Restore exact repository inputs in protected ABI checks

.github/workflows/abi-staging-merge-gate.yml

@@ -250,6 +250,29 @@ jobs:
           persist-credentials: false
           path: abi-staging-exact-head
 
+      - name: Materialize exact musl repository input as inert data
+        run: |
+          set -euo pipefail
+          # WHY: transport authority comes only from the protected checkout
+          musl_row=$(git -C abi-staging-exact-head ls-tree HEAD -- libc/musl)
+          [[ $musl_row =~ ^160000[[:space:]]commit[[:space:]][0-9a-f]{40}[[:space:]]libc/musl$ ]]
+          musl_sha=$(awk '{ print $3 }' <<<"$musl_row")
+          [[ $musl_sha =~ ^[0-9a-f]{40}$ ]]
+
+          musl_url=$(git config -f abi-staging-authority/.gitmodules --get submodule.musl.url)
+          [[ $musl_url == https://github.com/ifduyue/musl.git ]]
+          [[ -d abi-staging-exact-head/libc/musl && ! -L abi-staging-exact-head/libc/musl ]]
+          [[ -z $(find abi-staging-exact-head/libc/musl -mindepth 1 -maxdepth 1 -print -quit) ]]
+
+          git -C abi-staging-exact-head/libc/musl init --quiet
+          git -C abi-staging-exact-head/libc/musl remote add origin "$musl_url"
+          env -u GH_TOKEN -u GITHUB_TOKEN -u ACTIONS_RUNTIME_TOKEN \
+            git -C abi-staging-exact-head/libc/musl \
+              fetch --no-tags --depth=1 origin "$musl_sha"
+          git -C abi-staging-exact-head/libc/musl checkout --quiet --detach "$musl_sha"
+          [[ $(git -C abi-staging-exact-head/libc/musl rev-parse HEAD) == "$musl_sha" ]]
+          [[ -z $(git -C abi-staging-exact-head status --porcelain=v1 --untracked-files=all) ]]
+
       - name: Set up declared protected build tools
         uses: ./abi-staging-authority/.github/actions/setup-nix
 

.github/workflows/abi-staging-pr-check.yml

@@ -166,6 +166,28 @@ jobs:
           persist-credentials: false
           path: exact-head
 
+      - name: Materialize exact musl repository input as inert data
+        run: |
+          set -euo pipefail
+          # WHY: transport authority comes only from the protected checkout
+          musl_row=$(git -C exact-head ls-tree HEAD -- libc/musl)
+          [[ $musl_row =~ ^160000[[:space:]]commit[[:space:]][0-9a-f]{40}[[:space:]]libc/musl$ ]]
+          musl_sha=$(awk '{ print $3 }' <<<"$musl_row")
+          [[ $musl_sha =~ ^[0-9a-f]{40}$ ]]
+
+          musl_url=$(git config -f authority/.gitmodules --get submodule.musl.url)
+          [[ $musl_url == https://github.com/ifduyue/musl.git ]]
+          [[ -d exact-head/libc/musl && ! -L exact-head/libc/musl ]]
+          [[ -z $(find exact-head/libc/musl -mindepth 1 -maxdepth 1 -print -quit) ]]
+
+          git -C exact-head/libc/musl init --quiet
+          git -C exact-head/libc/musl remote add origin "$musl_url"
+          env -u GH_TOKEN -u GITHUB_TOKEN git -C exact-head/libc/musl \
+            fetch --no-tags --depth=1 origin "$musl_sha"
+          git -C exact-head/libc/musl checkout --quiet --detach "$musl_sha"
+          [[ $(git -C exact-head/libc/musl rev-parse HEAD) == "$musl_sha" ]]
+          [[ -z $(git -C exact-head status --porcelain=v1 --untracked-files=all) ]]
+
       - name: Set up declared protected build tools
         uses: ./authority/.github/actions/setup-nix
 

