site: load style.css before brand.css on live nodes pages (F2 dark-mode contrast)

.github/workflows/architecture-cli-boundary-regression.yml

@@ -0,0 +1,135 @@
+name: Architecture CLI boundary diagnostic
+
+'on':
+  push:
+    branches:
+      - codex/architecture-cli-boundary-red-20261016
+  pull_request:
+    paths:
+      - architecture/artifact_index.py
+      - architecture/graph_artifact_readback.py
+      - tools/artifact_index_export.py
+      - tools/architecture_graph_artifact_readback.py
+      - tests/test_architecture_artifact_index.py
+      - tests/test_architecture_graph_artifact_readback.py
+      - tests/test_architecture_cli_boundaries.py
+      - .github/workflows/architecture-cli-boundary-regression.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}
+  cancel-in-progress: false
+
+jobs:
+  cli-boundaries:
+    name: architecture-cli-boundary-${{ matrix.mode }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 6
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: [normal, optimized]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        timeout-minutes: 1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Record diagnostic native context before running controls
+        timeout-minutes: 1
+        env:
+          DIAGNOSTIC_MODE: ${{ matrix.mode }}
+        run: |
+          set -euo pipefail
+          evidence="$RUNNER_TEMP/architecture-cli-boundary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$DIAGNOSTIC_MODE"
+          mkdir -m 700 "$evidence"
+          git rev-parse HEAD > "$evidence/checked-commit.txt"
+          python3 -I -B -S - "$evidence" <<'PY'
+          from datetime import datetime, timezone
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import platform
+          import sys
+          root = Path(os.environ['GITHUB_WORKSPACE'])
+          destination = Path(sys.argv[1])
+          paths = (
+              '.github/workflows/architecture-cli-boundary-regression.yml',
+              'tests/test_architecture_cli_boundaries.py',
+              'tests/test_architecture_artifact_index.py',
+              'tests/test_architecture_graph_artifact_readback.py',
+              'tools/artifact_index_export.py',
+              'tools/architecture_graph_artifact_readback.py',
+              'architecture/artifact_index.py',
+              'architecture/graph_artifact_readback.py',
+              'docs/site/dependency-source/GRAPH.json',
+          )
+          sources = {}
+          for name in paths:
+              raw = (root / name).read_bytes()
+              sources[name] = {'bytes': len(raw), 'sha256': hashlib.sha256(raw).hexdigest()}
+          context = {
+              'schema': 'architecture-cli-boundary-diagnostic/v1',
+              'recorded_at': datetime.now(timezone.utc).isoformat(),
+              'repository': os.environ['GITHUB_REPOSITORY'],
+              'event_name': os.environ['GITHUB_EVENT_NAME'],
+              'workflow_ref': os.environ['GITHUB_WORKFLOW_REF'],
+              'workflow_sha': os.environ['GITHUB_WORKFLOW_SHA'],
+              'event_sha': os.environ['GITHUB_SHA'],
+              'checked_commit': (destination / 'checked-commit.txt').read_text().strip(),
+              'run_id': os.environ['GITHUB_RUN_ID'],
+              'run_attempt': os.environ['GITHUB_RUN_ATTEMPT'],
+              'mode': os.environ['DIAGNOSTIC_MODE'],
+              'python': sys.version,
+              'platform': platform.platform(),
+              'source_identities': sources,
+              'scope': 'four CLI boundary methods only; required full suite remains separate',
+              'scientific_effect': 'NONE',
+              'scientific_status_authority': False,
+          }
+          (destination / 'native-context.json').write_text(
+              json.dumps(context, sort_keys=True, indent=2) + '\n', encoding='utf-8')
+          PY
+
+      - name: Run only the four external CLI boundary controls
+        timeout-minutes: 3
+        env:
+          DIAGNOSTIC_MODE: ${{ matrix.mode }}
+          ARCHITECTURE_CLI_BOUNDARY_REPORT: ${{ runner.temp }}/architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.mode }}/child-results.jsonl
+        run: |
+          set -euo pipefail
+          evidence="$RUNNER_TEMP/architecture-cli-boundary-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$DIAGNOSTIC_MODE"
+          flags=(-I -B -S)
+          if [ "$DIAGNOSTIC_MODE" = optimized ]; then
+            flags+=(-O)
+          fi
+          printf '%q ' timeout --signal=TERM --kill-after=5s 150s \
+            python3 "${flags[@]}" -m unittest discover -s tests -p test_architecture_cli_boundaries.py -v \
+            > "$evidence/test-command.txt"
+          printf '\n' >> "$evidence/test-command.txt"
+          set +e
+          timeout --signal=TERM --kill-after=5s 150s \
+            python3 "${flags[@]}" -m unittest discover -s tests -p test_architecture_cli_boundaries.py -v \
+            > "$evidence/tests.stdout" 2> "$evidence/tests.stderr"
+          status=$?
+          set -e
+          printf '%s\n' "$status" > "$evidence/test-exit-status.txt"
+          cat "$evidence/tests.stdout"
+          cat "$evidence/tests.stderr" >&2
+          exit "$status"
+
+      - name: Retain separate diagnostic originals on every conclusion
+        if: always()
+        timeout-minutes: 1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          name: architecture-cli-boundary-${{ matrix.mode }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/architecture-cli-boundary-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.mode }}/
+          if-no-files-found: error
+          retention-days: 90
+          compression-level: 6

