Enforce an executable release freeze barrier

[TheGreenCedar]

Closes #1621

Context

Broad release proof could start before all source work was integrated, later source changes did not immediately cancel obsolete work, and “independently accepted exact head” had no executable definition.

PR #1597 owns calibration, the generated constant-set freeze, and qualification for 0.16.3. This PR is a nonblocking follow-up that owns executable freeze receipts, hostile/native acceptance, cancellation, and proof-trigger policy.

Because this branch contains #1597 head c72c87a963b81c626530958078b9f54f8f47efc5 plus later workflow/source changes, merging it before release would revoke that frozen candidate. It must stay out of the 0.16.3 lineage and may land after release.

What changed

• defines the candidate freeze sequence and release-handoff fields in AGENTS.md;
• gives calibration-source and frozen-candidate acceptance separate exact-head receipts;
• binds receipts to the live release PR and integration base, merged support PR ancestry, commit, tree, run attempt, evidence state, and planned next action;
• runs hostile mutations and a protected sub-90-second Windows native probe before acceptance;
• revokes acceptance and cancels obsolete proof when the frozen PR or integration head moves;
• removes support-PR proof labels and direct hardware-workflow dispatches;
• keeps calibration before the sole broad source proof on the generated-constant frozen candidate;
• authenticates the complete parsed bodies of the four acceptance jobs against .github/scripts/release-freeze-acceptance-jobs.json;
• pins that manifest by SHA-256 in release-claims.json.

The complete-job manifest replaces the rejected command substring scanner. Any command, shell, environment, condition, permission-relevant field, dependency, output, step, or step-order change changes the authenticated job digest.

Exact support head

• Commit: d94e8e6c55a970aab72bf31aee76e6be3df72a73
• Tree: 0a8740bef070ff290580afbff9836e6ae246cd1b
• Worktree: clean and pushed
• Contains Make embedding calibration GPU-only and measure true idle correctly #1597 head: c72c87a963b81c626530958078b9f54f8f47efc5

Both the current #1597 merge tree and the explicit integration-base merge tree are conflict-free.

Adversarial revisions

The first review rejected d79c298e because arbitrary Ubuntu and Windows acceptance jobs could run broad tests, the receipt ordered source proof before calibration, and the branch conflicted with #1597.

The second review rejected 4e63f63d because approved step bodies could still hide broad work through variables, aliases, functions, delegated scripts, command chaining, and alternate shells.

This revision authenticates the entire parsed job bodies. Executed regressions cover:

• Ubuntu and Windows variable expansion;
• aliases and shell functions;
• delegated script invocation;
• chained commands;
• alternate shells;
• manifest substitution, extra manifest jobs, and claim-graph digest substitution.

In a disposable clone of this exact pushed head, actionlint accepted syntactically valid Ubuntu and Windows variable mutations while workflow policy exited 1 and named both changed canonical jobs.

Focused verification

• workflow policy mutation suite: 1,272/1,272;
• freeze barrier, Windows artifact selector, candidate archive store, and actionlint suites: 129/129;
• release claim and closeout suites: 78/78;
• calibration-lineage self-test: passed under Python 3.12;
• static workflow policy, release claim graph, actionlint, git diff --check, and both merge-tree checks: passed.

No broad source, package, calibration, qualification, hardware, or release workflow was dispatched from this PR.

Release handoff

• Final intended 0.16.3 source head: c72c87a963b81c626530958078b9f54f8f47efc5, owned by Make embedding calibration GPU-only and measure true idle correctly #1597; this support head is not part of it.
• Known future source changes: this PR is explicitly post-release; close each flow requirement with its own cited evidence #1581 remains a separate parallel lane.
• Proof-triggering labels or actions from this PR: none.
• Reusable evidence: focused checks and exact-head hostile mutations listed above.
• Invalidated evidence: every acceptance receipt tied to a predecessor of this support head.
• Currently running release workflow observed before this update: platform and integration proof 30564679306 on c72c87a963b81c626530958078b9f54f8f47efc5. No Auto Release run is in flight.
• Next permitted mutation in this lane: independent verifier findings only.

