[echoomegaprime]

Independent CertForge release-gate integration — draft, source-only

Exact source baseline: PR #61 at c95dd7d2a971ea26d827382a4f1d5ec96fa327d6 (its parent stack includes PR #49's queue recovery). New integration head: 9417dc5a06159291384d11f569a2ffdb5b15c108.

This draft changes exactly .github/workflows/ci.yml. It ports the previously hosted-tested workflow bytes from draft PR #46 at b36ac97788f14b0d7fb3935f29f0208d82ad18c1 (source blob dadb8efe9431bde7770f592e34a8617738044fe2). The new branch was created directly from the exact PR #61 commit; no protected branch or previous PR head was changed.

• Preserve full deterministic pytest, compilation, P1, P6, P7 and existing artifact collection.
• Check out and verify the pull-request head SHA, not an implicit merge SHA, for the CI and CodeQL jobs.
• Pin checkout, setup-python, artifact upload and CodeQL actions to the same immutable upstream revisions previously hosted-tested in PR ci: run full exact-source verification and CodeQL #46.
• Give only the CodeQL job security-events: write plus its required read permissions; no elevated repository writes or production deployment.
• Emit checks and evidence bound to the verified exact source SHA.

Previous independent evidence: Hosted PR #46 workflow run 42493875408 completed both CI and CodeQL jobs successfully on its own source. This evidence does not certify this new head: new exact-SHA hosted CI and CodeQL results must be read back. Review the source identity/ref logic for same-repo versus fork pull requests; do not treat fork cases as independently proven.

Required independent gates: PR #61's recovery safety tests and PR #49's behavior still require maintainer/security review and production certification. PR #60 ancestry reconciliation and PR #52 two-phase policy are separate pending approvals. No deployed CertForge service, SQLite data, runner signing trust, HAMMER attestation, Swarm PR #16 or protected branch changed. Production status remains HOLD / NOT_READY.

Do not merge, promote, retarget certification, or invoke a paid 40-seat run without all independent approvals, exact-SHA CodeQL, signed-worker capacity, approved reversible release window and independently signed production evidence.

[echoomegaprime]

Independent exact-source readback (2026-11-12 UTC), still DRAFT / NOT_DEPLOYED:

• PR ci: exact-head CodeQL gate for reviewed PR61 recovery stack (draft) #62 new exact head 9417dc5a06159291384d11f569a2ffdb5b15c108, base PR fix(subscriber): preserve execution ownership during historical orphan recovery #61 c95dd7d2a971ea26d827382a4f1d5ec96fa327d6; GitHub compare confirms one changed file .github/workflows/ci.yml (48 additions, 4 deletions). Installed workflow blob dadb8efe9431bde7770f592e34a8617738044fe2 exactly equals the workflow from PR ci: run full exact-source verification and CodeQL #46 with previously hosted-verified CI+CodeQL.
• NEW GitHub Actions run #43270650624: CodeQL job 131365969305 completed successfully; independently read GitHub Advanced Security CodeQL analysis check 131366831515, also completed successfully, both bound to exact PR head SHA.
• At this readback the full deterministic CI job 131365969442 is still running P1 verification. Do not claim whole-workflow success until terminal readback. Release Sentinel 131366130865 is neutral, summary Pending checks: CI, CodeQL (it evaluated before completion); independent status re-evaluation is required, never a fabricated green check.
• This new check does not give PR fix(subscriber): combine transaction rollback and exhausted dispatch recovery (#40 #41) #49, PR fix(subscriber): preserve execution ownership during historical orphan recovery #61, or production CodeQL success retroactively. For any change to a candidate SHA, repeat exact-head CI, CodeQL, reviews, independent certification and release checks.

Fresh read-only FORGE production marker and service environment identify d8ad9fd881365801354b78a758632d2a31ab6828; the actual production SQLite has 7 QUEUED/FAILED/BOUND orphans, 8 separate CANCELLED/PENDING/BOUND reservations, and 3 active runner enrollments (2 for org-echo-sovereign), but no fresh authenticated heartbeat since 2026-07-26. No production data, service, source or trust root was altered.

Hold for independent maintainer/security approval, completed CI, Sentinel re-evaluation, approved CodeQL acceptance, #60 ancestry merge and #52 policy decision, genuine signed-runner recovery and fresh HAMMER-signed production E2E. Do not merge/promote on this comment.

[echoomegaprime]

Independent exact-head CI closure — 2026-11-12 18:31 UTC.

• Draft PR ci: exact-head CodeQL gate for reviewed PR61 recovery stack (draft) #62 head 9417dc5a06159291384d11f569a2ffdb5b15c108, directly stacked on PR fix(subscriber): preserve execution ownership during historical orphan recovery #61 c95dd7d2a971ea26d827382a4f1d5ec96fa327d6; no head changes observed.
• Hosted workflow #43270650624 is now completed/success; both CI (job 131365969442) and CodeQL (job 131365969305) completed/success for this source. This closes the earlier pending-CI uncertainty on this SHA only; it does not retroactively give fix(subscriber): combine transaction rollback and exhausted dispatch recovery (#40 #41) #49/fix(subscriber): preserve execution ownership during historical orphan recovery #61 CodeQL results, prove zero alerts, or confer production certification.
• GitHub returns zero submitted independent PR reviews, draft state, and no protected merge. Release Sentinel/policy acceptance and production E2E acceptance are not established.
• Follow-up from source review on fix(subscriber): preserve execution ownership during historical orphan recovery #61: expired owned CLAIMED dispatches mark ownership-review but clear dispatcher claim/lease fields; maintainer must assess durable nonsecret custody and add corresponding negative tests before promotion (see latest fix(subscriber): preserve execution ownership during historical orphan recovery #61 comment).
• FORGE deployed release marker still d8ad9fd881365801354b78a758632d2a31ab6828; read-only production DB still has 7 historical QUEUED/FAILED/BOUND, 8 separate CANCELLED/PENDING/BOUND, and 0 fresh authenticated worker heartbeats. No merge, deployment, restart, database mutation, signing or paid full-40 execution. HOLD until independent reviews/security sign-off, reconciled ancestry, genuine signed runners and exact-target production readiness.