Integrate the verified Elsa consolidation checkpoint into main

.agents/skills/elsa-release/references/consolidated-feedz-profile.json

@@ -0,0 +1,30 @@
+{
+  "schema": 1,
+  "mode": "nonpublishing_candidate",
+  "candidate_only": true,
+  "version": "3.10.0",
+  "configuration": "Release",
+  "repositories": [
+    {
+      "name": "core",
+      "directory": "elsa-core-main",
+      "github": "elsa-workflows/elsa-core",
+      "solution": "Elsa.sln",
+      "workflow": "prepare-consolidated-release-candidate.yml",
+      "dependencies": [],
+      "alignment": [],
+      "required_jobs": ["prepare", "retrieve", "consumers"],
+      "fixed_packages": {},
+      "npm": []
+    }
+  ],
+  "feeds": [
+    {"name": "feedz", "base_url": "https://f.feedz.io/elsa-workflows/elsa-3/nuget/v3/packages"}
+  ],
+  "release_kinds": {"stable": {"feeds": ["feedz"]}},
+  "artifact_retention_days": 30,
+  "npm_ownership": "undecided",
+  "templates_scope": "Separate repository and release policy; not part of Elsa.sln candidate inventory.",
+  "maintenance_profile": "elsa-profile.json",
+  "publication": "No publication. A separately reviewed and approved future publish-only workflow must bind to the exact original candidate artifact without restore, build or pack."
+}

.agents/skills/elsa-release/references/runbook.md

@@ -324,3 +324,94 @@ python3 <skill>/scripts/release_train.py --state <run>/state.json record-announc
 The checkpoint validates receipt content and hashes, but does not replace the connector's live `get_post` verification. On an interrupted social publish, reconcile the recorded intent and current channel posts before sending anything again. Verify Discord with the bot API and LinkedIn/X with their connector. Queue status is only completion when the user requested scheduling. A legacy checkpoint reports `adopt-post-refresh`; adopt it explicitly, and use `--targets website` when only the website needs to be refreshed on an already completed release. Do not create a new publication or repost existing announcements for that follow-up.
 