.github/workflows/canvas-reader-native-admission.yml

@@ -0,0 +1,13 @@
+name: Admit fixed native reader controls
+'on':
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  reader:
+    uses: d6g8k5htny-coder/main/.github/workflows/architecture-canvas-tests.yml@c5e64bb61a5c0f49d08e0255a6a07a22a2326e17
+    with:
+      candidate_commit: c5e64bb61a5c0f49d08e0255a6a07a22a2326e17
+      runner_commit: c5e64bb61a5c0f49d08e0255a6a07a22a2326e17
+      admission_commit: 73d00f71634712e91c951f14e490b816e84bf657
+      admission_sha256: c9e332696b81754121c5605b1f679159b738916a20798ee7009a7bc220c3ede4

.github/workflows/current-site.yml

@@ -55,6 +55,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
+          fetch-depth: 0
       - name: Restore and admit all previously published public history
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/navigation.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   navigation:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97

.github/workflows/public-intake.yml

@@ -11,9 +11,14 @@ permissions:
 jobs:
   public-intake:
     name: public-intake
-    # Skip metadata edits only for terminal merged PRs. Reopenable PRs must
-    # still pass the live checker, including closure and head-drift checks.
-    if: ${{ !(github.event.pull_request.state == 'closed' && toJSON(github.event.pull_request.merged) == 'true') }}
+    permissions:
+      contents: read
+      pull-requests: read
+      # Only for the neutral "not evaluated" check run. Submitted code is never executed.
+      checks: write
+    # Never skip this required job based on event metadata: skipped checks can
+    # appear passing without validation. The checker handles merged-before-check
+    # events by posting a separate neutral result and returning nonzero (78).
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -28,4 +33,20 @@ jobs:
       - name: Verify intake from API bytes without checking out the PR
         env:
           GH_TOKEN: ${{ github.token }}
-        run: python3 -B -I tools/public_intake_check.py
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set +e
+          python3 -B -I tools/public_intake_check.py
+          code=$?
+          set -e
+          # Actions cannot mark this job neutral. Skipping the job can count as a
+          # passing required check, and a zero status would make public-intake
+          # green without package verification. Record a separate neutral check,
+          # then exit 78 so this job is failure, not success. A failed post
+          # still reaches that same nonzero status.
+          if [ "$code" -eq 78 ]; then
+            echo "not evaluated: merged before check"
+            python3 -B -I tools/public_intake_check.py --publish-not-evaluated-check || true
+            exit 78
+          fi
+          exit "$code"

