[midiakiasat]

Purpose

Repair the current-main APPLY determinism workflow definition.

Machine-proven defect

Accepted main:

2ec7024ff5365a7f07008f6ccfd9114fd0d90414

Flagged run:

26185853188

The workflow fails before job instantiation with zero jobs.

The accepted Build artifact twice and compare digests step has shell commands, Python heredoc content, and the PY2 terminator outside the surrounding YAML run: | block.

Exact repair scope

Exactly one file changes:

.github/workflows/determinism-check.yml

The repair:

• restores the complete deterministic build body inside the YAML block scalar
• preserves the original two-build comparison algorithm
• preserves SHA-256 path/content hashing semantics
• preserves recursive artifact diff
• adds cleanup of temporary build directories
• pins actions/checkout to immutable commit 11d5960a326750d5838078e36cf38b85af677262
• preserves explicit read-only contents: read permission

It does not modify:

• CNAME
• application/package manifests
• public application surfaces
• surface-system assets
• Pages deployment workflow
• application data

Validation

• current-main zero-job failure reconfirmed
• malformed escaped run content machine-reproduced
• repaired run block has zero escaped lines
• repaired shell block passes bash -n
• local build A succeeds
• local build B succeeds
• local artifact SHA-256 hashes are identical
• recursive artifact diff succeeds
• local tracked source remains unchanged outside the intended workflow candidate
• exact changed-file count: 1
• candidate commit signed
• candidate patch SHA-256: 6a8323be66f22e62d390eedc154a788fc617407ed840f5a9ddf314699dcd966c

Governance

No direct write to main.
No merge performed.
No workflow dispatch or rerun performed.
Independent exact-head review by verifrax-systems is required.

[verifrax-systems]

Independent exact-head governance review.

Candidate head: 749cb7c
Accepted base: 2ec7024
Candidate tree: f4bf449eeb0a74891a71af93d4eaa8d9fbe2ee31
Patch SHA-256: 6a8323be66f22e62d390eedc154a788fc617407ed840f5a9ddf314699dcd966c
Scope: exactly .github/workflows/determinism-check.yml

Verified before approval:

• accepted-main determinism failure was a current-main zero-job workflow-definition defect
• candidate commit signature valid
• candidate parent exactly accepted main
• exact one-file workflow scope
• escaped shell body restored inside YAML run block
• escaped Python heredoc restored inside YAML run block
• PY2 terminator restored inside YAML run block
• repaired build step passes bash syntax validation
• local build A and B produce identical SHA-256 tree hashes
• recursive artifact comparison passes
• immutable actions/checkout pin present
• read-only contents permission preserved
• CNAME unchanged
• package manifests unchanged
• public surface unchanged
• surface-system unchanged
• Pages deployment workflow unchanged
• exact-head Surface projection validation green
• exact-head Determinism Check green
• exact-head determinism job instantiated and all steps passed
• exact-head Identity green
• all required branch-protection checks satisfied
• SPEEDKIT admission quarantine preserved
• VERIFRAX PR #345 preserved

Approval authorizes governed acceptance of this exact head only.
Accepted-main push must reproduce green determinism and all instantiated push CI.