfaces.mjs"
+      - "scripts/stamp-package-version.mjs"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".github/workflows/conformance.yml"
+  push:
+    branches: [main]
+    paths:
+      - "spec/**"
+      - "conformance/**"
+      - "clients/python/**"
+      - "packages/lattice/src/receipts/**"
+      - "packages/lattice/src/replay/materialize.ts"
+      - "packages/lattice/src/replay/materialize.test.ts"
+      - "packages/lattice/src/storage/fingerprint.ts"
+      - "packages/lattice/src/index.ts"
+      - "packages/lattice/src/audit.ts"
+      - "packages/lattice/package.json"
+      - "packages/lattice/tsdown.config.ts"
+      - "packages/lattice-cli/**"
+      - "scripts/check-protocol-package-consumer.mjs"
+      - "scripts/lib/packed-packages.mjs"
+      - "scripts/check-package-version-surfaces.mjs"
+      - "scripts/stamp-package-version.mjs"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - ".github/workflows/conformance.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  conformance:
+    name: conformance
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: "24"
+          cache: "pnpm"
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.13"
+
+      - name: Install Node dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Python client
+        run: python -m pip install -e "clients/python[test]"
+
+      - name: Verify unchanged nested legacy manifest
+        working-directory: conformance/vectors/legacy
+        run: sha256sum --check MANIFEST.sha256
+
+      - name: Verify aggregate exact manifest coverage
+        run: pnpm --filter @lattice-conformance/verify-ts test:manifest
+
+      - name: Typecheck conformance generator
+        run: pnpm --filter @lattice-conformance/generate typecheck
+
+      - name: Test conformance generator
+        run: pnpm --filter @lattice-conformance/generate test
+
+      - name: Verify generated artifacts without mutation
+        run: pnpm --filter @lattice-conformance/generate check:generated
+
+      - name: Assert generated evidence remains clean
+        run: >-
+          git diff --exit-code --
+          spec/vector0-fixture.json
+          conformance/vectors/legacy/MANIFEST.sha256
+          conformance/vectors/standard
+          conformance/vectors/MANIFEST.sha256
+
+      - name: Typecheck TypeScript conformance harness
+        run: pnpm --filter @lattice-conformance/verify-ts typecheck
+
+      - name: Run TypeScript receipt conformance harness
+        run: pnpm --filter @lattice-conformance/verify-ts test
+
+      - name: Run Python receipt conformance harness without oracle
+        run: >-
+          python -m pytest clients/python/tests -q
+          --ignore=clients/python/tests/test_dsse_oracle.py
+
+      - name: Run exact securesystemslib oracle
+        run: python -m pytest clients/python/tests/test_dsse_oracle.py -q
+
+      - name: Run reciprocal cross-mint parity
+        env:
+          LATTICE_RUN_CROSS_MINT: "1"
+          PYTHON: python
+        run: pnpm --filter @lattice-conformance/verify-ts test:cross-mint
+
+      - name: Run clean packed protocol consumer
+        run: pnpm check:packed-consumer

.github/workflows/provider-canary.yml

@@ -0,0 +1,92 @@
+name: provider-canary
+
+on:
+  schedule:
+    - cron: '30 7 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: provider-canary
+  cancel-in-progress: false
+
+jobs:
+  canary:
+    name: packed provider canary
+    runs-on: ubuntu-latest
+    environment: provider-canary
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run bounded packed canary
+        id: provider-canary
+        continue-on-error: true
+        run: node scripts/run-provider-canary.mjs
+        env:
+          LATTICE_CANARY_OPENAI_MODEL: ${{ vars.PROVIDER_CANARY_OPENAI_MODEL }}
+          LATTICE_CANARY_OPENAI_API_KEY: ${{ secrets.PROVIDER_CANARY_OPENAI_API_KEY }}
+          LATTICE_CANARY_OPENAI_BASE_URL: ${{ vars.PROVIDER_CANARY_OPENAI_BASE_URL }}
+          LATTICE_CANARY_OPENAI_INPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_OPENAI_INPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_OPENAI_OUTPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_OPENAI_OUTPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_OPENAI_MAX_SPEND_USD: ${{ vars.PROVIDER_CANARY_OPENAI_MAX_SPEND_USD }}
+          LATTICE_CANARY_ANTHROPIC_MODEL: ${{ vars.PROVIDER_CANARY_ANTHROPIC_MODEL }}
+          LATTICE_CANARY_ANTHROPIC_API_KEY: ${{ secrets.PROVIDER_CANARY_ANTHROPIC_API_KEY }}
+          LATTICE_CANARY_ANTHROPIC_INPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_ANTHROPIC_INPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_ANTHROPIC_OUTPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_ANTHROPIC_OUTPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_ANTHROPIC_MAX_SPEND_USD: ${{ vars.PROVIDER_CANARY_ANTHROPIC_MAX_SPEND_USD }}
+          LATTICE_CANARY_GEMINI_MODEL: ${{ vars.PROVIDER_CANARY_GEMINI_MODEL }}
+          LATTICE_CANARY_GEMINI_API_KEY: ${{ secrets.PROVIDER_CANARY_GEMINI_API_KEY }}
+          LATTICE_CANARY_GEMINI_INPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_GEMINI_INPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_GEMINI_OUTPUT_PRICE_PER_1K_USD: ${{ vars.PROVIDER_CANARY_GEMINI_OUTPUT_PRICE_PER_1K_USD }}
+          LATTICE_CANARY_GEMINI_MAX_SPEND_USD: ${{ vars.PROVIDER_CANARY_GEMINI_MAX_SPEND_USD }}
+
+      - name: Write sanitized summary
+        if: always()
+        shell: bash
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFile, readFile } from "node:fs/promises";
+          const report = JSON.parse(await readFile("provider-canary-report.json", "utf8"));
+          const lines = [
+            "## Packed provider canary",
+            "",
+            `Package: \`${report.packageVersion}\``,
+            "",
+            "| Family | Status | Code |",
+            "|---|---|---|",
+            ...report.families.map(
+              ({ family, status, code }) => `| ${family} | ${status} | ${code} |`,
+            ),
+            "",
+          ];
+          await appendFile(process.env.GITHUB_STEP_SUMMARY, lines.join("\n"), "utf8");
+          NODE
+
+      - name: Retain sanitized report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: provider-canary-report
+          path: provider-canary-report.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Enforce canary result
+        if: steps.provider-canary.outcome == 'failure'
+        run: exit 1

