fix(operability): reject impossible control-plane SLI counts

.github/workflows/control-plane-sli-receipt-quality-ci.yml

@@ -0,0 +1,71 @@
+name: Control Plane SLI Receipt Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/control-plane-sli-receipt-quality-ci.yml"
+      - "scripts/ci/control_plane_sli_receipt.py"
+      - "tests/test_control_plane_sli_receipt.py"
+      - "tests/test_control_plane_sli_receipt_quality_workflow_contract.py"
+      - "docs/doctoring/control-plane-sli-receipts.md"
+      - "AGENTS.md"
+      - "ARCHITECTURE.md"
+      - "CLAUDE.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: control-plane-sli-receipt-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  exact-head-quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install hash-locked repository quality tooling
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run focused SLI receipt tests with complete branch coverage
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage erase
+          python -m coverage run --branch --source=scripts.ci.control_plane_sli_receipt \
+            -m pytest tests/test_control_plane_sli_receipt.py -q
+          python -m coverage report --show-missing --fail-under=100
+
+      - name: Enforce public docstrings and compilation
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          python -m interrogate --fail-under 100 --ignore-init-method \
+            scripts/ci/control_plane_sli_receipt.py
+          python -m compileall -q \
+            scripts/ci/control_plane_sli_receipt.py \
+            tests/test_control_plane_sli_receipt.py \
+            tests/test_control_plane_sli_receipt_quality_workflow_contract.py
+
+      - name: Run complete central test suite
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: python -m pytest tests -q
+
+      - name: Verify clean patch
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: git diff --check

AGENTS.md

@@ -7,4 +7,7 @@ Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
 OriginWeave hourly NVIDIA NIM repair is a thin caller at minute 10. See [`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md).
 nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md).
+
+Control-plane SLI receipts are local, finite, and read-only; they are not merge or writer authority. See [`docs/doctoring/control-plane-sli-receipts.md`](docs/doctoring/control-plane-sli-receipts.md).
+
 The materialization contract is also covered by [`docs/doctoring/exact-artifact-sbom-attestation.md`](docs/doctoring/exact-artifact-sbom-attestation.md).

ARCHITECTURE.md

@@ -39,6 +39,14 @@ only established scheduler credentials, and grants job-scoped
 only established scheduler credentials, and grants job-scoped
 `id-token: write`. The reusable engine stays product-neutral.
 
