feat: list synthetic workflow admissions on a public ledger

.github/workflows/profile-consistency.yml

@@ -68,9 +68,15 @@ jobs:
           else
             printf '{"admissions":[]}\n' > "$RUNNER_TEMP/previous-production-lifecycle-admissions.json"
           fi
+          if git cat-file -e "$BASE_SHA:production-workflow-admissions.json"; then
+            git show "$BASE_SHA:production-workflow-admissions.json" > "$RUNNER_TEMP/previous-production-workflow-admissions.json"
+          else
+            printf '%s\n' '{"$schema":"schemas/production-workflow-admissions.schema.json","schema_version":"openadapt.production-workflow-admissions/v1","policy_sha256":"sha256:e1444a08ce6b16736168cce027ce9d48abb2e0e246fc0cd79c0772fa8e423e11","admissions":[]}' > "$RUNNER_TEMP/previous-production-workflow-admissions.json"
+          fi
           python3 scripts/validate_production_lifecycle.py \
             --history-only \
-            --previous-admissions "$RUNNER_TEMP/previous-production-lifecycle-admissions.json"
+            --previous-admissions "$RUNNER_TEMP/previous-production-lifecycle-admissions.json" \
+            --previous-workflow-admissions "$RUNNER_TEMP/previous-production-workflow-admissions.json"
       - name: Validate product truth and links
         run: python3 scripts/check_profile.py
       - name: Bind every published benchmark figure to its artifact

REPOSITORY_LIFECYCLE.md

@@ -65,6 +65,15 @@ expired, revoked, or mismatched qualification. A new workflow version or a
 change to a bound input requires a new qualification. A Production runtime must
 accept only these exact qualified workflow identities.
 
+A Production run needs an active workflow admission for one exact sealed
+bundle. Product release admissions do not qualify a workflow. The dedicated
+append-only ledger is
+[`production-workflow-admissions.json`](production-workflow-admissions.json).
+It lists signed `qualification-admission` objects. The current rows are
+remote-safe-synthetic tutorial bundles (`0.0.0-synthetic`). They do not set
+MockMed `production_acceptance`. The GitHub admission issuer stays inactive
+until consumers pin the exact verifier.
+
 Each target has an append-only hash chain of signed Production release
 identities. The highest sequence is current. A new release cannot reuse an old
 release identity. If the latest admission expires or is revoked, Production is