.github/workflows/registry-drift.yml

@@ -1,32 +1,29 @@
 # Lattice Registry Drift Workflow
-# Phase 33 -- D-19 -- CAPS-04
-#
 # Weekly cron + manual dispatch. Auto-opens a refresh PR when the
 # OpenRouter snapshot diverges from the committed
 # packages/lattice/src/capabilities/registry.generated.ts.
 #
-# PR-time ci.yml does NOT call OpenRouter (per D-19 -- keeps PR loop
-# network-free and fast). Drift is checked weekly on a predictable
+# PR-time ci.yml does NOT call OpenRouter, which keeps the PR loop
+# network-free and fast. Drift is checked weekly on a predictable
 # cadence (Monday 06:00 UTC) or manually via workflow_dispatch.
 #
-# Permissions discipline (Phase 28 inheritance):
+# Permissions discipline:
 #   - Workflow-level: contents: read (default-locked-down)
 #   - Job-level: contents: write + pull-requests: write (minimum needed)
-#   - NO OIDC token-mint scope anywhere (this workflow does not publish;
-#     blast-radius mitigation per Phase 28 SUMMARY)
+#   - NO OIDC token-mint scope anywhere because this workflow does not publish
 #
-# All third-party actions SHA-pinned per CI-02. peter-evans/create-pull-request
-# pinned to v8.1.1 SHA per A4 (Node 24 runner support).
+# All third-party actions are SHA-pinned. peter-evans/create-pull-request is
+# pinned to the v8.1.1 commit for Node 24 runner support.
 #
 # Prerequisite repo setting:
 #   Settings -> Actions -> General -> Workflow permissions ->
 #   "Allow GitHub Actions to create and approve pull requests" (must be enabled)
-# Inherited from Phase 29 (changesets/action Version Packages flow needs the same setting).
+# The changesets Version Packages flow requires the same repository setting.
 name: registry-drift
 
 on:
   schedule:
-    - cron: '0 6 * * 1'  # Monday 06:00 UTC (D-19)
+    - cron: '0 6 * * 1'  # Monday 06:00 UTC
   workflow_dispatch:
 
 permissions:
@@ -61,7 +58,7 @@ jobs:
         run: node scripts/refresh-model-registry.mjs
 
       - name: Open refresh PR
-        # SHA pin per CI-02; v8.1.1 per A4 (Node 24 runner support).
+        # Pinned to the v8.1.1 commit for Node 24 runner support.
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,7 +1,5 @@
 # Lattice Release Workflow
-# Phase 28: REL-01..REL-06, PUB-01
-#
-# Two-job pattern (Phase 28 SC-1):
+# Two-job pattern:
 #   version-pr: opens/updates the changesets release PR; needs contents:write
 #               and pull-requests:write but NO id-token. Triggered by pushes
 #               to main.
@@ -11,13 +9,13 @@
 #               Runs in environment npm-publish so the required reviewer
 #               (LakshmanTurlapati) approves each release.
 #
-# OIDC trust tuple registered on npmjs.com in Phase 27:
+# OIDC trust tuple registered on npmjs.com:
 #   (repository: fullselfbrowsing/Lattice,
 #    workflow_filename: release.yml,
 #    environment: npm-publish)
 # Both packages have this tuple, so pnpm publish exchanges the GitHub OIDC
 # token for an npm short-lived publish credential with no static npm secret.
-# All third-party actions SHA-pinned per CI-02 / Phase 25 D-12.
+# All third-party actions are pinned to full commit SHAs.
 name: release
 
 on:
@@ -119,11 +117,14 @@ jobs:
       - name: Audit core package boundary
         run: node scripts/check-core-package-boundary.mjs
 
+      - name: Validate packed runtime and CLI consumer
+        run: pnpm check:packed-consumer
+
       - name: Publish to npm with provenance
         # pnpm publish picks up the OIDC token from
         # ACTIONS_ID_TOKEN_REQUEST_URL + ACTIONS_ID_TOKEN_REQUEST_TOKEN that
         # the runner injects when id-token:write is set, exchanges it with
-        # npm using the trust tuple registered in Phase 27, and signs the
+        # npm using the registered trust tuple and signs the
         # tarball with Sigstore for provenance.
         run: pnpm -r publish --access public --provenance --no-git-checks
 

.gitignore

@@ -2,3 +2,8 @@ node_modules/
 dist/
 coverage/
 examples/work-inbox/.lattice/
+
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/