feat(authority): add fail-closed authority bootstrap

.github/workflows/ci.yml

@@ -231,7 +231,7 @@ jobs:
           name: release-permit-input
           path: permit-input
           if-no-files-found: error
-          retention-days: 1
+          retention-days: 90
 
       - name: Package immutable read-only review runtime
         run: |
@@ -377,13 +377,16 @@ jobs:
             --model "$MODEL" \
             --output "review-$PROVIDER.json"
 
-      - name: Upload commit-bound review envelope
+      - name: Upload replayable commit-bound review evidence
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: release-review-${{ matrix.provider }}
-          path: review-${{ matrix.provider }}.json
+          path: |
+            raw-${{ matrix.provider }}.txt
+            normalized-${{ matrix.provider }}.json
+            review-${{ matrix.provider }}.json
           if-no-files-found: error
-          retention-days: 14
+          retention-days: 90
 
       - name: Upload non-authoritative provider diagnostic
         if: ${{ always() }}
@@ -415,6 +418,8 @@ jobs:
       attestations: write
       contents: read
       id-token: write
+    outputs:
+      authority_generation: ${{ steps.reduce.outputs.authority_generation }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -458,6 +463,7 @@ jobs:
         run: go build -trimpath -o "$GITHUB_WORKSPACE/release-permit-verify" ./cmd/release-permit-verify
 
       - name: Reduce distinct-provider reviews
+        id: reduce
         run: |
           set -euo pipefail
           mapfile -t review_paths < <(find reviews -type f -name 'review-*.json' -print | sort)
@@ -493,6 +499,9 @@ jobs:
             exit 1
           fi
           decision="$(jq -er '.decision' release-permit.json)"
+          authority_generation="$(jq -er '.authority.generation' release-permit.json)"
+          [[ "$authority_generation" =~ ^[1-9][0-9]*$ ]]
+          echo "authority_generation=$authority_generation" >> "$GITHUB_OUTPUT"
           if [[ "$verifier_status" -eq 0 && "$decision" != "ALLOW" ]] \
             || [[ "$verifier_status" -ne 0 && "$decision" != "DENY" ]]; then
             echo "::error::Kernel verifier status and permit decision disagree"
@@ -541,7 +550,7 @@ jobs:
             release-permit.json
             release-permit.attestation.json
           if-no-files-found: error
-          retention-days: 30
+          retention-days: 90
 
       - name: Enforce ALLOW after retaining signed evidence
         run: |
@@ -551,96 +560,48 @@ jobs:
             exit 1
           fi
 
-  machine-approval:
-    name: Exact-head machine approval
+  dispatch-authority-promotion:
+    name: Dispatch immutable authority controller
     needs: permit
+    if: >-
+      github.repository == 'Mindburn-Labs/.github' &&
+      needs.permit.result == 'success' &&
+      needs.permit.outputs.authority_generation != '1'
     permissions:
-      actions: read
-      attestations: read
+      actions: write
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 5
     steps:
-      - name: Download signed ALLOW permit
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
-        with:
-          name: helm-autonomous-release-permit
-          path: approval
-
       - name: Download permit context
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: release-permit-input
-          path: approval/permit-input
-
-      - name: Checkout immutable approval broker
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          repository: Mindburn-Labs/.github
-          ref: ${{ github.workflow_sha }}
-          persist-credentials: false
-          path: policy
+          path: permit-input
 
-      - name: Checkout pinned Kernel verifier
+      - name: Checkout exact reviewed target tree
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          repository: Mindburn-Labs/helm-ai-kernel
-          ref: 83cc3eeb1cf512bed44b560254b11a342cee5b15
+          ref: ${{ github.sha }}
           persist-credentials: false
-          path: kernel
-
-      - name: Set up pinned Kernel toolchain
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
-        with:
-          go-version-file: kernel/core/go.mod
-
-      - name: Build source-owned permit verifier
-        working-directory: kernel/core
-        run: go build -trimpath -o "$GITHUB_WORKSPACE/release-permit-verify" ./cmd/release-permit-verify
-
-      - name: Mint isolated approval-only App token
-        id: approver-token
-        # At this exact action SHA, action.yml defines client-id and deprecates app-id.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.HELM_AUTHORITY_APPROVER_CLIENT_ID }}
-          private-key: ${{ secrets.HELM_AUTHORITY_APPROVER_PRIVATE_KEY }}
-          owner: Mindburn-Labs
-          repositories: ${{ github.event.repository.name }}
-          permission-pull-requests: write
-
-      - name: Bind exact approval App identity
-        env:
-          APP_SLUG: ${{ steps.approver-token.outputs.app-slug }}
-          INSTALLATION_ID: ${{ steps.approver-token.outputs.installation-id }}
-        run: |
-          set -euo pipefail
-          test "$APP_SLUG" = "helm-authority-approver"
-          test "$INSTALLATION_ID" = "146576964"
+          path: target
 
-      - name: Approve only the exact signed head
+      - name: Dispatch only a strict next-generation authority tree
         env:
           GH_TOKEN: ${{ github.token }}
-          HELM_AUTHORITY_APPROVER_TOKEN: ${{ steps.approver-token.outputs.token }}
+          PARENT_GENERATION: ${{ needs.permit.outputs.authority_generation }}
         run: |
           set -euo pipefail
-          python3 policy/scripts/submit_machine_approval.py \
-            --permit approval/release-permit.json \
-            --permit-bundle approval/release-permit.attestation.json \
-            --trusted-context approval/permit-input/context.json \
-            --kernel-verifier "$GITHUB_WORKSPACE/release-permit-verify" \
-            --repository "$GITHUB_REPOSITORY" \
-            --pull-request "${{ github.event.pull_request.number }}" \
-            --head-sha "${{ github.event.pull_request.head.sha }}" \
-            --workflow-sha "${{ github.workflow_sha }}" \
-            --approver-app-slug "${{ steps.approver-token.outputs.app-slug }}" \
-            --approver-installation-id "${{ steps.approver-token.outputs.installation-id }}" \
-            --output approval/machine-approval.json
-
-      - name: Retain approval receipt
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: helm-machine-approval
-          path: approval/machine-approval.json
-          if-no-files-found: error
-          retention-days: 30
+          [[ "$PARENT_GENERATION" =~ ^[1-9][0-9]*$ ]]
+          test "$(jq -er '.authority.generation' permit-input/context.json)" = "$PARENT_GENERATION"
+          candidate_generation="$(jq -er '.generation' target/config/autonomous-release-authority.json)"
+          [[ "$candidate_generation" =~ ^[1-9][0-9]*$ ]]
+          if [[ "$candidate_generation" -ne $((PARENT_GENERATION + 1)) ]]; then
+            echo "Target tree does not advance the authority generation; no promotion dispatch is needed."
+            exit 0
+          fi
+          gh api --method POST \
+            repos/Mindburn-Labs/.github/actions/workflows/promote-authority.yml/dispatches \
+            -f ref=authority/control-v1 \
+            -f "inputs[permit_run_id]=$GITHUB_RUN_ID" \
+            -f "inputs[permit_run_attempt]=$GITHUB_RUN_ATTEMPT"