Extract and test catalog publication logic; add PR quality gates

[ksanrse]

Current gap

Package Index publication logic is embedded almost entirely inside manually dispatched workflow YAML, including a large inline Node program and hard-coded first-party application versions/replacement IDs. The repository has no pull-request CI, reusable local validator, fixture tests, or hook configuration.

This makes security-critical catalogue behaviour difficult to review and means many failures are discovered only during a production publication run.

Scope

• Move catalog construction, package inspection, replacement handling, hash/size calculation, timestamp/sequence validation, signing input preparation, and envelope verification into versioned scripts/modules.
• Add fixture-based tests that run without network access or production secrets.
• Add a local dry-run using fixture packages and an ephemeral signing key.
• Add PR CI for unit/fixture tests, actionlint, shell checks, permissions review, and deterministic output snapshots.
• Add lightweight pre-commit hooks for workflow/scripts/metadata changes; CI remains authoritative.
• Replace hard-coded app release versions with the reviewed multi-repository release BOM tracked in makekosmos/cortex#4.
• Keep workflow inputs immutable: full commit SHA, monotonic sequence, bounded timestamps, exact release artifact hashes.
• Verify downloaded package manifests, IDs, Engine API compatibility, archive contents, hashes, and signatures before catalog construction.
• Preserve least-privilege workflow permissions and ensure temporary key files are removed on every exit path.

Acceptance criteria

• Publication workflows orchestrate tested scripts instead of containing the core catalog algorithm inline.
• Pull requests can reproduce catalog output from fixtures without GitHub tokens or signing secrets.
• Tests cover duplicate/replaced IDs, invalid manifests, incompatible Engine API ranges, bad hashes/sizes, invalid timestamps, non-monotonic sequence, existing release, and signature/envelope tampering.
• First-party package versions come from an immutable reviewed BOM rather than workflow source edits.
• Actions/shell syntax and workflow permissions are validated in CI.
• Production publication verifies every input before exposing/using the signing key and leaves no key file behind.
• README documents dry-run, production publication, rollback, and provenance verification.

[ksanrse]

Reviewable PR opened: #2 — workflow permission/action pin checks and publication-script syntax gate. Extraction/fixtures/BOM/dry-run remain open.

[ksanrse]

Implemented and pushed commit 5b909f9 on main. Summary: catalog construction, archive ZIP/manifest/hash/size checks, BOM/replacement validation moved to scripts/publish-catalog.mjs; signing split after existing-release preflight; key-file trap cleanup; Cortex envelope verification; fixture tests, shell/workflow checks, pre-commit hook, rollback/provenance docs. Evidence: node --test scripts/*.test.mjs (20 passed); check-workflow-contract passed; check-workflow-shell passed; validate-release-bom passed; dry-run passed with ephemeral Ed25519 and no production secret/release; git diff --check passed. Open production gates: hosted CI actionlint; live source/release ref and archive verification; production secret/environment reviewer approval. Real signing/release publication intentionally not run.

[ksanrse]

Follow-up: final pushed HEAD is 1f5e24b (origin/main), a fast-forward on 5b909f9. It removes the hard-coded sequence from the local reviewed-BOM validator; all evidence and checks in the previous comment remain valid.

[ksanrse]

Follow-up Store realignment: reviewed release/bom.v1.json now pins source.store.commit=7d185a52ad1eb444f197f2d664af2cdb96738add and catalog.store_sequence=13; catalog publication sequence remains 12. Pushed commit cc1361c on main. Added regression anchor test. Evidence: node --test scripts/*.test.mjs (21 passed), check-workflow-contract passed, check-workflow-shell passed, validate-release-bom passed, dry-run passed with ephemeral Ed25519/no production secret or release, git diff --check passed. Production gate remains open: Store catalog envelope/sequence authorization and live Store commit verification must be reviewed before production publication; no signing/release was run.

