feat(context): add general evidence projections (#1024) #7

	name: Disconnected acceptance

	# This workflow is intentionally push-only. The acceptance harness needs a
	# privileged cgroup broker; it must never run on attacker-controlled PR code.
	# Pull-request validation in test.yml remains unprivileged and runs all acceptance
	# cases except the explicitly marked privileged probes. The pinned dependencies
	# are installed only in this trusted push workflow.

	on:
	push:
	branches: [main, master]

	permissions:
	contents: read

	concurrency:
	group: disconnected-acceptance-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	disconnected-acceptance:
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 (2026-07-16)
	with:
	persist-credentials: false
	fetch-depth: 1

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 (2025-04-24)
	with:
	python-version: "3.12"

	- name: Install pinned test dependencies
	run: \|
	python -m pip install \
	PyYAML==6.0.3 \
	coverage==7.15.3 \
	hypothesis==6.165.1 \
	jsonschema==4.26.0 \
	pytest==9.1.1 \
	tiktoken==0.14.0

	- name: Verify build artifact is in sync
	run: python scripts/build.py --check

	- name: Run privileged disconnected acceptance
	run: bash scripts/ci/run_disconnected_acceptance.sh

Navigation Menu