.github/workflows/abi-staging-request-feed.yml

@@ -356,6 +356,25 @@ jobs:
             env -u GH_TOKEN -u GITHUB_TOKEN git -C "$exact_head_data" fetch --no-tags origin "$head" "$PROTECTED_SHA"
             env -u GH_TOKEN -u GITHUB_TOKEN git -C "$exact_head_data" checkout -q --detach "$head"
 
+            # WHY: transport authority comes only from the protected checkout
+            musl_row=$(git -C "$exact_head_data" ls-tree HEAD -- libc/musl)
+            [[ $musl_row =~ ^160000[[:space:]]commit[[:space:]][0-9a-f]{40}[[:space:]]libc/musl$ ]]
+            musl_sha=$(awk '{ print $3 }' <<<"$musl_row")
+            [[ $musl_sha =~ ^[0-9a-f]{40}$ ]]
+
+            musl_url=$(git config -f authority/.gitmodules --get submodule.musl.url)
+            [[ $musl_url == https://github.com/ifduyue/musl.git ]]
+            [[ -d "$exact_head_data/libc/musl" && ! -L "$exact_head_data/libc/musl" ]]
+            [[ -z $(find "$exact_head_data/libc/musl" -mindepth 1 -maxdepth 1 -print -quit) ]]
+
+            git -C "$exact_head_data/libc/musl" init --quiet
+            git -C "$exact_head_data/libc/musl" remote add origin "$musl_url"
+            env -u GH_TOKEN -u GITHUB_TOKEN git -C "$exact_head_data/libc/musl" \
+              fetch --no-tags --depth=1 origin "$musl_sha"
+            git -C "$exact_head_data/libc/musl" checkout --quiet --detach "$musl_sha"
+            [[ $(git -C "$exact_head_data/libc/musl" rev-parse HEAD) == "$musl_sha" ]]
+            [[ -z $(git -C "$exact_head_data" status --porcelain=v1 --untracked-files=all) ]]
+
             report="$evidence/reports/$pr-structural-report.json"
             "$authority_xtask" abi-staging structural-report validate \
               --exact-head-root "$exact_head_data" \

