Dev

.devcontainer/Dockerfile

@@ -1,41 +1,14 @@
-# Reviewed RAES development container.
-#
-# This file owns no version, digest, package, or platform fact. Every literal
-# below is derived from the reviewed `container-ubuntu-24.04-x86_64` host profile in
-# implementations/tooling/profiles/development-profiles.json and from
-# implementations/tooling/artifacts.lock.json; the drift gate in
-# tools/tooling_artifact_policy_container.py refuses any literal here that
-# disagrees with that authority, so edit the authority, never this file.
-#
-# The image supplies host prerequisites and maintainer conveniences only. The
-# dev-container lifecycle runs `tools.devcontainer_setup`, which acquires the
-# locked uv, CPython, and generic CLI payloads through the repository's own
-# verified installers, so no payload, checkout, credential, or reusable cache is
-# baked into a layer. Isabelle proof execution is unsupported here
-# (`proof_support: unsupported`); use the native proof host profile.
-#
-# Linux x86_64 is the one qualified platform: Ubuntu publishes immutable package
-# snapshots only for it. Every stage pins the reviewed linux/amd64 manifest, so
-# arm64 hosts such as Apple silicon run this same image under emulation instead
-# of silently substituting an unqualified native build.
-
-# The package snapshot is served only over HTTPS and the pinned base carries no
-# CA bundle. This throwaway stage obtains one from the base image's own signed
-# archive purely as TLS transport trust; none of its bytes reach the image.
-FROM --platform=linux/amd64 docker.io/library/ubuntu@sha256:a61567bd31828687156d735ea8eb01ba4e37636e225dd6a48ba94136a70d9d61 AS transport-trust
+# Optional connected development environment. The artifact lock owns the base
+# digest; this native Dockerfile owns its packages, account, and environment.
+# Signed Ubuntu repositories supply current native packages. Rebuilds are not
+# byte-reproducible and do not qualify additional host architectures.
+# The lifecycle separately verifies locked uv, Python, and CLI payloads.
+# Proof isolation and a container daemon are intentionally not supplied.
+FROM --platform=linux/amd64 docker.io/library/ubuntu@sha256:a61567bd31828687156d735ea8eb01ba4e37636e225dd6a48ba94136a70d9d61
 RUN set -eu; \
     export DEBIAN_FRONTEND=noninteractive; \
     apt-get update; \
-    apt-get install -y --no-install-recommends ca-certificates
-
-# Every installed package comes from the immutable reviewed snapshot and is
-# authenticated by the Ubuntu archive keyring inside the digest-pinned base.
-FROM --platform=linux/amd64 docker.io/library/ubuntu@sha256:a61567bd31828687156d735ea8eb01ba4e37636e225dd6a48ba94136a70d9d61
-RUN --mount=type=bind,from=transport-trust,source=/etc/ssl/certs/ca-certificates.crt,target=/run/raes-transport-ca.crt \
-    set -eu; \
-    export DEBIAN_FRONTEND=noninteractive; \
-    apt-get -o APT::Snapshot=20260912T000000Z -o Acquire::https::CAInfo=/run/raes-transport-ca.crt update; \
-    apt-get -o APT::Snapshot=20260912T000000Z -o Acquire::https::CAInfo=/run/raes-transport-ca.crt install -y --no-install-recommends \
+    apt-get install -y --no-install-recommends \
         bash-completion \
         ca-certificates \
         coreutils \
@@ -58,7 +31,7 @@ RUN --mount=type=bind,from=transport-trust,source=/etc/ssl/certs/ca-certificates
     find /var/lib/apt/lists -mindepth 1 -delete
 
 # A non-root development account owns the caches and never the mounted source.
-# The reviewed base ships a stock account at 1000; replacing it keeps the
+# The base ships a stock account at 1000; replacing it keeps the
 # development user aligned with the typical host owner of a bind-mounted
 # checkout, and dev-container clients remap it to the host owner otherwise.
 RUN set -eu; \

.gc/plan-rules.md

@@ -3,12 +3,13 @@
 Mandatory constraints the `/implement` skill applies during plan phase.
 These encode the hard rules previously in `AGENTS.md` prose.
 
-- Plans MUST run `implementations/python/.venv/bin/python tools/check_repo_policy.py`
-  before declaring completion.
-- Plans MUST run `implementations/python/.venv/bin/python tools/check_requirement_governance.py`
-  before declaring completion.
-- Plans MUST run `implementations/python/.venv/bin/python tools/verify_all.py`
-  before declaring completion.
+- Plans MUST follow `/implement`'s proportionate local verification rules:
+  run targeted tests and checks for the changed behavior locally. CI owns
+  repository-wide verification, completion, and policy suites. Preserve the
+  mandatory pre-publish hook, review, CI, SonarCloud, and readiness gates.
+- Local test and completion commands MUST remain targeted. Never select a full
+  test, integration or fuzz suite locally, even on unknown changes, source edits,
+  base synchronization or review repairs. Full verification is CI/CD only.
 - Plans MUST set `RAES_REQUIREMENT_UID` when the branch name does not
   already contain a UID such as `GOV-918`.
 - Plans MUST NOT add new authority-bearing artifacts outside `specs/`,

