Epic: operational hardening — wire real GitHub, CI, and registries behind the engine seams

[ronimoe]

Tracks the work to take Conductor from validated against real git to wired to real GitHub, CI, and registries. The engine (P0–P5) is built and tested; this is operational hardening, not new design. Each item is scoped to the exact code seam it replaces.

Roadmap

• Wire the verdict seam to real hermetic per-PR CI #1 — Wire the verdict seam to real hermetic per-PR CI
• Run the engine tick as a privileged GitHub Actions workflow #2 — Run the engine tick as a privileged GitHub Actions workflow
• Provision the least-privilege bot GitHub App (sole trunk writer) #3 — Provision the least-privilege bot GitHub App (sole trunk writer)
• Wire the issue oracle to real GitHub GraphQL #4 — Wire the issue oracle to real GitHub GraphQL
• Wire the release transaction to real registries, Releases, and Issues #5 — Wire the release transaction to real registries, Releases, and Issues
• Extend the hermetic gate to the test runtime (flake-soundness precondition) #6 — Extend the hermetic gate to the test runtime (flake-soundness precondition)
• Stand up a frozen registry mirror + epoch refresh policy #7 — Stand up a frozen registry mirror + epoch refresh policy
• Build the real per-language public-API differ #8 — Build the real per-language public-API differ
• Implement the provenance ledger + conductor ssot verify + attestation #9 — Implement the provenance ledger + conductor ssot verify + attestation
• Wire the cross-model advisory reviewer + required human approver #10 — Wire the cross-model advisory reviewer + required human approver
• Drive the reconciler/orchestrator from webhooks + cron; tune the write governor #11 — Drive the reconciler/orchestrator from webhooks + cron; tune the write governor
• Fleet-scale soak test + concurrency/CI-cost report #12 — Fleet-scale soak test + concurrency/CI-cost report

Themes

• Execution plane — run the tick in Actions under a bot App; webhooks + cron orchestration.
• Real seams — verdict fn → real hermetic CI; issue oracle → GraphQL; release → real registries.
• Soundness preconditions — hermetic test runtime + frozen registry mirror.
• Depth — real per-language API differ; provenance ledger + attestation; cross-model + human review.
• Proof — fleet-scale soak + honest CI-cost report.

See DESIGN.md §13 (risks) and the per-phase residuals.

[ronimoe]

Slice 1 landed (ddd23b3): the minimum to land a real PR end-to-end through Actions — #3 (App token), #2 (tick + CI workflows), #1 (CI→verdict), #6 (hermetic test runtime).

Engine-side seams (#1, #6) are implemented + unit-tested (10 new tests; full suite now 76). GitHub-side pieces (#2 workflows, #3 the App) are correct, committed artifacts that need a live repo + installed App + real Actions runs to verify end-to-end. Details + setup in tools/conductor/INTEGRATION.md. The four issues stay open pending that live validation.

[ronimoe]

#4 and #5 landed (967fe7f). The real GraphQL issue oracle + at-land recheck (#4) and the real registry/Release/Issue ports for the exactly-once release transaction (#5) are implemented and unit-tested (10 more tests; full suite now 86). Both stay open pending live validation against a real repo. With #1–#6 now wired, a labelled PR can flow issue → spec → hermetic CI verdict → linear land → verified → released, all behind injectable seams whose logic is tested; the remaining work is the live GitHub/registry plumbing + the depth items (#7–#12).

[ronimoe]

#9 and #8 landed. The two most buildable depth items are implemented and unit-tested against real git:

• Implement the provenance ledger + conductor ssot verify + attestation #9 — ssot.py provenance projection (build_ledger/trace/verify/rebuild) + attest.py + trailers.py. Adversarial pass caught a fabricated join key (would have guessed issue↔changeset from agent+sha8) and a Closes #N cardinality bug — both fixed with an authoritative change_id map threaded through changeset → plan → release journal. (16 tests)
• Build the real per-language public-API differ #8 — differs.py pluggable API-differ registry + deep Python AST differ + shelldiff.py, replacing the fail-open fold (unsupported ext → NONE) with fail-closed (→ MAJOR+UNCERTAIN). (18 tests)

Full suite now 120 conductor + 18 hermetic = 138 tests. Remaining depth items are increasingly infrastructure/live-gated: #10 (advisory reviewer + human approver — buildable core), #11 (webhook orchestration + governor tuning — partly), #7 (frozen registry mirror — infra), #12 (soak — needs a live fleet). #1–#6 still await live GitHub/App validation.

[ronimoe]

#10 landed — cross-model advisory reviewer (comment-only, fail-open) + the head-bound, agent-proof approval gate with an all-agent-CODEOWNERS deadlock guard; a NEEDS_HUMAN batch holds until a valid approval, then lands (tested end to end). 10 tests; full suite now 130 conductor + 18 hermetic = 148.

Status

Implemented + unit-tested in code: #1–#6, #8, #9, #10 (behind injectable/tested seams).

The remaining items are genuinely infrastructure- or live-gated and cannot be meaningfully built/tested in a sandbox — they need a real repo / fleet / mirror:

• Stand up a frozen registry mirror + epoch refresh policy #7 frozen registry mirror — real infra (devpi/Verdaccio/Athens/cargo-vendor).
• Drive the reconciler/orchestrator from webhooks + cron; tune the write governor #11 webhook/cron orchestration + governor tuning — the triggers + governor + reconciler already exist (slice 1); the remaining work is live-repo wiring and empirical tuning against real GitHub abuse limits.
• Fleet-scale soak test + concurrency/CI-cost report #12 fleet-scale soak — needs a live agent fleet.
• Wire the verdict seam to real hermetic per-PR CI #1–Extend the hermetic gate to the test runtime (flake-soundness precondition) #6 await one end-to-end validation on a real repo with the bot App installed.

Next concrete step is operator-side: install the bot App on a sandbox repo, set the Actions var/secret, and run the slice-1 loop — after which #1–#6 (and the live halves of #4/#5/#8/#9/#10) can be validated against real GitHub.