fix(ci): secure and bound sandbox evidence streams

.github/workflows/materialize-sandboxed-evidence-bounds.yml

@@ -0,0 +1,117 @@
+name: Materialize focused sandbox evidence bounds
+run-name: Materialize sandbox evidence bounds at ${{ github.sha }}
+
+on:
+  push:
+    branches:
+      - fix/sandboxed-evidence-bounds-main
+    paths:
+      - .github/workflows/materialize-sandboxed-evidence-bounds.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: materialize-sandboxed-evidence-bounds
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  materialize:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github' &&
+      github.ref == 'refs/heads/fix/sandboxed-evidence-bounds-main'
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact trigger without persisted credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Extract the reviewed receipt steps as inert shell scripts
+        env:
+          RECEIPT_WORKFLOW: .github/workflows/materialize-sandboxed-evidence-receipt.yml
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          ruby -ryaml -e '
+            document = YAML.safe_load(File.read(ENV.fetch("RECEIPT_WORKFLOW")), aliases: false)
+            steps = document.fetch("jobs").fetch("materialize").fetch("steps")
+            targets = {
+              "Verify bounded setup and import immutable focused source" => "import.sh",
+              "Install exact hash-locked tooling" => "install.sh",
+              "Verify complete integrated quality contract" => "verify.sh",
+              "Build immutable verified Git commit object" => "build.sh",
+            }
+            targets.each do |name, filename|
+              matches = steps.select { |step| step["name"] == name }
+              abort("expected one receipt step named #{name.inspect}, found #{matches.length}") unless matches.length == 1
+              run = matches.first.fetch("run")
+              File.write(File.join(ENV.fetch("RUNNER_TEMP"), filename), run)
+            end
+          '
+          chmod 0700 \
+            "${RUNNER_TEMP}/import.sh" \
+            "${RUNNER_TEMP}/install.sh" \
+            "${RUNNER_TEMP}/verify.sh" \
+            "${RUNNER_TEMP}/build.sh"
+
+      - name: Import, repair, and verify the complete exact-head product tree
+        env:
+          SOURCE_SHA: 45e4929e1fc473211168b2d6360c9da2516e5341
+          EXPECTED_MAIN: f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae
+          EXPECTED_HEAD: ${{ github.sha }}
+          SOURCE_BRANCH: fix/sandboxed-evidence-bounds-main
+          API_TOKEN: ${{ github.token }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD"
+          bash "${RUNNER_TEMP}/import.sh"
+          bash "${RUNNER_TEMP}/install.sh"
+          bash "${RUNNER_TEMP}/verify.sh"
+          bash "${RUNNER_TEMP}/build.sh" | tee "${RUNNER_TEMP}/pr788-materialization-receipt.txt"
+          grep -E '^MATERIALIZATION_COMMIT_SHA=[0-9a-f]{40}$' \
+            "${RUNNER_TEMP}/pr788-materialization-receipt.txt"
+
+      - name: Publish exact-head materialization pointer
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EXPECTED_HEAD: ${{ github.sha }}
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          commit_sha="$(sed -n 's/^MATERIALIZATION_COMMIT_SHA=//p' "${RUNNER_TEMP}/pr788-materialization-receipt.txt")"
+          test "${#commit_sha}" -eq 40
+          case "$commit_sha" in (*[!0-9a-f]*) exit 1;; esac
+          body="PR788_MATERIALIZATION_PARENT_SHA=${EXPECTED_HEAD}%0APR788_MATERIALIZATION_COMMIT_SHA=${commit_sha}"
+          gh api \
+            --method POST \
+            repos/ContextualWisdomLab/.github/issues/788/comments \
+            -f "body=${body}"
+
+      - name: Upload exact-head materialization receipt
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.0
+        with:
+          name: pr788-exact-head-materialization
+          path: ${{ runner.temp }}/pr788-materialization-receipt.txt
+          if-no-files-found: error
+          retention-days: 5