From ee33533a2895d39cfb3f064c5c1fac834246975c Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 24 Aug 2026 09:52:14 +0500
Subject: [PATCH] fix(release): preserve the monotonic sequence ledger

---
 .github/workflows/release-bundle.yml          | 6 +++++-
 CHANGELOG.md                                  | 3 +++
 core/releasebuilder/workflow_contract_test.go | 4 ++++
 docs/runbooks/release-lifecycle.md            | 5 +++++
 4 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-bundle.yml b/.github/workflows/release-bundle.yml
index c32c0c2..1f3e57f 100644
--- a/.github/workflows/release-bundle.yml
+++ b/.github/workflows/release-bundle.yml
@@ -16,6 +16,10 @@ on:
           - canary
           - stable
           - frozen
+      release_sequence:
+        description: "Monotonic sequence greater than every previously accepted GDS release"
+        required: true
+        type: number
       minimum_cli_version:
         description: "Minimum compatible GDS CLI SemVer"
         required: true
@@ -66,7 +70,7 @@ jobs:
     env:
       GOTOOLCHAIN: go1.26.5
       VERSION: ${{ inputs.version }}
-      RELEASE_SEQUENCE: ${{ github.run_number }}
+      RELEASE_SEQUENCE: ${{ inputs.release_sequence }}
       CHANNEL: ${{ inputs.channel }}
       MINIMUM_CLI_VERSION: ${{ inputs.minimum_cli_version }}
       HARNESS_EVIDENCE_BUNDLE_BASE64: ${{ inputs.harness_evidence_bundle_base64 }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04b0d9d..48bba1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,9 @@ Versioning.
   tool-managed interpreter.
 - The declared `gds-drakkars` plugin now has its canonical source manifest, so
   full and release validation cannot silently stop at a redirected JSON result.
+- Release sequence is an explicit monotonic dispatch input rather than the
+  repository-local workflow run number, preserving the accepted sequence ledger
+  across the public-authority migration.
 
 ## [0.1.1] - 2026-08-16
 
diff --git a/core/releasebuilder/workflow_contract_test.go b/core/releasebuilder/workflow_contract_test.go
index 08d9ebd..cba60c1 100644
--- a/core/releasebuilder/workflow_contract_test.go
+++ b/core/releasebuilder/workflow_contract_test.go
@@ -96,11 +96,15 @@ func TestHostedReleaseWorkflowUsesOutputOutsideSourceRoot(t *testing.T) {
 		`HARNESS_EVIDENCE_TRUST_POLICY_DIGEST: ${{ vars.HARNESS_EVIDENCE_TRUST_POLICY_DIGEST }}`,
 		`stable/frozen requires signed active-five harness evidence`,
 		`--harness-evidence-directory $EVIDENCE_INPUT_ROOT/records`,
+		`RELEASE_SEQUENCE: ${{ inputs.release_sequence }}`,
 	} {
 		if !strings.Contains(content, required) {
 			t.Fatalf("hosted workflow is missing output contract %q", required)
 		}
 	}
+	if strings.Contains(content, "RELEASE_SEQUENCE: ${{ github.run_number }}") {
+		t.Fatal("release sequence regressed to repository-local workflow run numbering")
+	}
 	if strings.Contains(content, `$GITHUB_WORKSPACE/$RELEASE_DIRECTORY`) {
 		t.Fatal("hosted workflow still writes release output beneath the source root")
 	}
diff --git a/docs/runbooks/release-lifecycle.md b/docs/runbooks/release-lifecycle.md
index e829dcf..cc99c84 100644
--- a/docs/runbooks/release-lifecycle.md
+++ b/docs/runbooks/release-lifecycle.md
@@ -36,6 +36,11 @@ proven:
 - the repository visibility and active GitHub plan support artifact
   attestations.
 
+The dispatch must provide an explicit `release_sequence` greater than every
+sequence already accepted in the consumer ledger. Repository transfer or
+republication never resets that ledger, and `github.run_number` is local to one
+workflow lineage, so it is not a release sequence.
+
 The whole release chain runs on GitHub-hosted runners. The consumer
 does not constrain the runner environment: `gh attestation verify` binds the
 attestation to this repository, this reusable-workflow path, this source commit