 Finally rerun `status`, audit the exact release/version/source/workflow and feed evidence, verify all requested social results, save a concise completion record, stop any heartbeat, and report release/post URLs plus any material limitation. Complete a persistent goal only after this audit.
+
+## Consolidated 3.10.0 candidate preparation (nonpublishing)
+
+Use [consolidated-feedz-profile.json](consolidated-feedz-profile.json) for the
+single Core-owned lockstep candidate, including imported Extensions/Studio and
+Elsa.SamplePackage at **3.10.0**. Its fixed-package exceptions are empty.
+Feedz is the eventual 3.10 target. This profile prepares a candidate; it is not
+an ordinary release-train profile or publication approval. The existing
+[elsa-profile.json](elsa-profile.json) remains the four-repository 3.8/3.9
+maintenance procedure, including its legacy SamplePackage 1.0.1 exception.
+Templates remains a separate source/release stage outside Elsa.sln. npm
+ownership is **undecided** and no npm publication is part of this procedure.
+
+First review a coherent implementation head and evaluated inventory comparison.
+The dedicated `prepare-consolidated-release-candidate.yml` workflow runs only
+on its repository-write branch push or a manual dispatch of the exact reviewed
+ref. Review that workflow as trusted code before running it. PR-editable YAML
+and an `if` condition do not provide an immutable authorization boundary.
+The prepare and consumer jobs have contents-read and no actions-read permission;
+the separate actions-read retrieval job executes fixed requests without checkout.
+It supplies only original archive bytes, public artifact metadata and the
+independent envelope. The pinned download action selects the same-run transport
+artifact ID with `merge-multiple: true`, so inputs appear at the specified root.
+
+For inexpensive evaluation in a clean isolated committed checkout:
+
+```bash
+python3 scripts/integration-program/prepare_consolidated_release_candidate.py \
+  --version 3.10.0 --inventory-only --output /absolute/new/candidate-inventory
+```
+
+The canonical proof evaluator derives every package/exclusion from current
+Elsa.sln properties. It compares IDs, project paths and exclusion reasons with
+`consolidated-candidate-inventory-baseline.json`, derived from the accepted proof
+inventory. The 225 package/symbol pairs and 124 excluded projects (123 IDs) are
+baseline sanity evidence, never an allowlist. A difference emits
+`inventory-diff.json` and stops before building. Review and commit any justified
+baseline update; do not silently shrink it. The five retired Extensions Secrets
+IDs stay excluded. Default imported packability remains false, and
+ConsolidatedPackageProof retains its proof-only version rule. Candidate is an
+explicit mutually exclusive opt-in for Release and Version=PackageVersion=3.10.0
+at restore, compile and pack. A local candidate output is preparation evidence;
+only the exact-head hosted run supplies an immutable artifact identity.
+
+The producer verifies every nupkg/snupkg, dependency group, framework asset,
+assembly/source identity and built Studio asset using the shared proof pipeline.
+It seals every retained file in `preupload-manifest.json`, excluding that
+manifest from its own file list. The immutable artifact name binds source SHA,
+run ID and attempt. Retention is explicitly 30 days. After upload the no-checkout
+retrieval job writes a **separate post-upload envelope** in the run summary,
+recording artifact ID/name, source SHA/run/attempt, original archive digest/size,
+actual expiry, the UTC retrieval time and the producer's manifest hash. This envelope stays outside the
+original archive. Do not append it to the artifact, repack, relabel, or rebuild
+those bytes to hand them off.
+
+The downstream job binds the transferred envelope to the retrieval job output,
+checks the retrieval-time availability snapshot and expiry before execution, verifies the original archive digest/size and
+all manifest hashes/member safety **before extraction**, then restores/builds
+fresh PackageReference-only consumers on net8.0, net9.0 and net10.0. Parent
+props/targets/central configuration and SDK discovery are isolated. The standalone
+consumer disables the SDK's implicit library-packs source and legacy NuGet fallback
+folder; its strict effective-source/cache checks do not allow these caches.
+Receipts
+record resolved package assets, effective sources/cache, all loaded Elsa assembly
+identities/informational versions and DLL hashes against exact package assets.
+The Core/Slack/Studio feature handshake and actual WorkflowContexts HTTP loopback
+are representative checks, not a full behavior test of every package.
+
+Keep the original envelope, artifact link/ID, producer receipt and downstream
+receipt together in the review evidence. The retrieval job checks availability at
+its recorded retrieval time. Token-minimal consumers prove the exact transferred
+bytes with expiry checked before execution; they cannot observe deletion of the original artifact
+after retrieval. Before candidate approval or publication, independently re-read
+live original artifact metadata and recheck the exact artifact ID/name, archive
+digest/size, source SHA/run/attempt and expiry. A consumer receipt alone cannot
+satisfy that current availability check. If the artifact expires or disappears,
+it is no longer an approvable candidate. A replacement run creates a new
+identity and needs the full proof again. Candidate preparation is distinct from
+the unchanged earlier `3.10.0-proof.37410240989.1` archive and from future approved
+publication. The #8629 proof-version persisted matrix cannot certify different
+stable candidate bytes: applicable persisted compatibility checks must bind to
+these exact production bytes before publication.
+
+This task implements no publisher handoff. Ordinary approved Core publication
+selection remains unchanged, including its stable 3.10.0 Feedz dispatch. That
+workflow accepts no candidate opt-in, candidate artifact/run selector or candidate
+workflow ID. A future separately reviewed **publish-only** workflow must bind to
+the exact original candidate identity without restore/build/pack, after the
+remaining compatibility, publisher-cutover and release approvals. Candidate
+success does not imply release readiness, publication, source publisher cutover
+or completion of #8219/#8220.

.agents/skills/elsa-release/scripts/release_train.py

@@ -260,6 +260,8 @@ def site_receipt_valid(state, target, record):
 def init(args):
     version = parse_version(args.version, args.kind)
     profile = read(args.profile)
+    if profile.get("candidate_only"):
+        raise ValueError("Nonpublishing candidate profiles cannot initialize a publication release train")
     names = [r['name'] for r in profile['repositories']]
     selected = args.repositories or names
     sources = dict(x.split('=', 1) for x in (args.source or []))

.agents/skills/elsa-release/tests/test_release_train.py

@@ -25,6 +25,12 @@ def setUp(self):
         self.state=train.init(self.args)
         self.remote_existing=False
 
+    def test_candidate_profile_cannot_initialize_publication_train(self):
+        self.args.version = '3.10.0'
+        self.args.profile = train.DEFAULT_PROFILE.with_name('consolidated-feedz-profile.json')
+        with self.assertRaisesRegex(ValueError, 'candidate profiles cannot initialize'):
+            train.init(self.args)
+
     def bind_fixture(self,name):
         path=self.root/name;path.mkdir(exist_ok=True)
         manifest=path/'manifest.json';notes=path/'notes.md';report=path/'report.json'

