Repair proof determinism workflow

[midiakiasat]

Purpose

Repair the current-main PROOF determinism workflow definition.

Machine-proven defect

Accepted main:

fe62b08746ff70eab7e000699c487fe5c19d4ddc

Flagged run:

24860174012

The accepted workflow fails before job instantiation with zero jobs.

The Build artifact twice and compare digests step contains shell commands,
Python heredoc content, and the PY2 terminator outside the surrounding
YAML run: | block.

Exact repair scope

Exactly one file changes:

.github/workflows/determinism-check.yml

The repair:

• restores the complete deterministic build body inside the YAML block scalar
• preserves the two-build proof-publication artifact comparison
• preserves SHA-256 path/content hashing semantics
• preserves recursive artifact diff
• cleans temporary build directories after validation
• pins actions/checkout to immutable commit 11d5960a326750d5838078e36cf38b85af677262
• preserves explicit read-only contents: read permission

It does not modify:

• CNAME
• package manifests
• public proof publication content
• surface-system assets
• proof data or artifacts

Validation

• current-main zero-job failure reconfirmed
• 25 escaped run-block lines machine-reproduced
• 19 column-zero escaped lines machine-reproduced
• repaired run block has zero escaped lines
• repaired shell block passes bash -n
• local proof artifact build A succeeds
• local proof artifact build B succeeds
• local artifact SHA-256 hashes are identical
• recursive artifact comparison succeeds
• no tracked content outside the intended workflow candidate changes
• exact changed-file count: 1
• candidate commit signed
• candidate patch SHA-256: 896485fce3cfdfbe566fc70bb942f3f73f831d9b998a7dd152c0beecc7e05b84

Governance

No direct write to main.
No review performed.
No merge performed.
No workflow dispatch or rerun performed.
No branch-protection mutation performed.

Independent exact-head review by verifrax-systems is required.

[verifrax-systems]

Independent exact-head governance review.

Candidate head: c51d1f9
Accepted base: fe62b08
Candidate tree: cf653a7c9a3439b0b5624d4a3fe7c2c87f744adf
Patch SHA-256: 896485fce3cfdfbe566fc70bb942f3f73f831d9b998a7dd152c0beecc7e05b84
Scope: exactly .github/workflows/determinism-check.yml

Verified before approval:

• current-main zero-job determinism workflow-definition defect proven
• candidate signature valid
• candidate parent exactly accepted main
• exact one-file workflow scope
• 25 malformed escaped run-block lines removed
• 19 column-zero escaped lines removed
• shell build body restored inside YAML run scalar
• Python heredoc restored inside YAML run scalar
• PY2 terminator restored inside YAML run scalar
• repaired build step passes bash syntax validation
• local proof publication build A and B hashes are identical
• recursive artifact comparison passes
• immutable actions/checkout pin present
• read-only contents permission preserved
• CNAME unchanged
• package manifests unchanged
• public proof publication surface unchanged
• surface-system unchanged
• Pages workflow unchanged
• exact-head determinism job instantiated and passed
• all exact-head PR workflows terminal/nonbad
• all exact-head check runs terminal/nonbad
• all required status contexts satisfied
• dismiss-stale review gate enabled
• last-push approval gate enabled
• required signatures enabled
• classic branch protection frozen
• active Main protection floor ruleset frozen
• SPEEDKIT admission quarantine preserved
• VERIFRAX PR #345 preserved

Approval authorizes governed acceptance of this exact head only.
Accepted-main push must independently reproduce green determinism and required checks.