[Clear1nsight]

Malformed workflows could reach research branches before GitHub parsed them. This adds checksum-pinned actionlint 1.7.12, an exact-commit validator, a standalone workflow-lint job and an opt-in pre-push hook that checks every pushed non-deletion ref, including non-checked-out branches and annotated tags. The hook is documented and is not installed automatically.

The upstream planning run also exposed four selected-result navigation failures. This revision synchronizes the tooling branch with upstream main f626db5c3a3d781d8f7695038776c621651f75e1, updates the CI guide to the selected #4359 replay, and places the status history banner before the first historical checkpoint. The selected result remains conditional κ = 0.0023.

Source-preserving CI integration

Documentation changes select four registered packages. This revision reuses the authenticated historical replay adapter, source-role repairs and six regression tests from #4542, exact predecessor head af86fb28f4fe039d4bb8419850af99a6fc474587. It also corrects the adapter's fork-only publication reference to canonical upstream introduction d11655a9fd1c7eedc52e0e9720158bd17d29192a, preserving the identical manifest blob. A seventh adapter test requires the publication pin to be reachable from HEAD, so a locally cached fork object cannot hide missing upstream history.

• D8 assignment/navigation documents retain their original Git blob and SHA256 authentication as provenance; the mathematical input remains unchanged.
• The original PR3563 Conditional κ = 0.001672188119205421: improved T16 owner packing on the seven-slot k8 word #1042 verifier, tests and receipt run on the authenticated original snapshot. Its old previous-record assertion is not applied to today's selected frontier. Current navigation is checked separately by the existing status tests.
• The locale replay retains historical authentication and executes its declared checks against current documentation.
• The three-coordinate temporal package is replayed without changes.

All original invalidation paths remain declared. No frozen verifier, mathematical source, receipt, source hash or selected-result record is rewritten. No global planner bypass, assertion weakening or path-filter suppression is added.

Validation

Final repair head: ae19b6868d5981fbacdf6950a226d969e603b78d.

• All 145 workflows pass exact-commit actionlint.
• All 24 workflow-guard tests pass, including malformed workflows, wrong linter versions, exact pushed refs, annotated tags, replacement refs and local reusable actions.
• Planning/onboarding suite: 338 tests run, 327 passed and 11 native-Windows tests skipped on Linux.
• All four documentation-triggered package replays pass, including the unchanged temporal calculation and locale checks.
• All original source hashes, historical implementation/receipts and the selected record are retained.

The final-head workflow-lint run and registered-package run report hosted validation. Read outcomes at this exact head. Workflow validation and scoped package replay do not establish a new κ or a complete multiplication theorem. This remains a draft tooling contribution.

Prepared for Clear1nsight with substantial OpenAI Codex assistance. Apache-2.0.

[jwr404]

Independent review (James Reed, with Claude Code). Head ae19b6868d5981fbacdf6950a226d969e603b78d.

Verdict: the workflow-validation tooling is sound and works against today's main. The branch now has a merge conflict and one small installer robustness issue.

Checks

• Pinned checksums. All four .github/actionlint.json SHA-256 values (darwin/linux × amd64/arm64) match the official actionlint_1.7.12_checksums.txt from the rhysd/actionlint v1.7.12 release exactly.
• Installer. It verifies the checksum before extraction and extracts only the actionlint member, after an isfile() check. It writes with exclusive create ("xb", so it never follows a pre-existing symlink) and finishes with an atomic replace. I installed with it into a scratch directory and the binary ran.
• Validator against current canonical main. I ran check_workflows.py --ref upstream/main at 7c472563…. It printed Checking 146 workflows … and exited 0, so today's main is clean under the pinned linter with -shellcheck= -pyflakes=.
• Pre-push parsing. Malformed input (deadbeef x y z) is rejected with malformed pre-push object ID, exit 1. Deletions are skipped, and annotated tags are peeled via ^{commit}.
• Snapshot safety. Tree paths with .., .git or absolute components and symlink entries are refused. Repo-local actionlint.yaml ignore rules are deliberately not imported, and resource files are written as empty placeholders, so no repo code is read or executed. All of this looks right.

Issues

1. Merge conflict. git merge-tree against current main (7c472563) conflicts in docs/research/current-status.md. The branch's status-page edits date from the κ = 0.0023 era (base f626db5c…), and the selected record is now 60403/20000000. I'd drop or rebase those navigation edits; the tooling itself merges cleanly. The historical-1042-link adapter and the SOURCES.json pin updates should also be re-checked against current main, since many related PRs have merged since.
2. Stale temporary file. If an install is interrupted after creating actionlint.download, every later run fails with an uncaught FileExistsError traceback (reproduced). Exclusive create is the right security choice. A fix that keeps it is to create the temporary file with tempfile.mkstemp(dir=directory), or to unlink a pre-existing regular (non-symlink) actionlint.download first.

The opt-in hook is documented and not auto-installed, which matches AGENTS.md's no-surprise-tooling stance. Merge or close decisions are for maintainers.