Project the Artifact Index and verify original graph archives

.github/workflows/architecture-cli-boundary-regression.yml

@@ -0,0 +1,135 @@
+name: Architecture CLI boundary diagnostic
+
+'on':
+  push:
+    branches:
+      - codex/architecture-cli-boundary-red-20261016
+  pull_request:
+    paths:
+      - architecture/artifact_index.py
+      - architecture/graph_artifact_readback.py
+      - tools/artifact_index_export.py
+      - tools/architecture_graph_artifact_readback.py
+      - tests/test_architecture_artifact_index.py
+      - tests/test_architecture_graph_artifact_readback.py
+      - tests/test_architecture_cli_boundaries.py
+      - .github/workflows/architecture-cli-boundary-regression.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}
+  cancel-in-progress: false
+
+jobs:
+  cli-boundaries:
+    name: architecture-cli-boundary-${{ matrix.mode }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 6
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: [normal, optimized]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        timeout-minutes: 1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Record diagnostic native context before running controls
+        timeout-minutes: 1
+        env:
+          DIAGNOSTIC_MODE: ${{ matrix.mode }}
+        run: |
+          set -euo pipefail
+          evidence="$RUNNER_TEMP/architecture-cli-boundary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$DIAGNOSTIC_MODE"
+          mkdir -m 700 "$evidence"
+          git rev-parse HEAD > "$evidence/checked-commit.txt"
+          python3 -I -B -S - "$evidence" <<'PY'
+          from datetime import datetime, timezone
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import platform
+          import sys
+          root = Path(os.environ['GITHUB_WORKSPACE'])
+          destination = Path(sys.argv[1])
+          paths = (
+              '.github/workflows/architecture-cli-boundary-regression.yml',
+              'tests/test_architecture_cli_boundaries.py',
+              'tests/test_architecture_artifact_index.py',
+              'tests/test_architecture_graph_artifact_readback.py',
+              'tools/artifact_index_export.py',
+              'tools/architecture_graph_artifact_readback.py',
+              'architecture/artifact_index.py',
+              'architecture/graph_artifact_readback.py',
+              'docs/site/dependency-source/GRAPH.json',
+          )
+          sources = {}
+          for name in paths:
+              raw = (root / name).read_bytes()
+              sources[name] = {'bytes': len(raw), 'sha256': hashlib.sha256(raw).hexdigest()}
+          context = {
+              'schema': 'architecture-cli-boundary-diagnostic/v1',
+              'recorded_at': datetime.now(timezone.utc).isoformat(),
+              'repository': os.environ['GITHUB_REPOSITORY'],
+              'event_name': os.environ['GITHUB_EVENT_NAME'],
+              'workflow_ref': os.environ['GITHUB_WORKFLOW_REF'],
+              'workflow_sha': os.environ['GITHUB_WORKFLOW_SHA'],
+              'event_sha': os.environ['GITHUB_SHA'],
+              'checked_commit': (destination / 'checked-commit.txt').read_text().strip(),
+              'run_id': os.environ['GITHUB_RUN_ID'],
+              'run_attempt': os.environ['GITHUB_RUN_ATTEMPT'],
+              'mode': os.environ['DIAGNOSTIC_MODE'],
+              'python': sys.version,
+              'platform': platform.platform(),
+              'source_identities': sources,
+              'scope': 'four CLI boundary methods only; required full suite remains separate',
+              'scientific_effect': 'NONE',
+              'scientific_status_authority': False,
+          }
+          (destination / 'native-context.json').write_text(
+              json.dumps(context, sort_keys=True, indent=2) + '\n', encoding='utf-8')
+          PY
+
+      - name: Run only the four external CLI boundary controls
+        timeout-minutes: 3
+        env:
+          DIAGNOSTIC_MODE: ${{ matrix.mode }}
+          ARCHITECTURE_CLI_BOUNDARY_REPORT: ${{ runner.temp }}/architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.mode }}/child-results.jsonl
+        run: |
+          set -euo pipefail
+          evidence="$RUNNER_TEMP/architecture-cli-boundary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$DIAGNOSTIC_MODE"
+          flags=(-I -B -S)
+          if [ "$DIAGNOSTIC_MODE" = optimized ]; then
+            flags+=(-O)
+          fi
+          printf '%q ' timeout --signal=TERM --kill-after=5s 150s \
+            python3 "${flags[@]}" -m unittest discover -s tests -p test_architecture_cli_boundaries.py -v \
+            > "$evidence/test-command.txt"
+          printf '\n' >> "$evidence/test-command.txt"
+          set +e
+          timeout --signal=TERM --kill-after=5s 150s \
+            python3 "${flags[@]}" -m unittest discover -s tests -p test_architecture_cli_boundaries.py -v \
+            > "$evidence/tests.stdout" 2> "$evidence/tests.stderr"
+          status=$?
+          set -e
+          printf '%s\n' "$status" > "$evidence/test-exit-status.txt"
+          cat "$evidence/tests.stdout"
+          cat "$evidence/tests.stderr" >&2
+          exit "$status"
+
+      - name: Retain separate diagnostic originals on every conclusion
+        if: always()
+        timeout-minutes: 1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: architecture-cli-boundary-${{ matrix.mode }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.mode }}/
+          if-no-files-found: error
+          retention-days: 90
+          compression-level: 6

.github/workflows/navigation.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   navigation:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97

.github/workflows/research-architecture.yml

@@ -36,8 +36,8 @@ jobs:
   graph:
     name: research-architecture
     runs-on: ubuntu-24.04
-    # Complete stage ceiling: 19 preparation + 11 tests + fourteen 1-minute stages.
-    timeout-minutes: 44
+    # Complete stage ceiling: 19 preparation + 16 tests + fourteen 1-minute stages.
+    timeout-minutes: 49
     outputs:
       checked_commit: ${{ steps.accepted.outputs.checked_commit }}
       repository: ${{ steps.accepted.outputs.repository }}
@@ -311,17 +311,17 @@ jobs:
           printf '%s\n' "$GITHUB_RUN_ATTEMPT" > "$RUNNER_TEMP/architecture-publish/run-attempt.txt"
       - name: Run controls and export in ephemeral restricted container
         id: architecture_controls
-        timeout-minutes: 11
+        timeout-minutes: 16
         env:
           IMAGE: python:3.11.14-slim-bookworm@sha256:83f339c1be6340ae1096010fdccf6552ac932d8f410d45d206014916bdf37e48
         run: |
           set -euo pipefail
           set +e
-          timeout --signal=TERM --kill-after=10s 600s docker run --pull=never --rm --log-driver none --name architecture-controls \
+          timeout --signal=TERM --kill-after=10s 900s docker run --pull=never --rm --log-driver none --name architecture-controls \
             --network none --read-only --user 65532:65532 --cpus 2 --memory 1g --pids-limit 128 \
             --cap-drop ALL --security-opt no-new-privileges \
             --env ARCHITECTURE_SANDBOX=1 \
-            --tmpfs /tmp:rw,noexec,nosuid,size=64m \
+            --tmpfs /tmp:rw,noexec,nosuid,size=128m \
             --mount type=bind,source="$GITHUB_WORKSPACE",target=/source,readonly \
             --mount type=bind,source="$RUNNER_TEMP/architecture-evidence/container",target=/output \
             --workdir /source "$IMAGE" sh -c '