.github/workflows/consolidated-package-recovery-preflight.yml

@@ -0,0 +1,113 @@
+name: Consolidated package recovery preflight
+
+on:
+  push:
+    branches: ['codex/consolidated-recovery-preflight']
+  workflow_dispatch:
+  workflow_call:
+    outputs:
+      input-artifact-id:
+        description: Same-run transfer of the pinned original archive and fresh retrieval metadata
+        value: ${{ jobs.retrieve.outputs.input-artifact-id }}
+
+permissions: {}
+
+jobs:
+  retrieve:
+    permissions:
+      actions: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      input-artifact-id: ${{ steps.transfer.outputs.artifact-id }}
+    steps:
+      # Repository-write push/manual authority is the trust boundary. This job
+      # never checks out or executes repository code with the artifact token.
+      - name: Retrieve original verified unpublished artifact
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/recovery-input"
+          gh api repos/elsa-workflows/elsa-core/actions/artifacts/11412848210 > "$RUNNER_TEMP/recovery-input/artifact.json"
+          gh api repos/elsa-workflows/elsa-core/actions/runs/37456860080/attempts/1 > "$RUNNER_TEMP/recovery-input/producer-run.json"
+          jq -e '.id == 37456860080 and .run_attempt == 1 and
+            .head_sha == "ba5b348aa2414fdf7c19d9d8806e87b7c91a4205" and .conclusion == "success" and
+            (.event == "push" or .event == "workflow_dispatch") and
+            .path == ".github/workflows/prepare-consolidated-release-candidate.yml"' "$RUNNER_TEMP/recovery-input/producer-run.json" > /dev/null
+          jq -e '.id == 11412848210 and
+            .name == "consolidated-candidate-ba5b348aa2414fdf7c19d9d8806e87b7c91a4205-37456860080-1" and
+            .expired == false and .expires_at == "2026-11-05T12:13:30Z" and
+            .digest == "sha256:ace85260c3389916fe3dcd7ee9cd5b766e4030dd6cee13c7f89285ada79c944f" and
+            .size_in_bytes == 92659861 and .workflow_run.id == 37456860080 and
+            .workflow_run.head_sha == "ba5b348aa2414fdf7c19d9d8806e87b7c91a4205"' "$RUNNER_TEMP/recovery-input/artifact.json" > /dev/null
+          test "$(date -u -d '2026-11-05T12:13:30Z' +%s)" -gt "$(date -u +%s)"
+          gh api repos/elsa-workflows/elsa-core/actions/artifacts/11412848210/zip > "$RUNNER_TEMP/recovery-input/candidate.zip"
+          test "$(stat -c %s "$RUNNER_TEMP/recovery-input/candidate.zip")" -eq 92659861
+          printf '%s  %s\n' \
+            'ace85260c3389916fe3dcd7ee9cd5b766e4030dd6cee13c7f89285ada79c944f' \
+            "$RUNNER_TEMP/recovery-input/candidate.zip" | sha256sum --check --status
+          jq -nc --arg observed "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{schema:1,artifact_id:11412848210,archive_sha256:"ace85260c3389916fe3dcd7ee9cd5b766e4030dd6cee13c7f89285ada79c944f",retrieved_at:$observed}' \
+            > "$RUNNER_TEMP/recovery-input/live-retrieval.json"
+      - name: Transfer only the verified original inputs
+        id: transfer
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: consolidated-recovery-input-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/recovery-input/candidate.zip
+            ${{ runner.temp }}/recovery-input/producer-run.json
+            ${{ runner.temp }}/recovery-input/live-retrieval.json
+            ${{ runner.temp }}/recovery-input/artifact.json
+          if-no-files-found: error
+          retention-days: 1
+
+  proof:
+    needs: retrieve
+    permissions:
+      contents: read
+      actions: none
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.retrieve.outputs.input-artifact-id }}
+          merge-multiple: true
+          path: ${{ runner.temp }}/recovery-input
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.12'
+      - name: Verify cheap recovery contracts in both Python modes
+        working-directory: scripts/integration-program
+        run: |
+          python -m unittest test_consolidated_recovery_inputs test_consolidated_package_recovery test_run_consolidated_recovery_fixture test_stable_persisted_workflow_upgrade_fixture
+          python -O -m unittest test_consolidated_recovery_inputs test_consolidated_package_recovery test_run_consolidated_recovery_fixture test_stable_persisted_workflow_upgrade_fixture
+      - name: Preserve maintenance verification and recovery policy
+        working-directory: .agents/skills/elsa-release/tests
+        run: |
+          python -m unittest test_verify_packages test_release_train
+          python -O -m unittest test_verify_packages test_release_train
+      - name: Rehearse all 225 original package pairs with a simulated feed
+        run: >-
+          python scripts/integration-program/run_consolidated_recovery_fixture.py
+          --inputs "$RUNNER_TEMP/recovery-input"
+          --verified-root "$RUNNER_TEMP/recovery-candidate"
+          --output "$RUNNER_TEMP/recovery-evidence/simulation.json"
+          --planner-source "${{ github.sha }}"
+          --planner-run "${{ github.run_id }}"
+          --planner-attempt "${{ github.run_attempt }}"
+      - name: Retain the portable simulation ledger
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: consolidated-recovery-preflight-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/recovery-evidence/simulation.json
+          if-no-files-found: warn
+          retention-days: 30