[ksanrse]

Security follow-up pushed: b7f0223 on main. P1 fixes: no-secret preflight now checks exact release tags (refs/tags), source commit anchors, unused target release, and downloads/verifies previous catalog envelope bytes/signatures/pinned public key before any secret-bearing step; signing remains isolated. ZIP policy is fail-closed for entry count, compressed/uncompressed limits and ratio, traversal/absolute/backslash/ADS/device/case collisions, directories/symlinks/special files, safe entrypoint/icon paths, unexpected binaries/files, license metadata, and Windows x86_64 PE workers. Adversarial tests cover envelope tamper/wrong key/missing envelope and archive attacks. Evidence: node --test scripts/*.test.mjs (23 passed), check-workflow-contract passed, check-workflow-shell passed, validate-release-bom passed, dry-run passed (ephemeral Ed25519 only), git diff --check passed. Open gates: Store sequence 13 envelope/commit authorization and live previous release verification remain reviewer/production gates; actionlint hosted CI and production environment/reviewer approval remain required. No Cortex changes, production signing, or release publication.

[ksanrse]

Final P1 follow-up pushed: bf145ed on main (fast-forward). No-secret preflight now performs exact git ls-remote --exit-code refs/tags/catalog- and handles status 2=absent, 0=reject existing, other=fail closed before any secret-bearing step. ZIP policy rejects encrypted general-purpose bit 0 and DOS reparse external-attribute bit 0x400; adversarial fixtures cover both. Evidence: node --test scripts/*.test.mjs (23 passed), check-workflow-contract passed, check-workflow-shell passed, validate-release-bom passed, dry-run passed, git diff --check passed. No production signing/release or Cortex changes. Open gates remain Store sequence 13 stale-envelope/commit authorization, live previous release validation, hosted actionlint, and production environment/reviewer approval.

[ksanrse]

Hosted-CI follow-up verified. Commit 11e6eec is on origin/main and keeps publish-catalog tests self-contained via repo-local scripts/test-zip-utils.mjs (no sibling Cortex dependency). Isolated clean clone with no sibling cortex passed: node --test scripts/*.test.mjs (23 passed), check-workflow-contract, check-workflow-shell, validate-release-bom, dry-run, and git diff --check. Hosted Package Index quality run is green: https://github.com/makekosmos/package-index/actions/runs/33332693042 (success). No production signing/release; Store sequence 13 stale-envelope/authorization remains an open production gate.

[ksanrse]

Enforcement evidence (2026-08-31):

• local-ai-runtimes#4 merged as 1db5b02ca913b7f00a9e02e99062483efa941dfc; main run 33391948533 is green. main now strictly requires GitHub Actions context validate (app 15368).
• package-index#5 merged as bf40159feefa27fb9da279c62575fbe045dbfad1; main run 33391949114 is green. main now strictly requires GitHub Actions context quality (app 15368).
• Both required jobs run on every pull request. Protection enforces admins, linear history and resolved conversations, and denies force-pushes/deletions. Independent approval is not required while the organisation has one member; required CI is the explicit compensating gate.
• docs#25 recorded the live state and merged as c620beab6d04e81b4f23d5322c5182e5ea80f7d6; docs main is green in Governance 33392529411 and Documentation quality 33392529359.

The repository-specific audit issues remain open for their production/runtime acceptance gates. store and desktop remain explicitly unprotected. The core#36 source-move hold is unchanged; no source was moved and no umbrella issue is closed.

[ksanrse]

Quality-contract evidence refresh (2026-08-31):

• Store main now requires strict GitHub Actions check quality (app 15368) with admin enforcement, linear history, conversation resolution, and force-push/deletion denial. Current run 33331693112 remains red on the signing-envelope exception; protection is fail-closed, not a waiver.
• local-ai-runtimes PR ci-always-report-required-check #5 merged as 1f41f900565ee0dec1df1ac9fc168aa8be6a480f; main run 33401545479 passed. Bun 1.3.14 is pinned, clean install activates repository-owned hooks, pre-push runs bun run check, and CI retains binary rejection, secret scan, deterministic dry-run, and actionlint.
• package-index PR governance-install-package-index-hooks #6 merged as 7e2098f6e407a4566f03d9342eee64dd42c7e507; main run 33401757551 passed. Clean install activates repository-owned hooks, pre-push runs the aggregate signature gate, and CI retains secret scan/actionlint plus workflow, BOM, syntax, fixture, and dry-run checks.
• Docs PR #29 merged as 0eaf1c0740dbe4a46997091ffa7f3089b7769261; main runs 33401388325 and 33401388278 passed. Docs PR #30 merged as 2bcfd23; main runs 33402151292 and 33402151305 passed.

The umbrella and repository audit issues remain open for the documented production, signing, dependency-access, private-branch-protection, and overlapping implementation gates.