Install the Ground Control Phase E workflow

[Brad-Edwards]

Summary

Readiness for #1352 and PR #1378 required .github/workflows/ground-control-phase-e.yml on dev. Merged PR #1379 installed the guarded workflow; PR #1381 was closed as superseded.

This is the bounded workflow-install portion of #1377; the package migration and doctor acceptance criteria remain on that issue.

Acceptance criteria

• Install the Phase E workflow for exact grndctl@1.2.1 with pinned action commits. Keep workflow-level permissions read-only and grant issues: write only to the guarded finalization job.
• Trigger only after merged pull requests to main or dev, or an explicit maintainer repair dispatch.
• Preserve immutable merged-revision reads and read-only checkout credentials; limit write permission to issues.
• Parse and inspect the workflow, run targeted repository policy checks and pre-commit, and pass hosted checks.
• Document the bootstrap dependency and its resolution: readiness required this workflow on dev, and merged PR docs: define external inject semantics and install delivery finalization #1379 supplied it.

Requirements

None. Repository workflow setup only; no product requirement or semantic contract change.

[Brad-Edwards]

🛠️ Picked up by /quickfix - driver codex, branch 1380-install-phase-e-workflow, 2026-09-22T06:24:39.914Z.

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at c3a9154b9be85f4cf60688df9c384385baae03cd
• Outcome: already_current
• Published feature head: 3de32482a9124eba69d7592108fc586248cdc2ff
• Synchronized tree: 6ce72a82de30c22f703c96fae5f9f10b48e6b5a1

[Brad-Edwards]

Execution obligation PHASE-E-PERMISSION-BOUNDARY — Opened

Category: security
Observed state: The official grndctl 1.2.1 Phase E workflow parses and passes targeted file-local checks, but hosted fast-feedback rejects its required issues: write permission on a pull_request trigger.
Impact: Bootstrap PR #1381 is draft and not ready to merge. Relaxing permissions without a reviewed, precisely constrained trust boundary would weaken the repository's PR security policy.
Current obligation: Review and implement the GOV-913 policy treatment for the official pinned post-merge finalizer, with negative tests preserving rejection of unmerged PRs, arbitrary commands, broader permissions and untrusted checkouts; rerun targeted checks, review and CI before requesting merge.

Evidence

• chore: superseded Phase E workflow installation #1381
• https://github.com/OpenRAE/rae/actions/runs/35694817551/job/106639258765
• tools/tooling_artifact_policy_actions.py:_permission_failures rejects any write permission whenever the job is classified as untrusted.
• docs/requirements/GOV-913/requirement.md traces the native workflow permission boundary to this checker.

[Brad-Edwards]

Execution obligation PHASE-E-PERMISSION-BOUNDARY — Escalated

Category: security
Observed state: Installing the official workflow exposed a governed permission-policy decision; the bootstrap is no longer a settled requirement-free quickfix.
Impact: Current policy blocks installation, which in turn blocks readiness for #1352.
Current obligation: Resolve the permission boundary through a reviewed GOV-913 implementation before merging the workflow.

Evidence

• chore: superseded Phase E workflow installation #1381
• https://github.com/OpenRAE/rae/actions/runs/35694817551/job/106639258765

Pause class: significant_security_decision
Decision request: Authorize /implement 1380 to review and implement a narrowly bounded permission exception for pinned post-merge finalization; leave general pull-request write restrictions intact.

This obligation remains open while the decision is pending.

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
• Outcome: merged_conflicts_resolved
• Published feature head: e862559f9905c6ffa4ac3de0c1257df369332fdc
• Synchronized tree: 63a20e671b9ae704aa047660fec356272c494289

[Brad-Edwards]

Execution obligation PHASE-E-PERMISSION-BOUNDARY — Resolved

Category: security
Observed state: Merged PR #1379 installed the Phase E workflow and its guarded permission policy on dev; redundant PR #1381 is closed.
Impact: The missing-workflow and permission-policy block recorded for this issue is resolved.
Current obligation: Keep Phase E issue writes limited to the guarded merged-delivery finalization job or explicit maintainer dispatch, with read-only workflow defaults and pinned execution inputs.

Evidence

• docs: define external inject semantics and install delivery finalization #1379
• https://github.com/OpenRAE/rae/blob/ddba5049a0f851a0906792e1e61a1917033e2f6e/.github/workflows/ground-control-phase-e.yml
• https://github.com/OpenRAE/rae/blob/ddba5049a0f851a0906792e1e61a1917033e2f6e/implementations/python/tests/test_issue_1313_workflow_policy.py

Disposition: fix
Corrective action: PR #1379 installed the Phase E workflow with job-scoped issues: write, an exact merged-delivery guard, read-only checkout credentials, a narrowly scoped policy allowance, and negative workflow-policy tests.

Verification

• PR docs: define external inject semantics and install delivery finalization #1379 is merged into dev and all its required hosted checks passed.
• The merged workflow gives issues: write only to finalize; workflow defaults remain read-only.
• The workflow-policy tests reject broader write permissions, unchecked triggers, missing merged guards, and repository secrets.