+## Control-plane SLI receipts
+
+`scripts/ci/control_plane_sli_receipt.py` turns a local finite evidence
+document into one `cwl.control-plane-sli/v1` receipt. The collector does
+not query GitHub or acquire mutation authority. Named wait reasons and
+acceptance debt are operator evidence only. Follow-through cannot exceed
+intermediate events, and exhausted retries require at least one attempt.
+
 ## Hourly NVIDIA NIM repair gate
 
 ```mermaid
@@ -147,5 +155,7 @@ trusted `uv` exporter is downloaded from the literal GitHub Releases URL for
   — current increment's repair-worker decision and APA 7th citations.
 - [`docs/doctoring/fast-mlsirm-hourly-review-caller.md`](docs/doctoring/fast-mlsirm-hourly-review-caller.md)
   — product-specific psychometric repair heartbeat and scientific gates.
+
+
 - [`docs/doctoring/exact-artifact-sbom-attestation.md`](docs/doctoring/exact-artifact-sbom-attestation.md)
   — current increment's attestation decision and APA 7th citations.

CHANGELOG.md

@@ -11,6 +11,8 @@ Semantic Versioning where the repository publishes a release.
 - Added an hourly organization commercial-readiness coordinator that discovers writable repositories, honors enabled dedicated writer leases and fully paginated live writer runs, refetches exact repository/workflow/run/PR state before dispatch, rotates bounded review-repair and opt-in NVIDIA OpenCode product-development targets, fails nonzero on fleet-wide inspection or dispatch outages, retains three-day JSON receipts, and keeps the existing 15-minute merge scheduler authoritative.
 - Added a dedicated Quarantine Sandbox Runtime hourly caller at minute 14 that targets protected `develop`, dispatches at most one exact-head repair, applies a two-hour same-head retry floor, preserves non-cancelling single-flight execution, and maps only the established scheduler credentials with job-scoped OIDC.
 - Added a dedicated OriginWeave hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `main` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials.
+- Added a bounded read-only control-plane SLI receipt builder that consumes a finite local evidence document and emits canonical `cwl.control-plane-sli/v1` JSON without GitHub queries or mutation authority.
+- Rejected impossible control-plane SLI follow-through and zero-attempt exhaustion counts, and pinned the exact-head quality workflow to every receipt ADR and contract surface.
 - Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate.
 - Added an organization-owned reusable exact-artifact SBOM attestation boundary that validates inert six-file wheel/sdist evidence, binds CycloneDX 1.7 predicates to exact SHA-256 subjects, signs through least-privilege GitHub artifact attestations, and exports online and offline verification bundles.
 - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence.

CLAUDE.md

@@ -121,6 +121,8 @@ repeatable compile command.
 - **Product hourly callers** stay thin. Do not hard-code OriginWeave, naruon, or Keyverse
   into `pr-review-fix-scheduler.yml`. The model credential remains `NVIDIA_NIM_API_KEY`
   on the worker, never `COPILOT_GITHUB_TOKEN`.
+- **Control-plane SLI receipts** (`scripts/ci/control_plane_sli_receipt.py`) are local, finite, and
+  read-only. They are operator evidence, not merge or writer authority.
 - **`pull_request_target` trust boundary.** The required review workflows run the *base branch's*
   trusted scripts. A PR that edits the trusted review workflows can fail its own checks until the
   base branch catches up; a same-head manual `workflow_dispatch` Strix run may supply review evidence

docs/doctoring/control-plane-sli-receipts.md

@@ -0,0 +1,77 @@
+# Bounded control-plane SLI receipts
+
+## Decision
+
+`scripts/ci/control_plane_sli_receipt.py` builds one canonical
+`cwl.control-plane-sli/v1` receipt from a local, finite-cardinality evidence
+document. The builder does not query GitHub, interpret reviews, or acquire
+mutation authority. Unknown fields, duplicate JSON members, non-finite
+numbers, unbounded arrays, impossible recovery counts, follow-through that
+exceeds intermediate events, exhausted retries with zero attempts, and
+out-of-order or future timestamps fail closed.
+
+Receipts are operator evidence: they tell a buyer whether the org control
+plane is executable now, deferred for a named wait reason, or carrying
+operational-acceptance debt. They are not merge authority.
+
+To emit a receipt, write one finite local evidence JSON, then run
+`python scripts/ci/control_plane_sli_receipt.py --input evidence.json --now
+<UTC-Z>`. If the command raises `ValueError`, repair the evidence document.
+Do not treat a printed receipt as merge permission.
+
+## Why the boundary exists
+
+A commercial operator cannot see queue health from GitHub check rollups
+alone. Waiting on review or Checks is not a coding stop, but the wait must
+be named and aged. An unbounded or authority-bearing collector would turn
+that observability surface into a second control plane.
+
+CWE-807 (reliance on untrusted inputs in a security decision) is the
+rejection reason for treating a receipt as merge or writer authority
+(MITRE, 2026). Timestamps are canonical whole-second UTC RFC 3339 values
+ending in `Z` (Internet Engineering Task Force, 2002). Service-level
+indicators remain descriptive measurements of named wait and recovery
+classes, not control-plane commands (Beyer et al., 2016; International
+Organization for Standardization, 2023).
+
+## Trust-boundary sequence
+
+```mermaid
+flowchart LR
+  A["Local finite evidence JSON"] --> B["Strict load: no NaN, no duplicate keys"]
+  B --> C["Field, regex, and cardinality guards"]
+  C --> D["Age, retry, transition, redirection aggregates"]
+  D --> E["Canonical cwl.control-plane-sli/v1 JSON"]
+```
+
+Each arrow is fail-closed. A later stage does not repair an earlier
+rejection.
+
+## Verification contract
+
+`tests/test_control_plane_sli_receipt.py` exercises a two-repository fixture,
+strict JSON boundaries, impossible premature-stop recovery counts,
+follow-through that exceeds intermediate events, exhausted retries with
+zero attempts, and timestamp canonicalization.
+`tests/test_control_plane_sli_receipt_quality_workflow_contract.py` pins the
+exact-head quality workflow to every receipt surface, including ADR files.
+The permanent quality workflow runs that suite with 100% branch coverage,
+interrogate, compileall, and the full central test suite on the exact
+pull-request head.
+
+## References
+
+Beyer, B., Jones, C., Petoff, J., & Murphy, N. R. (Eds.). (2016). *Site
+reliability engineering: How Google runs production systems*. O'Reilly
+Media. https://sre.google/sre-book/service-level-objectives/
+
+International Organization for Standardization. (2023). *Systems and
+software engineering — Systems and software Quality Requirements and
+Evaluation (SQuaRE) — Product quality model* (ISO/IEC 25010:2023).
+https://www.iso.org/standard/78176.html
+
+Internet Engineering Task Force. (2002). *Date and time on the Internet:
+Timestamps* (RFC 3339). https://www.rfc-editor.org/rfc/rfc3339
+
+MITRE. (2026). *CWE-807: Reliance on untrusted inputs in a security
+decision*. https://cwe.mitre.org/data/definitions/807.html

requirements-pip-audit-ci-hashes.txt

@@ -213,9 +213,9 @@ packaging==26.2 \
     # via
     #   pip-audit
     #   pip-requirements-parser
-pip==26.1.2 \
-    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
-    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+pip==26.2.1 \
+    --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
+    --hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f
     # via pip-api
 pip-api==0.0.34 \
     --hash=sha256:8b2d7d7c37f2447373aa2cf8b1f60a2f2b27a84e1e9e0294a3f6ef10eb3ba6bb \