Gate full CI behind explicit approval

.github/actions/build-evidence-bundle/action.yml

@@ -1,6 +1,9 @@
 name: Build evidence bundle
 description: Stage deterministic evidence artifacts and archive the final bundle.
 inputs:
+  commit_sha:
+    description: Exact commit SHA recorded in every evidence artifact.
+    required: true
   workflow_name:
     description: Workflow name recorded in the evidence summary.
     required: true
@@ -19,6 +22,12 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Validate evidence commit provenance
+      shell: bash
+      env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
+      run: test -n "${COMMIT_SHA}"
+
     - name: Prepare evidence inputs
       shell: bash
       run: |
@@ -48,6 +57,7 @@ runs:
     - name: Build suite summary JSON
       shell: bash
       env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
         WORKFLOW_NAME: ${{ inputs.workflow_name }}
         TAG_VALUE: ${{ inputs.tag }}
         INCLUDE_SDK_SUITE: ${{ inputs.include_sdk_suite }}
@@ -69,7 +79,7 @@ runs:
         include_sdk_suite = os.environ["INCLUDE_SDK_SUITE"].lower() == "true"
         workflow_name = os.environ["WORKFLOW_NAME"]
         tag = os.environ.get("TAG_VALUE", "")
-        commit = os.environ["GITHUB_SHA"]
+        commit = os.environ["COMMIT_SHA"]
 
         suite_summary = {
           "commit_sha": commit,
@@ -158,10 +168,12 @@ runs:
 
     - name: Build interop evidence summary
       shell: bash
+      env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
       run: |
         set -euo pipefail
         python3 tools/ci/build_interop_summary.py \
-          --commit-sha "${GITHUB_SHA}" \
+          --commit-sha "${COMMIT_SHA}" \
           --out-dir artifacts/evidence \
           --suite-rust artifacts/evidence/suite-run-rust.json \
           --suite-ts artifacts/evidence/suite-run-ts.json \
@@ -212,7 +224,9 @@ runs:
 
     - name: Archive evidence
       shell: bash
+      env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
       run: |
         set -euo pipefail
         cd artifacts
-        zip -r "evidence-${GITHUB_SHA}.zip" evidence
+        zip -r "evidence-${COMMIT_SHA}.zip" evidence

.github/actions/python-policy-checks/action.yml

@@ -5,7 +5,7 @@ inputs:
     description: Run the main ruleset drift check for main.
     required: false
     default: "false"
-  gh_token:
+  ruleset_token:
     description: Token used by the main ruleset drift check.
     required: false
     default: ""
@@ -16,7 +16,7 @@ inputs:
   main_ruleset_contexts:
     description: Comma-separated required status contexts.
     required: false
-    default: python-tooling,rust-core,evidence-bundle,capid-csprng-audit
+    default: CI gate
 runs:
   using: composite
   steps:
@@ -57,10 +57,14 @@ runs:
       shell: bash
       run: python3 tools/ci/check_codeowners_coverage.py
 
-    - name: Check Dependabot automerge policy consistency
+    - name: Check Dependabot update policy consistency
       shell: bash
       run: python3 tools/ci/check_dependabot_policy.py
 
+    - name: Check public CI economy policy
+      shell: bash
+      run: python3 tools/ci/check_ci_economy_policy.py
+
     - name: Check golden image publication policy
       shell: bash
       run: python3 tools/ci/check_golden_images_policy.py
@@ -153,11 +157,18 @@ runs:
       shell: bash
       run: python3 tools/ci/check_sdk_ai_boundary.py
 
+    - name: Require main ruleset drift token (main)
+      if: inputs.run_main_ruleset_drift == 'true' && inputs.ruleset_token == ''
+      shell: bash
+      run: |
+        echo "RULESET_DRIFT_ERR_TOKEN_MISSING: ruleset drift is mandatory on main." >&2
+        exit 1
+
     - name: Check main ruleset drift (main)
-      if: inputs.run_main_ruleset_drift == 'true' && inputs.gh_token != ''
+      if: inputs.run_main_ruleset_drift == 'true' && inputs.ruleset_token != ''
       shell: bash
       env:
-        GH_TOKEN: ${{ inputs.gh_token }}
+        GH_TOKEN: ${{ inputs.ruleset_token }}
       run: |
         set -euo pipefail
         python3 tools/ci/check_branch_protection_drift.py \
@@ -173,6 +184,18 @@ runs:
           --expected-ruleset-name "main protection" \
           --expected-merge-methods "merge,squash,rebase"
 
+    - name: Check full CI environment drift (main)
+      if: inputs.run_main_ruleset_drift == 'true' && inputs.ruleset_token != ''
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.ruleset_token }}
+      run: |
+        set -euo pipefail
+        python3 tools/ci/check_full_ci_environment.py \
+          --repo "${GITHUB_REPOSITORY}" \
+          --environment full-ci \
+          --expected-reviewer "${GITHUB_REPOSITORY_OWNER}"
+
     - name: Ensure no macOS metadata files
       shell: bash
       run: |

.github/actions/rust-core-verification/action.yml

@@ -1,13 +1,22 @@
 name: Rust core verification
 description: Run the Rust reference implementation tests and conformance suite.
 inputs:
+  commit_sha:
+    description: Exact commit SHA recorded in the Rust suite summary.
+    required: true
   build_wasm:
     description: Build the wasm target after the Rust suite.
     required: false
     default: "false"
 runs:
   using: composite
   steps:
+    - name: Validate Rust evidence commit provenance
+      shell: bash
+      env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
+      run: test -n "${COMMIT_SHA}"
+
     - name: Set up Rust toolchain
       uses: ./.github/actions/setup-rust-toolchain
 
@@ -28,11 +37,13 @@ runs:
 
     - name: Rust strict conformance suite
       shell: bash
+      env:
+        COMMIT_SHA: ${{ inputs.commit_sha }}
       run: |
         set -euo pipefail
         python3 tools/ci/run_runner_suite.py \
           --vectors-root conformance/vectors \
-          --commit-sha "${GITHUB_SHA}" \
+          --commit-sha "${COMMIT_SHA}" \
           --out artifacts/rust-suite-summary.json \
           --runner-cmd core/rust/target/debug/grain-runner run --strict --vector
 

.github/dependabot.yml

@@ -3,29 +3,49 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    rebase-strategy: "disabled"
+    open-pull-requests-limit: 2
+    groups:
+      routine-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
     labels:
       - "dependencies"
       - "ci"
 
   - package-ecosystem: "cargo"
     directory: "/core/rust"
     schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    rebase-strategy: "disabled"
+    open-pull-requests-limit: 2
+    groups:
+      routine-cargo-patches:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
     labels:
       - "dependencies"
       - "rust"
 
   - package-ecosystem: "npm"
     directory: "/runner/typescript"
     schedule:
-      interval: "weekly"
-    rebase-strategy: "auto"
-    open-pull-requests-limit: 5
+      interval: "monthly"
+    rebase-strategy: "disabled"
+    open-pull-requests-limit: 2
+    groups:
+      routine-npm:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
     labels:
       - "dependencies"
       - "typescript"

.github/pull_request_template.md

@@ -45,3 +45,4 @@ If this PR touches any of: encoding / CID / COSE / ledger / E2E / manifest / lim
 - [ ] NES and CDDL are consistent (no drift)
 - [ ] docs/llm updated as needed, including `DOC_SYNC` for contract changes
 - [ ] Rationale documented (ADR or spec rationale)
+- [ ] If the workflow requested full verification, a maintainer approved the protected `full-ci` environment after the final commit