Close weekly lock acquisition preflight findings

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/pert_weekly_period_lock_acquisition.yml

@@ -1,8 +1,6 @@
 name: PERT Weekly Period Lock Acquisition Preflight
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
   workflow_dispatch:
 
 permissions:

docs/weekly_period_lock_acquisition_preflight.md

@@ -4,6 +4,11 @@ This isolated workflow is a test-only proof of same-run GitHub Actions artifact
 acquisition. It is not the RSS/source production pipeline and does not publish
 producer output.
 
+The workflow is intentionally `workflow_dispatch`-only. A maintainer must
+select the exact PR head for the initial run; this keeps `actions:read` away
+from untrusted `pull_request` code. The one allowed rerun remains the same
+workflow run and therefore retains the original `github.run_id`.
+
 - Attempt 1 builds one deterministic representative `pert.weekly.period_lock.v1`
   lock and one immutable input snapshot. The period and snapshot are fixed
   fixture values; no wall-clock fallback is allowed.

scripts/period_lock_acquisition_preflight.py

@@ -104,6 +104,21 @@ def _fixture_snapshot(lock_payload: dict[str, object]) -> dict[str, object]:
     }
 
 
+def _fixture_manifest(run_id: str, artifact_name: str, lock_bytes: bytes, snapshot_bytes: bytes) -> dict[str, object]:
+    return {
+        "bundle_version": BUNDLE_VERSION,
+        "artifact_name": artifact_name,
+        "source_run_id": run_id,
+        "source_attempt": 1,
+        "lock_version": LOCK_VERSION,
+        "snapshot_version": SNAPSHOT_VERSION,
+        "files": [
+            {"name": "input_snapshot.json", "sha256": _sha256(snapshot_bytes)},
+            {"name": "period_lock.json", "sha256": _sha256(lock_bytes)},
+        ],
+    }
+
+
 def _assert_empty_output_dir(output_dir: Path) -> None:
     if output_dir.is_symlink() or not output_dir.is_dir():
         raise ValueError("period_lock_output_dir_invalid")
@@ -126,18 +141,7 @@ def build_bundle(output_dir: Path, run_id: str, artifact_name: str | None = None
     lock_bytes = serialize_period_lock(lock)
     snapshot = _fixture_snapshot(lock_payload)
     snapshot_bytes = _canonical_json(snapshot, "period_lock_snapshot_invalid")
-    manifest = {
-        "bundle_version": BUNDLE_VERSION,
-        "artifact_name": expected_name,
-        "source_run_id": run_id,
-        "source_attempt": 1,
-        "lock_version": LOCK_VERSION,
-        "snapshot_version": SNAPSHOT_VERSION,
-        "files": [
-            {"name": "input_snapshot.json", "sha256": _sha256(snapshot_bytes)},
-            {"name": "period_lock.json", "sha256": _sha256(lock_bytes)},
-        ],
-    }
+    manifest = _fixture_manifest(run_id, expected_name, lock_bytes, snapshot_bytes)
     manifest_bytes = _canonical_json(manifest, "period_lock_manifest_invalid")
     payloads = {
         "period_lock.json": lock_bytes,
@@ -189,6 +193,12 @@ def verify_bundle(output_dir: Path, expected_run_id: str, expected_artifact: str
     expected_snapshot = _fixture_snapshot(_fixture_lock_payload(expected_run_id))
     if snapshot != expected_snapshot:
         raise ValueError("period_lock_snapshot_mismatch")
+    expected_manifest_bytes = _canonical_json(
+        _fixture_manifest(expected_run_id, expected_artifact, payloads["period_lock.json"], payloads["input_snapshot.json"]),
+        "period_lock_manifest_invalid",
+    )
+    if payloads["bundle_manifest.json"] != expected_manifest_bytes:
+        raise ValueError("period_lock_manifest_mismatch")
     manifest = _parse_canonical_json(payloads["bundle_manifest.json"], "period_lock_manifest_invalid")
     if set(manifest) != {"bundle_version", "artifact_name", "source_run_id", "source_attempt", "lock_version", "snapshot_version", "files"}:
         raise ValueError("period_lock_manifest_invalid")

tests/test_period_lock_acquisition_preflight.py

@@ -74,11 +74,27 @@ def test_verify_rejects_missing_multiple_or_wrong_attempt(tmp_path: Path) -> Non
         verify_bundle(wrong_attempt_dir, "29399816773", expected_artifact_name("29399816773"))
 
 
+@pytest.mark.parametrize("mutation", ["reorder", "duplicate"])
+def test_verify_rejects_manifest_record_mutation(tmp_path: Path, mutation: str) -> None:
+    build_bundle(tmp_path, "29399816773")
+    manifest_path = tmp_path / "bundle_manifest.json"
+    manifest = json.loads(manifest_path.read_bytes())
+    if mutation == "reorder":
+        manifest["files"] = list(reversed(manifest["files"]))
+    else:
+        manifest["files"].append(manifest["files"][0])
+    manifest_path.write_bytes(json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode())
+    with pytest.raises(ValueError, match="period_lock_manifest_mismatch"):
+        verify_bundle(tmp_path, "29399816773", expected_artifact_name("29399816773"))
+
+
 def test_workflow_isolated_and_minimally_permissioned() -> None:
     workflow = Path(".github/workflows/pert_weekly_period_lock_acquisition.yml").read_text(encoding="utf-8")
     assert "actions: read" in workflow
     assert "contents: read" in workflow
     assert "artifact-metadata: write" in workflow
+    assert "workflow_dispatch:" in workflow
+    assert "pull_request:" not in workflow
     assert "contents: write" not in workflow
     assert "id-token:" not in workflow
     assert "secrets." not in workflow