Bind audit seals to exact source jobs

[jeffhuber]

Multi-lane local audit runs could leave a valid reviewer seal ambiguous at publication time because the artifact identified only the source run and attempt. This change adds the source Actions job ID to the sealed metadata, resolves it from the running lane/job/attempt on the current runner, and requires the successful seal to belong to that exact job. Independent Codex and Claude lanes can now publish from the same matrix run, while missing, duplicate same-lane, forged, stale-head, wrong-job, and wrong-attempt proofs continue to fail closed.

Validation:

• python -m pytest -q tests/test_audit_publication.py — 39 passed, 303 subtests passed
• ruff check tools/audit_publication.py src/code_mower/audit_publication.py tests/test_audit_publication.py
• git diff --check
• full python -m unittest discover -s tests exercised 4,843 tests (19 skipped); its four initial failures were all caused by the uv-created test environment lacking pip
• after installing pip in that environment, all affected tests passed: 5 lineage artifact tests plus the release identity and installed prompt-pack build tests
• hosted CI passed on Python 3.12, 3.13, and 3.14, plus wheel rehearsal, Linux/macOS containment, and Board qualification
• Code Mower published an independent Claude PASS for exact head f4713b05926fa2d6f5067583653796f2bfd9c9a6; code-mower/gate passed

Closes #1032

[gitar-bot]

Note

Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom.
Learn more

Code Review ✅ Approved

🔴 High risk

Binds audit seals to exact source Actions job IDs to resolve ambiguity in multi-lane local audit runs, enabling independent Codex and Claude lanes to publish from the same matrix run. Comprehensive test coverage confirms all seal validation scenarios pass, including missing, duplicate same-lane, forged, stale-head, wrong-job, and wrong-attempt proofs. No issues found.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Options

Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

Claude audit (merge-authority lane)

Head SHA: f4713b05926fa2d6f5067583653796f2bfd9c9a6
Verdict: PASS
Review details remain in the local audit artifact.
Publication workflow: .github/workflows/local-audit-publication.yml at ba72ac986ab3d24e1c5ace2fbcdcc9e4aed97aaa