The PR remains draft and unmerged. It does not block 0.16.3, and its focused PR checks are not release evidence.

Risk

The manifest intentionally makes acceptance-job changes explicit and reviewable. Updating one of those jobs requires updating the manifest, its claim-graph digest, policy tests, and exact-head hostile evidence together.

[TheGreenCedar]

Independent verifier repair — workflow execution context authenticated

Head: 1a7c8a4af7816da13f886799fe7589ae52d6bbd1
Tree: 060db18ca3568bd63674cd8d9d8c6b231d93659f
Rejected head: d94e8e6c55a970aab72bf31aee76e6be3df72a73

The rejected manifest authenticated the four jobs.* bodies but omitted the workflow-level context inherited by those jobs. That left actionlint-clean execution channels outside the digest.

The v2 manifest now authenticates the canonical parsed source-proof.yml top level with jobs removed; each acceptance job remains separately authenticated. This covers the existing and future workflow-level fields as one closed seam: environment, run defaults, triggers and inputs, permissions, concurrency, display identity, and any newly introduced top-level key. The manifest remains SHA-256-bound from release-claims.json, and the resulting claim-graph digest was propagated through its deterministic fixtures.

Executed hostile mutations

Each mutation was applied to the real workflow, accepted by actionlint, rejected by workflow policy with source-proof.yml workflow execution context must match the canonical acceptance manifest, and then removed:

• top-level env.BASH_ENV loading a repository script;
• top-level env.NODE_OPTIONS --require loading a repository script;
• top-level defaults.run.shell: bash scripts/run-broad-source.sh {0}.

The persistent generated matrix also mutates workflow triggers, token permissions, concurrency, name, a new run-name field, and the manifest's own workflow-context digest. All are rejected through the same context boundary.

Exact-head focused verification

• workflow policy suite: 1,281/1,281;
• release-claim suite: 39/39;
• release claim graph validation: passed, digest 9df8f932d66a60baa104bf61252ab318b0c1325740a0edf193463618e0946348;
• static workflow policy: passed;
• actionlint wrapper and its 3 contract tests: passed;
• git diff --check: passed.

No broad source proof, calibration, package proof, hardware proof, merge, or release action was started. The PR remains draft and remains a parallel nonblocking lane for 0.16.3.

[TheGreenCedar]

Exact-head fixture repair pushed: 47e41374eeb286d38da38794068ec505031d2f3b (tree 6a80c69cda2dc19e9d726e4011a3da269817bd06).

The canonical evidence evaluator regenerated benchmarks/release-evidence/fixtures/report.json from the checked-in candidate. Its output differed in exactly one derived field: candidate_sha256, updated from 81625f51cac5313bf23184f3853940a83149e1bbbb99e4a5823d046dc0d362e8 to the candidate's actual SHA-256, 5302ac5856891447183a0c0e7c7df09cfc5ad425efb1b834b2b439364870f438. No other dependent hash was stale.

Focused verification on this repair:

• release evidence gate: 20/20
• release claim graph: 39/39; digest 9df8f932d66a60baa104bf61252ab318b0c1325740a0edf193463618e0946348
• workflow policy: 1281/1281 plus static validation
• actionlint: passed
• git diff --check: passed

No broad source proof, calibration, package proof, hardware proof, merge, or release was dispatched.

[TheGreenCedar]

Independent exact-head acceptance completed at 47e41374eeb286d38da38794068ec505031d2f3b (tree 6a80c69cda2dc19e9d726e4011a3da269817bd06).

• Branch matches origin and the worktree/index are clean.
• The workflow-context boundary rejected 27 valid semantic mutations, including BASH_ENV, NODE_OPTIONS, delegated shell wrappers, trigger/permission/concurrency changes, and acceptance-job scheduling/body changes.
• Three YAML mapping-order controls remained accepted.
• Three incomplete workflow/manifest/claim coordination paths failed closed.
• Evidence gate: 20/20.
• Workflow policy: 1407/1407.
• Claims and closeout: 78/78; claim graph validated.
• Actionlint and diff checks passed.

No broad source proof, calibration, package proof, or hardware proof was dispatched for this support PR.