.github/workflows/reactor-v0-controls.yml

@@ -0,0 +1,121 @@
+name: reactor-v0-controls
+
+on:
+  pull_request:
+    paths:
+      - 'experiments/reactor_v0/**'
+      - '.github/workflows/reactor-v0-controls.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'experiments/reactor_v0/**'
+      - '.github/workflows/reactor-v0-controls.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  finite-control:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      REACTOR_VERIFY_SOURCES: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11'
+      - name: Fetch and bind exact parent source objects
+        run: |
+          git fetch --no-tags --depth=1 origin \
+            88ff9223e57bf38c7fc33cb3559a88793a7b5087 \
+            6bd133d591e43e75a9292463bb4bfde7a34984dc
+      - name: Preserve an existing frozen closure
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          python3 -I -B - <<'PY'
+          import hashlib
+          import json
+          from pathlib import Path
+          import os
+          import subprocess
+
+          closure_path = "experiments/reactor_v0/closure.json"
+          closure_file = Path(closure_path)
+          package = Path("experiments/reactor_v0")
+          package_entries = list(package.rglob("*"))
+          if (closure_file.is_symlink() or package.is_symlink() or
+                  any(path.is_symlink() for path in package_entries)):
+              raise SystemExit("frozen package may not contain symlinks")
+          base = os.environ["BASE_SHA"]
+          base_commit = subprocess.run(
+              ["git", "cat-file", "-e", base + "^{commit}"],
+              stdout=subprocess.DEVNULL,
+              stderr=subprocess.DEVNULL,
+              check=False,
+          )
+          if base_commit.returncode != 0:
+              raise SystemExit("pull-request base is not an available commit")
+          base_path = subprocess.run(
+              ["git", "ls-tree", "-z", base, "--", closure_path],
+              stdout=subprocess.PIPE,
+              stderr=subprocess.DEVNULL,
+              check=False,
+          )
+          if base_path.returncode != 0:
+              raise SystemExit("unable to inspect frozen closure at pull-request base")
+          if not base_path.stdout:
+              print("Base has no Reactor A freeze; introduction is permitted.")
+              raise SystemExit(0)
+          prior = subprocess.run(
+              ["git", "show", base + ":" + closure_path],
+              stdout=subprocess.PIPE,
+              stderr=subprocess.DEVNULL,
+              check=False,
+          )
+          if prior.returncode != 0:
+              raise SystemExit("unable to read frozen closure at pull-request base")
+          current = closure_file.read_bytes()
+          if current != prior.stdout:
+              raise SystemExit("frozen closure.json differs from pull-request base")
+          closure = json.loads(prior.stdout)
+          expected_package = {
+              Path(path).relative_to("experiments/reactor_v0").as_posix()
+              for path in closure
+              if path.startswith("experiments/reactor_v0/")
+          } | {"closure.json"}
+          actual_package = {
+              path.relative_to(package).as_posix()
+              for path in package_entries
+              if not path.is_dir()
+          }
+          if actual_package != expected_package:
+              raise SystemExit("frozen package file set differs from pull-request base")
+          for relative, expected in closure.items():
+              path = Path(relative)
+              if path.is_symlink():
+                  raise SystemExit("frozen closure member may not be a symlink: " + relative)
+              actual = hashlib.sha256(path.read_bytes()).hexdigest()
+              if actual != expected:
+                  raise SystemExit("frozen byte mismatch: " + relative)
+          PY
+      - name: Normal tests and control
+        run: |
+          python3 -I -B -m unittest discover -s experiments/reactor_v0 -p 'test_*.py' -v
+          python3 -B experiments/reactor_v0/mutation_harness.py
+          python3 -B experiments/reactor_v0/run_control.py
+      - name: Optimized tests and control
+        run: |
+          python3 -I -B -O -m unittest discover -s experiments/reactor_v0 -p 'test_*.py' -v
+          python3 -B -O experiments/reactor_v0/mutation_harness.py
+          python3 -B -O experiments/reactor_v0/run_control.py
+      - name: Frozen run stage is read-only
+        run: |
+          git diff --exit-code -- experiments/reactor_v0 .github/workflows/reactor-v0-controls.yml
+          test -z "$(git status --porcelain --untracked-files=all --ignored -- \
+            experiments/reactor_v0 .github/workflows/reactor-v0-controls.yml)"

