Qualify 2.2 observation, durable no-op audit and immutable publication gates

.github/workflows/managed-moc-audit-2.2.yml

@@ -0,0 +1,47 @@
+name: Managed MOC 2.2 native audit qualification
+on:
+  push:
+    branches: [main, 'release/**']
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  native-no-change:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-latest]
+        node: [22, 24]
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: core.autocrlf
+      GIT_CONFIG_VALUE_0: 'false'
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - name: Native process-exit and filesystem audit qualification
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/moc-audit-evidence"
+          node -e 'const fs=require("node:fs"); console.log(JSON.stringify({source_commit:process.env.GITHUB_SHA,node:process.version,platform:process.platform,arch:process.arch,filesystem_type:fs.statfsSync(".").type,host_type:"github_hosted",physical_power_loss_qualified:false}))' > "$RUNNER_TEMP/moc-audit-evidence/environment.json"
+          node --test --test-reporter=tap test/managed-moc-no-change.test.mjs test/navigation-effects-host.test.mjs test/navigation-effects-node.test.mjs > "$RUNNER_TEMP/moc-audit-evidence/tests.tap" 2>&1
+          git diff --exit-code
+          test -z "$(git status --porcelain)"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: moc-audit-${{ matrix.os }}-node-${{ matrix.node }}-${{ github.sha }}
+          path: ${{ runner.temp }}/moc-audit-evidence/
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/npm-release-2.2.yml

@@ -0,0 +1,109 @@
+name: Immutable Engine 2.2 npm release
+on:
+  push:
+    tags: [v2.2.0]
+permissions:
+  contents: read
+  actions: read
+  id-token: write
+concurrency:
+  group: gkos-engine-2.2.0-publication
+  cancel-in-progress: false
+jobs:
+  publish:
+    if: github.repository == 'Odenknight/GKOS-Engine'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    environment: gkos-engine-release
+    env:
+      GKOS_220_APPROVAL_JSON: ${{ vars.GKOS_220_APPROVAL_JSON }}
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: core.autocrlf
+      GIT_CONFIG_VALUE_0: 'false'
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          ref: refs/tags/v2.2.0
+          fetch-depth: 0
+          path: candidate
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          repository: Odenknight/gkos-standard
+          ref: ad10dfe94a024f464430fd243c5a918d03389041
+          path: gkos-standard
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: candidate/package-lock.json
+      - name: Exact approved source and signed annotated tag
+        working-directory: candidate
+        env:
+          ALLOWED_SIGNERS: ${{ vars.GKOS_RELEASE_ALLOWED_SIGNERS }}
+        run: |
+          set -euo pipefail
+          mkdir -m 700 "$RUNNER_TEMP/release-evidence"
+          printf '%s\n' "$ALLOWED_SIGNERS" > "$RUNNER_TEMP/release-evidence/allowed-signers"
+          git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile="$RUNNER_TEMP/release-evidence/allowed-signers" verify-tag v2.2.0
+          node scripts/release-220-preflight.mjs > "$RUNNER_TEMP/release-evidence/preflight.json"
+      - name: Install current trusted-publishing CLI
+        run: npm install --global npm@12.0.2 --registry=https://registry.npmjs.org
+      - name: Retrieve the exact approved qualification bundle
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          artifact_id="$(node -e 'console.log(JSON.parse(process.env.GKOS_220_APPROVAL_JSON).evidenceArtifactId)')"
+          gh api "repos/Odenknight/GKOS-Engine/actions/artifacts/$artifact_id" > "$RUNNER_TEMP/release-evidence/qualified-artifact-metadata.json"
+          node -e 'const fs=require("node:fs"),assert=require("node:assert/strict"),r=JSON.parse(process.env.GKOS_220_APPROVAL_JSON),m=JSON.parse(fs.readFileSync(process.env.RUNNER_TEMP+"/release-evidence/qualified-artifact-metadata.json"));assert.equal(m.expired,false);assert.equal(m.workflow_run.head_sha,r.sourceCommit);'
+          gh api "repos/Odenknight/GKOS-Engine/actions/artifacts/$artifact_id/zip" > "$RUNNER_TEMP/release-evidence/qualified-evidence.zip"
+      - name: Refuse existing version and verify registry maintainer
+        working-directory: candidate
+        run: |
+          set -euo pipefail
+          npm view gkos-engine versions --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/release-evidence/versions.json"
+          npm view gkos-engine dist-tags --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/release-evidence/dist-tags.json"
+          npm view gkos-engine maintainers --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/release-evidence/maintainers.json"
+          node --input-type=module -e 'import fs from "node:fs"; import assert from "node:assert/strict"; const root=process.env.RUNNER_TEMP+"/release-evidence/"; assert.ok(!JSON.parse(fs.readFileSync(root+"versions.json")).includes("2.2.0")); assert.ok(JSON.parse(fs.readFileSync(root+"maintainers.json")).some(x=>x.startsWith("odenknight <")));'
+      - name: Rerun release gates serially
+        working-directory: candidate
+        run: |
+          set -euo pipefail
+          npm ci
+          npm run typecheck
+          npm run build
+          npm test
+          npm run test:navigation
+          npm run test:intelligence
+          npm run pack:check
+          npm run check:license
+          npm run check:nomenclature
+          npm audit --audit-level=low
+          npm run qualify:current -- --output "$RUNNER_TEMP/current-qualification"
+          git diff --exit-code
+          test -z "$(git status --porcelain)"
+      - name: Create and inspect the one publication artifact
+        working-directory: candidate
+        run: |
+          set -euo pipefail
+          npm pack --dry-run --ignore-scripts --json > "$RUNNER_TEMP/release-evidence/pack-dry-run.json"
+          npm pack --ignore-scripts --json --pack-destination "$RUNNER_TEMP/release-evidence" > "$RUNNER_TEMP/release-evidence/pack.json"
+          node scripts/release-220-preflight.mjs --artifact "$RUNNER_TEMP/release-evidence/gkos-engine-2.2.0.tgz" "$RUNNER_TEMP/release-evidence/pack.json" > "$RUNNER_TEMP/release-evidence/artifact.json"
+          npm sbom --sbom-format=cyclonedx > "$RUNNER_TEMP/release-evidence/sbom.cdx.json"
+          npm publish "$RUNNER_TEMP/release-evidence/gkos-engine-2.2.0.tgz" --dry-run --ignore-scripts --registry=https://registry.npmjs.org --tag=latest --access=public
+      - name: Publish inspected artifact through OIDC only
+        working-directory: candidate
+        run: |
+          set -euo pipefail
+          npm view gkos-engine versions --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/release-evidence/versions-immediate.json"
+          npm view gkos-engine dist-tags --json --registry=https://registry.npmjs.org > "$RUNNER_TEMP/release-evidence/dist-tags-immediate.json"
+          node -e 'const fs=require("node:fs"),assert=require("node:assert/strict"),root=process.env.RUNNER_TEMP+"/release-evidence/"; assert.ok(!JSON.parse(fs.readFileSync(root+"versions-immediate.json")).includes("2.2.0")); assert.equal(JSON.parse(fs.readFileSync(root+"dist-tags-immediate.json")).latest,"2.0.1")'
+          node scripts/release-220-preflight.mjs --artifact "$RUNNER_TEMP/release-evidence/gkos-engine-2.2.0.tgz" "$RUNNER_TEMP/release-evidence/pack.json"
+          npm publish "$RUNNER_TEMP/release-evidence/gkos-engine-2.2.0.tgz" --ignore-scripts --registry=https://registry.npmjs.org --tag=latest --access=public
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: gkos-engine-2.2.0-release-evidence-${{ github.run_id }}
+          path: ${{ runner.temp }}/release-evidence/
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/observation-2.2.yml