scripts/check-abi-staging-pr-check-workflow.rb

@@ -158,6 +158,30 @@ def check_workflow(workflow)
         candidate_checkout.dig("with", "ref") == "${{ matrix.subject.head }}" &&
         candidate_checkout.dig("with", "path") == "exact-head",
         "collector does not check out the exact PR head as inert data")
+  candidate_checkout_index = collect.fetch("steps").index(candidate_checkout)
+  musl_materialization = named_step(
+    collect, "Materialize exact musl repository input as inert data"
+  )
+  musl_materialization_index = collect.fetch("steps").index(musl_materialization)
+  collection_index = collect.fetch("steps").index(
+    named_step(collect, "Collect and project bounded public facts")
+  )
+  musl_source = musl_materialization.fetch("run")
+  check(candidate_checkout_index < musl_materialization_index &&
+        musl_materialization_index < collection_index &&
+        musl_source.include?("git -C exact-head ls-tree HEAD -- libc/musl") &&
+        musl_source.include?("authority/.gitmodules") &&
+        musl_source.include?("^160000[[:space:]]commit") &&
+        musl_source.include?("env -u GH_TOKEN -u GITHUB_TOKEN git") &&
+        musl_source.match?(/fetch\s+--no-tags\s+--depth=1/) &&
+        musl_source.include?("status --porcelain=v1 --untracked-files=all") &&
+        !musl_source.include?("exact-head/.gitmodules") &&
+        !musl_source.match?(/git\s+(?:-C\s+exact-head\s+)?submodule\s+update/),
+        "collector does not materialize the exact musl gitlink from protected transport")
+  check(collect_source.lines.count { |line|
+          line.strip == '--out "$output/projection.json"'
+        } == 1,
+        "collector must pass the projection output exactly once")
   upload = named_step(collect, "Transfer bounded inert projection")
   check(upload.fetch("uses").start_with?(UPLOAD) &&
         upload.dig("with", "name").to_s.include?("matrix.subject.head") &&
@@ -311,6 +335,12 @@ def check_merge_gate(workflow)
           "${{ needs.capture-current-subject.outputs.exact-head }}" &&
         gate_exact.dig("with", "path") == "abi-staging-exact-head",
         "gate does not inspect the exact PR head as inert data")
+  gate_exact_index = validate.fetch("steps").index(gate_exact)
+  gate_musl = named_step(
+    validate, "Materialize exact musl repository input as inert data"
+  )
+  gate_musl_index = validate.fetch("steps").index(gate_musl)
+  gate_musl_source = gate_musl.fetch("run")
   download_structure = named_step(
     validate, "Download exact-head structural ABI evidence"
   )
@@ -322,6 +352,20 @@ def check_merge_gate(workflow)
   provenance = named_step(
     validate, "Validate current request and locate protected Check provenance"
   )
+  provenance_index = validate.fetch("steps").index(provenance)
+  check(gate_exact_index < gate_musl_index &&
+        gate_musl_index < provenance_index &&
+        gate_musl_source.include?(
+          "git -C abi-staging-exact-head ls-tree HEAD -- libc/musl"
+        ) &&
+        gate_musl_source.include?("abi-staging-authority/.gitmodules") &&
+        gate_musl_source.include?("^160000[[:space:]]commit") &&
+        gate_musl_source.include?("env -u GH_TOKEN -u GITHUB_TOKEN") &&
+        gate_musl_source.match?(/fetch\s+--no-tags\s+--depth=1/) &&
+        gate_musl_source.include?("status --porcelain=v1 --untracked-files=all") &&
+        !gate_musl_source.include?("abi-staging-exact-head/.gitmodules") &&
+        !gate_musl_source.match?(/git\s+(?:-C\s+[^\n]+\s+)?submodule\s+update/),
+        "gate does not materialize exact musl data from protected transport")
   check(!provenance.key?("if") && provenance["continue-on-error"] != true,
         "current evidence validation must be unconditional and non-swallowing")
   provenance_source = provenance.fetch("run")
@@ -439,6 +483,39 @@ def rejected_mutation(workflow, label)
       end
       step.fetch("with")["persist-credentials"] = true
     },
+    "missing exact musl materialization" => lambda { |copy|
+      copy.dig("jobs", "collect-project", "steps").reject! do |step|
+        step["name"] == "Materialize exact musl repository input as inert data"
+      end
+    },
+    "candidate-controlled musl transport" => lambda { |copy|
+      step = copy.dig("jobs", "collect-project", "steps").find do |item|
+        item["name"] == "Materialize exact musl repository input as inert data"
+      end
+      step["run"] = step.fetch("run").gsub(
+        "authority/.gitmodules", "exact-head/.gitmodules"
+      )
+    },
+    "musl materialization after requirement derivation" => lambda { |copy|
+      steps = copy.dig("jobs", "collect-project", "steps")
+      materialization = steps.delete_at(steps.index do |step|
+        step["name"] == "Materialize exact musl repository input as inert data"
+      end)
+      collect_index = steps.index do |step|
+        step["name"] == "Collect and project bounded public facts"
+      end
+      steps.insert(collect_index + 1, materialization)
+    },
+    "duplicate projection output command" => lambda { |copy|
+      step = copy.dig("jobs", "collect-project", "steps").find do |item|
+        item["name"] == "Collect and project bounded public facts"
+      end
+      step["run"] = step.fetch("run").sub(
+        '  --out "$output/projection.json"',
+        "  --out \"$output/projection.json\"\n" \
+          '  --out "$output/projection.json"'
+      )
+    },
     "collector target validation after use" => lambda { |copy|
       step = copy.dig("jobs", "collect-project", "steps").find do |item|
         item["run"]&.include?("host_target=$(cd authority &&")
@@ -532,6 +609,30 @@ def rejected_mutation(workflow, label)
         "name" => "Candidate execution", "run" => "bash abi-staging-exact-head/build.sh"
       }
     },
+    "merge gate missing exact musl materialization" => lambda { |copy|
+      copy.dig("jobs", "validate-current-evidence", "steps").reject! do |step|
+        step["name"] == "Materialize exact musl repository input as inert data"
+      end
+    },
+    "merge gate candidate-controlled musl transport" => lambda { |copy|
+      step = copy.dig("jobs", "validate-current-evidence", "steps").find do |item|
+        item["name"] == "Materialize exact musl repository input as inert data"
+      end
+      step["run"] = step.fetch("run").gsub(
+        "abi-staging-authority/.gitmodules",
+        "abi-staging-exact-head/.gitmodules"
+      )
+    },
+    "merge gate musl materialization after derivation" => lambda { |copy|
+      steps = copy.dig("jobs", "validate-current-evidence", "steps")
+      materialization = steps.delete_at(steps.index do |step|
+        step["name"] == "Materialize exact musl repository input as inert data"
+      end)
+      provenance_index = steps.index do |step|
+        step["name"] == "Validate current request and locate protected Check provenance"
+      end
+      steps.insert(provenance_index + 1, materialization)
+    },
     "conditional final validation" => lambda { |copy|
       step = copy.dig("jobs", "validate-current-evidence", "steps").find do |item|
         item["name"] == "Reproject and validate protected Check provenance"