.github/workflows/research-architecture.yml

@@ -36,8 +36,8 @@ jobs:
   graph:
     name: research-architecture
     runs-on: ubuntu-24.04
-    # Complete stage ceiling: 19 preparation + 11 tests + fourteen 1-minute stages.
-    timeout-minutes: 44
+    # Complete stage ceiling: 19 preparation + 16 tests + fourteen 1-minute stages.
+    timeout-minutes: 49
     outputs:
       checked_commit: ${{ steps.accepted.outputs.checked_commit }}
       repository: ${{ steps.accepted.outputs.repository }}
@@ -311,17 +311,17 @@ jobs:
           printf '%s\n' "$GITHUB_RUN_ATTEMPT" > "$RUNNER_TEMP/architecture-publish/run-attempt.txt"
       - name: Run controls and export in ephemeral restricted container
         id: architecture_controls
-        timeout-minutes: 11
+        timeout-minutes: 16
         env:
           IMAGE: python:3.11.14-slim-bookworm@sha256:83f339c1be6340ae1096010fdccf6552ac932d8f410d45d206014916bdf37e48
         run: |
           set -euo pipefail
           set +e
-          timeout --signal=TERM --kill-after=10s 600s docker run --pull=never --rm --log-driver none --name architecture-controls \
+          timeout --signal=TERM --kill-after=10s 900s docker run --pull=never --rm --log-driver none --name architecture-controls \
             --network none --read-only --user 65532:65532 --cpus 2 --memory 1g --pids-limit 128 \
             --cap-drop ALL --security-opt no-new-privileges \
             --env ARCHITECTURE_SANDBOX=1 \
-            --tmpfs /tmp:rw,noexec,nosuid,size=64m \
+            --tmpfs /tmp:rw,noexec,nosuid,size=128m \
             --mount type=bind,source="$GITHUB_WORKSPACE",target=/source,readonly \
             --mount type=bind,source="$RUNNER_TEMP/architecture-evidence/container",target=/output \
             --workdir /source "$IMAGE" sh -c '

AGENTS.md

@@ -7,6 +7,12 @@ Carry both links into task handoffs and new-agent onboarding.
 
 Use the [current workflow](governance/OP-WORKFLOW-20260930.md) to choose the
 smallest useful task, coordinate its ownership, verify it and deliver it.
+As of 15 October 2026, direct new claims, reviews, handoffs and releases to
+[Agent Message Board #419](https://github.com/d6g8k5htny-coder/main/issues/419).
+Earlier [#307](https://github.com/d6g8k5htny-coder/main/issues/307) and
+[#229](https://github.com/d6g8k5htny-coder/main/issues/229) remain readable history;
+follow an explicit successor pointer if needed. Moving the board does not
+transfer, renew, or release any existing claim.
 Dylan's current explicit instruction resumes the requested reader experience
 and workflow improvements, including implementation, review and integration.
 The [September 27 stop](governance/OWNER_STOP_20260927.md) is no longer in effect

CONTRIBUTING.md

@@ -111,7 +111,7 @@ HTML, SVG, archives, executable files, symlinks and submodules are refused here.
 For code or a notebook proposal, describe it in an issue; a maintainer can sponsor
 a separate engineering PR. Do not encode a refused file inside an allowed format.
 
-`public-intake` runs trusted default-branch code with a read-only token. It reads
+`public-intake` runs trusted default-branch code; the job's token is read-only for contents and pull requests, plus `checks: write` used solely to post the neutral 'not evaluated: merged before check' check run, and submitted code is never checked out or executed. It reads
 PR metadata and blobs through the GitHub API, checks complete path lists and source
 identities, and fails on missing information or a changing PR. It never checks
 out or executes submitted code. The credential scan catches a small documented

README.md

@@ -41,7 +41,7 @@ The [research workspace](https://d6g8k5htny-coder.github.io/main/site/workspace.
 | [query-](https://github.com/d6g8k5htny-coder/query-) | Read-only exact-source lookup |
 | [Universal-Law-Workspace](https://github.com/d6g8k5htny-coder/Universal-Law-Workspace) | Repository map |
 
-[Reproduction guide](docs/REPRODUCE.md) · [Agent entry](AGENTS.md) · [Current workflow](governance/OP-WORKFLOW-20260930.md) · [Active coordination board, main #307](https://github.com/d6g8k5htny-coder/main/issues/307) · [Historical #229 working guidance](https://github.com/d6g8k5htny-coder/main/issues/229#issuecomment-6038554880) · [Tasks and claims, main #275](https://github.com/d6g8k5htny-coder/main/issues/275)
+[Reproduction guide](docs/REPRODUCE.md) · [Agent entry](AGENTS.md) · [Current workflow](governance/OP-WORKFLOW-20260930.md) · [Active coordination board, main #419](https://github.com/d6g8k5htny-coder/main/issues/419) · [Prior board #307 (history)](https://github.com/d6g8k5htny-coder/main/issues/307) · [Historical #229 working guidance](https://github.com/d6g8k5htny-coder/main/issues/229#issuecomment-6038554880) · [Tasks and claims, main #275](https://github.com/d6g8k5htny-coder/main/issues/275)
 
 </details>