@@ -0,0 +1,46 @@
+name: Engine 2.2 retrieval observation
+on:
+  push:
+    branches: [main, 'release/**']
+  pull_request:
+  schedule:
+    - cron: '37 4 * * *'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  current-2-2:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: core.autocrlf
+      GIT_CONFIG_VALUE_0: 'false'
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck && npm run build && npm run pack:check
+      - name: Build private runner
+        run: ./node_modules/.bin/esbuild scripts/run-retrieval-observation-qualification-2.2.mjs --bundle --platform=node --format=esm --target=node24 --outfile="$RUNNER_TEMP/observation-2.2.mjs"
+      - name: Execute exact current source
+        run: |
+          mkdir -m 700 "$RUNNER_TEMP/observation-2.2"
+          node "$RUNNER_TEMP/observation-2.2.mjs" --mode observation --artifact-root "$RUNNER_TEMP/observation-2.2"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: observation-2.2-${{ github.sha }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/observation-2.2/performance-sample-plan.json
+            ${{ runner.temp }}/observation-2.2/observation-receipt.json
+            ${{ runner.temp }}/observation-2.2/observation-report.json
+          if-no-files-found: error
+          retention-days: 30
+      - run: git diff --exit-code && test -z "$(git status --porcelain)"
+        if: always()

.github/workflows/phase4-retrieval-observation.yml

@@ -1,4 +1,4 @@
-name: Phase 4 Retrieval Observation
+name: Phase 4 Retrieval Observation (historical Engine 2.1.2)
 
 on:
   schedule:
@@ -16,9 +16,15 @@ jobs:
   observe:
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: core.autocrlf
+      GIT_CONFIG_VALUE_0: 'false'
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
+          # Exact last successful historical implementation; never current main.
+          ref: d81f9d1351f1a9228650a840629191a92f2dfb22
           fetch-depth: 0
 
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0

.github/workflows/sidecar-release.yml

@@ -53,7 +53,9 @@ jobs:
           cache: npm
 
       - name: Verify release identity
-        if: startsWith(github.ref, 'refs/tags/')
+        # The stable 2.2 release notes/evidence are created only after npm and
+        # consumer verification. Keep these binaries as run artifacts meanwhile.
+        if: startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/tags/v2.2.0'
         shell: bash
         run: |
           set -euo pipefail

README.md

@@ -347,6 +347,12 @@ authority.
 
 ## Build and verification
 
+Use a full Git clone for verification: historical fixture tests read exact
+commits and cannot reliably run from a shallow clone or a source ZIP. Check
+with `git rev-parse --is-shallow-repository`; if it prints `true`, run
+`git fetch --unshallow origin` before testing. In GitHub Actions, use
+`actions/checkout` with `fetch-depth: 0`.
+
 Run build and packaging steps separately from running tests: npm preparation
 can rebuild `dist/` and invalidate a concurrent test run.