[IanHollow]

Summary

Token-created package source validations had no explicit completion callback, and a successful queue callback could finish before GitHub exposed the next candidate. Verified start/completion notifications now invalidate stale source evidence and restore admission only from current actual jobs. A bounded post-publication pass dispatches the next verified front candidate without waiting for the hourly recovery schedule.

source callback → validate producer/attempt → invalidate or revalidate actual jobs
queue success → wait for asynchronous front change → dispatch next ref once

Evidence

• Before: source CI 38328227870 passed while its queue-only callback skipped the package source branch. Completion callback 38334694888 ended before the next candidate appeared.
• After: 161 local regression tests and offline workflow, security, shell and Python checks pass. Tests exercise immutable producer validation, completion-before-producer-finish, obsolete callback no-ops, 16 required jobs plus admission invalidation, actual failed-job links, and next-front dispatch after success publication. Required hosted PR and merge-group checks remain mandatory.
• Legacy callback payloads remain compatible. Package caller inputs and source-only callback jobs require a separate reviewed rollout. Version-specific release notes are included for v2.12.0.

Merge Danger

Door: two-way. Restore the previous shared release pin and remove optional source notification inputs to roll back.

Blast Radius: automation. Queue/status operations change; existing job gates, token permissions, source ownership checks, release builders and signing trust remain intact.

Hosted validation on 128a7e6fed565147424c30227f4d72bd4406d00f passed the actual Nix validation job: all 161 tests (including hermetic callback Bash execution), strict documentation build, workflow/security checks and real Nix attribute discovery. Full current-head checks and normal merge-group validation remain required before release.

Protected queue commit ab8e486d3d1c48edd116578e097a46eb0c8f5097 passed CI, partitioning fuzz and sign-off, then merged normally. v2.12.0 was published by the independently pinned SLSA builder. The signed tag, archive checksum, manifest source identity and all three provenance subjects were independently verified. Archive SHA-256: ec1e9099b62fc4f6738ccebef0803e417fd97aba7e078385a3535705590ba9e4.