.github/workflows/execution-cycle-proof.yml

@@ -0,0 +1,65 @@
+name: Execution-cycle ownership proof
+
+on:
+  pull_request:
+    paths:
+      - 'src/modules/Elsa.Workflows.Core/**'
+      - 'src/modules/Elsa.Workflows.Runtime/**'
+      - 'src/modules/Elsa.Alterations/**'
+      - 'src/extensions/runtimes/Elsa.Workflows.Runtime.ProtoActor/**'
+      - 'src/extensions/actors/**'
+      - 'test/unit/Elsa.Workflows.Core.UnitTests/**'
+      - 'test/unit/Elsa.Workflows.Runtime.UnitTests/**'
+      - 'test/integration/Elsa.Workflows.IntegrationTests/**'
+      - 'test/integration/Elsa.Alterations.IntegrationTests/**'
+      - 'test/extensions/modules/runtimes/Elsa.Workflows.Runtime.ProtoActor.UnitTests/**'
+      - 'scripts/integration-program/run_execution_cycle_proof.py'
+      - 'scripts/integration-program/test_execution_cycle_proof.py'
+      - '.github/workflows/execution-cycle-proof.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: execution-cycle-proof-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  execution-cycle-proof:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.12'
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: |
+            8.0.x
+            9.0.x
+            10.0.x
+      - name: Check evidence policy
+        run: |
+          PYTHONDONTWRITEBYTECODE=1 python -m unittest discover -s scripts/integration-program -p test_execution_cycle_proof.py
+          PYTHONDONTWRITEBYTECODE=1 python -O -m unittest discover -s scripts/integration-program -p test_execution_cycle_proof.py
+      - name: Build supported frameworks and verify execution ownership serially
+        env:
+          EXPECTED_HEAD: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python scripts/integration-program/run_execution_cycle_proof.py \
+            --expected-head "$EXPECTED_HEAD" --output "$RUNNER_TEMP/execution-cycle-proof"
+      - name: Retain sanitized case evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: execution-cycle-proof-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/execution-cycle-proof/receipt.json
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/integration-program-tools.yml

@@ -45,11 +45,24 @@ jobs:
         run: |
           echo 'PyYAML==6.0.3 --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc' > "$RUNNER_TEMP/gate-requirements.txt"
           python3 -m pip install --only-binary :all: --require-hashes -r "$RUNNER_TEMP/gate-requirements.txt"
+      - name: Verify the real symbol inspector against compiler-produced DLL and PDB fixtures
+        env:
+          ELSA_SYMBOL_INSPECTOR_DLL: ${{ runner.temp }}/symbol-inspector-fixture/VerifyPackageSymbolPair.dll
+        run: |
+          dotnet build scripts/integration-program/VerifyPackageSymbolPair/VerifyPackageSymbolPair.csproj \
+            --configuration Release --output "$RUNNER_TEMP/symbol-inspector-fixture"
+          python -m unittest discover -s scripts/integration-program -p test_verify_package_symbol_pair.py
+          python -O -m unittest discover -s scripts/integration-program -p test_verify_package_symbol_pair.py
       - name: Verify program graph, import safety and history preservation
         run: |
           python doc/integration-program/verify-hierarchy.py
           python -m unittest discover -s scripts/integration-program -p 'test_*.py'
           python -O -m unittest discover -s scripts/integration-program -p 'test_*.py'
+      - name: Preserve maintenance package verification and recovery contracts
+        working-directory: .agents/skills/elsa-release/tests
+        run: |
+          python -m unittest test_verify_packages test_release_train
+          python -O -m unittest test_verify_packages test_release_train
       - name: Verify activity contract comparison guards
         run: |
           python -m unittest discover -s scripts/integration-program/activity-compatibility -p 'test_*.py'