production-workflow-admissions.json

@@ -0,0 +1,133 @@
+{
+  "$schema": "schemas/production-workflow-admissions.schema.json",
+  "schema_version": "openadapt.production-workflow-admissions/v1",
+  "policy_sha256": "sha256:e1444a08ce6b16736168cce027ce9d48abb2e0e246fc0cd79c0772fa8e423e11",
+  "admissions": [
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "6e28818a94e057cae99dcc2c76d02b9137f87076",
+      "registry_revision": 2,
+      "registry_head_sha256": "sha256:12508b788997dcd841b7b116b512dd7c1e129192988a947952bcc2e2e8572a24",
+      "registry_entry_sha256": "sha256:813040c698d3b04d39825502635f5337bcf08d5885142363fe9b16a76b4667a6",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/dc/dcdb32a762aca87fbb1a7c9df5d346403b167ec5850d35fe47fd64d942684a04.qualification-admission.json",
+      "object_sha256": "sha256:dcdb32a762aca87fbb1a7c9df5d346403b167ec5850d35fe47fd64d942684a04",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:a480d62a9c2aa5ed6061d3b0140cf908024b23e90b7535bb3c09e9da6f748e90",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:ccaf41e33bb4c59fbb182af2c4cd184a3aa56dad23fd31b698ad979b94990739",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/34/34b8a1157cfd72d820cac0c49e3679959174083ccbb83cf0371925cc72226fdb.qualification-admission.json",
+      "object_sha256": "sha256:34b8a1157cfd72d820cac0c49e3679959174083ccbb83cf0371925cc72226fdb",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:4ae2e17a493b2b18b757423ab729dc1aa3729e21e3cf42e1ea22e9d98d5f8ac7",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:e9f906e705881b4f3b6f3a626198dd34d76e321be94d28f9ab0efdd137853b70",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/4b/4b505945969b876b8af9d9686416214d191b78cd3472e313ce3776a5e550efcb.qualification-admission.json",
+      "object_sha256": "sha256:4b505945969b876b8af9d9686416214d191b78cd3472e313ce3776a5e550efcb",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:55105879b0f9f324e3b08d8fd5b9b44f51d5c5930afcc8d43bf737ae8167f263",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:6d8c2fd866016a461ca6ce10c12f27b8e0396944460435905e3c40af00dec0f1",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/71/71b69bc2339fd3202eae960c2cd7fbef4963e6736fa5ad6e24d7879e53f8da7d.qualification-admission.json",
+      "object_sha256": "sha256:71b69bc2339fd3202eae960c2cd7fbef4963e6736fa5ad6e24d7879e53f8da7d",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:e2dca14ae8df88852b1b776bf8e6ab2bed2b01e1111046147dbbb544e73617ed",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:03d1aeb88a512ba4fb60c9ecb43ebaf247002b3982cebabe271b70fe9f235c1f",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/46/46e925b68d8313880756b38fcbf17d8bf02af1fb5b57692e63cc972479088a3e.qualification-admission.json",
+      "object_sha256": "sha256:46e925b68d8313880756b38fcbf17d8bf02af1fb5b57692e63cc972479088a3e",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:927f92c7f001997829efbbe7deade5e5c54ccf04dc5ebff4790de84a2d8ae76b",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:bb4facd0a1b5b8d939f82508f411cba4702c1c3bbeb5da100bd4811e8c53ffc7",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/71/71470304eb13b4d9aed64c0d26c9d31d1bb8a4eb463955be0b720e1aed523e61.qualification-admission.json",
+      "object_sha256": "sha256:71470304eb13b4d9aed64c0d26c9d31d1bb8a4eb463955be0b720e1aed523e61",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:a0288638b7f2061011d4a5fb1833f61663180dc40c3970bde54ce76864e52e31",
+      "subject_sha256": null
+    },
+    {
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "registry_revision": 3,
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_entry_sha256": "sha256:84fa3b4bdbd34ce18d9ca9fb49e4e8f13e01b4a3030115ad9dbcb8537c4bfa1f",
+      "kind": "qualification-admission",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_path": "production-evidence/objects/sha256/6d/6d0c77a7831103e1959406513f7b53fca7fb0709c872056461dc8b6be06a784e.qualification-admission.json",
+      "object_sha256": "sha256:6d0c77a7831103e1959406513f7b53fca7fb0709c872056461dc8b6be06a784e",
+      "size_bytes": 8055,
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "semantic_identity_sha256": "sha256:920214d3bb3378e5cdab572c67ac04d13de3b2f19f99ade5e73f7e394282776e",
+      "subject_sha256": null
+    }
+  ]
+}

schemas/production-workflow-admissions.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/OpenAdaptAI/.github/blob/main/schemas/production-workflow-admissions.schema.json",
+  "title": "OpenAdapt Production workflow admissions",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema_version", "policy_sha256", "admissions"],
+  "properties": {
+    "$schema": {"const": "schemas/production-workflow-admissions.schema.json"},
+    "schema_version": {"const": "openadapt.production-workflow-admissions/v1"},
+    "policy_sha256": {"$ref": "#/$defs/digest"},
+    "admissions": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/qualificationAdmissionReference"}
+    }
+  },
+  "$defs": {
+    "digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "qualificationAdmissionReference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema_version",
+        "repository",
+        "repository_id",
+        "repository_owner_id",
+        "registry_source_commit",
+        "registry_revision",
+        "registry_head_sha256",
+        "registry_entry_sha256",
+        "kind",
+        "object_schema_version",
+        "object_path",
+        "object_sha256",
+        "size_bytes",
+        "object_media_type",
+        "semantic_identity_sha256",
+        "subject_sha256"
+      ],
+      "properties": {
+        "schema_version": {"const": "openadapt.production-evidence-object-reference/v2"},
+        "repository": {"const": "OpenAdaptAI/.github"},
+        "repository_id": {"const": "858454062"},
+        "repository_owner_id": {"const": "132681217"},
+        "registry_source_commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        "registry_revision": {"type": "integer", "minimum": 1},
+        "registry_head_sha256": {"$ref": "#/$defs/digest"},
+        "registry_entry_sha256": {"$ref": "#/$defs/digest"},
+        "kind": {"const": "qualification-admission"},
+        "object_schema_version": {"const": "openadapt.qualification-admission/v4"},
+        "object_path": {
+          "type": "string",
+          "pattern": "^production-evidence/objects/sha256/[0-9a-f]{2}/[0-9a-f]{64}\\.qualification-admission\\.json$"
+        },
+        "object_sha256": {"$ref": "#/$defs/digest"},
+        "size_bytes": {"type": "integer", "minimum": 1},
+        "object_media_type": {
+          "const": "application/vnd.openadapt.qualification-admission+json;version=4"
+        },
+        "semantic_identity_sha256": {"$ref": "#/$defs/digest"},
+        "subject_sha256": {"type": "null"}
+      }
+    }
+  }
+}