From 7e0a9d413fd125c6571db086909bbb5743884db5 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Thu, 16 Jul 2026 13:27:12 -0400
Subject: [PATCH] =?UTF-8?q?ci:=20dogfood=20truecopy-action=20=E2=80=94=20p?=
 =?UTF-8?q?in=20and=20verify=20our=20own=20demo=20manifest?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pins demo/clean-mcp.json into a committed truecopy.lock and gates it in
CI with askalf/truecopy-action@v1.0.1 (pinned by SHA). The gate fails
if the demo manifest drifts or a detection change re-classifies it,
until the change is consciously re-pinned — the same workflow we ask
adopters to run.
---
 .github/workflows/truecopy-gate.yml | 27 +++++++++++++++++++++++++++
 truecopy.lock                       | 22 ++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/truecopy-gate.yml
 create mode 100644 truecopy.lock

diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
new file mode 100644
index 0000000..85a5f2c
--- /dev/null
+++ b/.github/workflows/truecopy-gate.yml
@@ -0,0 +1,27 @@
+# Dogfood: this repo pins its own demo MCP manifest (demo/clean-mcp.json) in
+# truecopy.lock and gates it with the published truecopy-action. If the demo
+# manifest drifts — or a rule change re-classifies it — this fails until the
+# change is consciously re-pinned.
+name: truecopy gate
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions: read-all
+
+jobs:
+  verify:
+    name: verify pinned skills
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 20
+      - name: truecopy verify
+        uses: askalf/truecopy-action@5c6fcf00edb83ff4846206392722292d45fee227 # v1.0.1
diff --git a/truecopy.lock b/truecopy.lock
new file mode 100644
index 0000000..074662c
--- /dev/null
+++ b/truecopy.lock
@@ -0,0 +1,22 @@
+{
+  "version": 1,
+  "skills": {
+    "filesystem": {
+      "source": "demo/clean-mcp.json",
+      "kind": "mcp",
+      "hash": "a881946cef3fb45d7c78d3297070a179f4c55ba65f00a576ada922c39f4e1f57",
+      "scannedAt": "2026-07-16T17:25:56.559Z",
+      "verdict": "clean",
+      "findings": 0,
+      "detection": {
+        "engine": "redstamp",
+        "version": "0.4.1"
+      },
+      "parts": {
+        "read_file": "cfe9acc21dbc05b0b8baa751e71fe524fd8fa15578d20610fc90b8d533bd8d8f",
+        "list_directory": "ac606087a4a47e23d801beb12699d87364430677f04b6709eacbaec062156227",
+        "(manifest)": "cac4676bf307456c45dfa470fa0b350b6b305b0d3cb86ffc3b68396625261b46"
+      }
+    }
+  }
+}