scripts/check-abi-staging-request-workflow.rb

@@ -183,6 +183,22 @@ def check_workflow(workflow)
         !derive_source.include?('find "$evidence/reports"') &&
         derive_source.include?("authority_xtask"),
         "protected derivation does not revalidate inert exact-head data")
+  musl_materialization = [
+    'musl_row=$(git -C "$exact_head_data" ls-tree HEAD -- libc/musl)',
+    'musl_url=$(git config -f authority/.gitmodules --get submodule.musl.url)',
+    '[[ $musl_url == https://github.com/ifduyue/musl.git ]]',
+    'git -C "$exact_head_data/libc/musl" init --quiet',
+    'env -u GH_TOKEN -u GITHUB_TOKEN git -C "$exact_head_data/libc/musl"',
+    'fetch --no-tags --depth=1 origin "$musl_sha"',
+    'git -C "$exact_head_data/libc/musl" checkout --quiet --detach "$musl_sha"',
+    'git -C "$exact_head_data" status --porcelain=v1 --untracked-files=all'
+  ]
+  check(musl_materialization.all? { |fragment| derive_source.include?(fragment) } &&
+        !derive_source.include?("$exact_head_data/.gitmodules") &&
+        !derive_source.match?(/git\s+(?:-C\s+[^\n]+\s+)?submodule\s+update/) &&
+        derive_source.index(musl_materialization.fetch(0)) <
+          derive_source.index('"$authority_xtask" abi-staging request derive'),
+        "protected derivation does not materialize exact musl data before requirements")
   check_filtered_host_target(derive_source, "protected derivation")
   check(!derive_source.match?(%r{(?:bash|source|\.)\s+[^\n]*exact-head-data}),
         "protected derivation executes a file from the exact head")
@@ -269,6 +285,23 @@ def rejected_mutation(workflow, label)
       step = copy.dig("jobs", "derive-request", "steps").find { |item| item["run"]&.include?("structural-report validate") }
       step["run"] = step.fetch("run").gsub("structural-report validate", "echo trust-report")
     },
+    "missing exact musl materialization" => lambda { |copy|
+      step = copy.dig("jobs", "derive-request", "steps").find do |item|
+        item["run"]&.include?("request derive")
+      end
+      step["run"] = step.fetch("run").gsub(
+        'musl_row=$(git -C "$exact_head_data" ls-tree HEAD -- libc/musl)',
+        'musl_row=""'
+      )
+    },
+    "candidate-controlled musl transport" => lambda { |copy|
+      step = copy.dig("jobs", "derive-request", "steps").find do |item|
+        item["run"]&.include?("request derive")
+      end
+      step["run"] = step.fetch("run").gsub(
+        "authority/.gitmodules", '$exact_head_data/.gitmodules'
+      )
+    },
     "line-delimited path classification" => lambda { |copy|
       step = copy.dig("jobs", "derive-request", "steps").find do |item|
         item["run"]&.include?("request classify")