.github/workflows/bootstrap-qualification.yml

@@ -1,14 +1,22 @@
 name: Bootstrap qualification
 
-# The main->dev back-merge PR changes only Release Please-managed files, which
-# were qualified on the dev->main promotion; it does not trigger this (#1266).
+# Qualify changed tooling components, not unrelated application or documentation edits.
 on:
   pull_request:
     branches: [dev]
-    paths-ignore:
-      - CHANGELOG.md
-      - .release-please-manifest.json
-      - implementations/python/packages/raes/_version.py
+    paths:
+      - '.github/workflows/bootstrap-qualification.yml'
+      - '.devcontainer/**'
+      - 'implementations/tooling/**'
+      - 'implementations/python/pyproject.toml'
+      - 'implementations/python/uv.lock'
+      - 'implementations/python/tests/test_issue_1217_bootstrap_profiles.py'
+      - 'implementations/python/tests/test_issue_1219_verified_tool_installation.py'
+      - 'implementations/python/tests/test_issue_1220_isabelle_acquisition.py'
+      - 'implementations/python/tests/test_issue_1238_development_container.py'
+      - 'implementations/python/tests/test_issue_1313_workflow_policy.py'
+      - 'tools/**'
+      - 'noxfile.py'
   workflow_dispatch:
 
 permissions:
@@ -23,9 +31,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - {profile: public-ubuntu-24.04-x86_64, runner: ubuntu-24.04, target: x86_64-unknown-linux-gnu, tool_closure: public-linux-x86_64-cp314-tools, tool_requirements: implementations/tooling/python/smoke/tools-linux-x86_64-cp314.txt, project_closure: public-linux-x86_64-cp314-all-extras}
-          - {profile: public-linux-arm64, runner: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu, tool_closure: public-linux-arm64-cp314-tools, tool_requirements: implementations/tooling/python/smoke/tools-linux-arm64-cp314.txt, project_closure: public-linux-arm64-cp314-all-extras}
-          - {profile: public-macos-arm64, runner: macos-15, target: aarch64-apple-darwin, tool_closure: public-macos-arm64-cp314-tools, tool_requirements: implementations/tooling/python/smoke/tools-macos-arm64-cp314.txt, project_closure: public-macos-arm64-cp314-all-extras}
+          - {profile: public-ubuntu-24.04-x86_64, runner: ubuntu-24.04, target: x86_64-unknown-linux-gnu, project_closure: public-linux-x86_64-cp314-all-extras}
+          - {profile: public-linux-arm64, runner: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu, project_closure: public-linux-arm64-cp314-all-extras}
+          - {profile: public-macos-arm64, runner: macos-15, target: aarch64-apple-darwin, project_closure: public-macos-arm64-cp314-all-extras}
     env:
       UV_PYTHON: "3.14.7"
       UV_PYTHON_PLATFORM: ${{ matrix.target }}
@@ -41,7 +49,7 @@ jobs:
         with:
           python-version: "3.14.7"
       - name: Install exact uv payload
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           version: "0.12.4"
           enable-cache: false
@@ -54,138 +62,25 @@ jobs:
       - name: Exercise supported Python wheel and ABI closure
         if: matrix.project_closure != ''
         run: uv run --project implementations/tooling/python --frozen --no-default-groups nox -f noxfile.py -s python-compatibility
-      - name: Build the credential-free target payload kit
-        id: kit
+      - name: Exercise verified tool acquisition and reuse
         run: |
-          tool_python=(uv run --project implementations/tooling/python --frozen --no-default-groups python)
-          "${tool_python[@]}" -m tools.bootstrap_profile generic-tools
-          mkdir -p .qualification-kit/bin .qualification-kit/python .qualification-kit/.cache/raes-sdl \
-            .qualification-kit/tool-wheelhouse
-          "${tool_python[@]}" -m tools.bootstrap_profile offline-kit-fetch \
-            "${{ matrix.profile }}" .qualification-kit --artifact-id cpython-3.14 --artifact-id uv \
-            --artifact-id conftest --artifact-id gitleaks --artifact-id osv-scanner --artifact-id vale
-          cp "$(command -v uv)" .qualification-kit/bin/uv
-          "${tool_python[@]}" -m tools.bootstrap_profile offline-kit-install-python \
-            "${{ matrix.profile }}" .qualification-kit --python-artifact-id cpython-3.14
-          "${tool_python[@]}" -m tools.python_closure materialize \
-            --profile "${{ matrix.tool_closure }}" --wheelhouse .qualification-kit/tool-wheelhouse
-          "${tool_python[@]}" -m tools.python_closure manifest-show \
-            --profile "${{ matrix.tool_closure }}" > .qualification-kit/tool-wheelhouse-manifest.json
-          if [ -n "${{ matrix.project_closure }}" ]; then
-            mkdir .qualification-kit/project-wheelhouse
-            "${tool_python[@]}" -m tools.python_closure materialize \
-              --profile "${{ matrix.project_closure }}" --wheelhouse .qualification-kit/project-wheelhouse
-            "${tool_python[@]}" -m tools.python_closure manifest-show \
-              --profile "${{ matrix.project_closure }}" > .qualification-kit/wheelhouse-manifest.json
-          fi
-          "${tool_python[@]}" -m tools.bootstrap_profile offline-kit-export-tool-seeds \
-            "${{ matrix.profile }}" .cache/raes-sdl/tooling/installations \
-            .qualification-kit/.cache/raes-sdl/tooling/installations
-          "${tool_python[@]}" -m tools.bootstrap_profile offline-kit-manifest \
-            "${{ matrix.profile }}" .qualification-kit --python-artifact-id cpython-3.14 \
-            > .qualification-kit/offline-kit-manifest.json
-          manifest_sha256="$("${tool_python[@]}" -m tools.bootstrap_profile \
-            offline-kit-manifest-digest .qualification-kit/offline-kit-manifest.json)"
-          echo "manifest_sha256=${manifest_sha256}" >> "$GITHUB_OUTPUT"
-          tar -cf bootstrap-offline-kit.tar .qualification-kit
-      - name: Restore and exercise the payload kit without network fallback
-        run: |
-          for cleanup_root in \
-            .qualification-kit/.cache/raes-sdl/tooling/installations \
-            .cache/raes-sdl/tooling/installations; do
-            if [ -d "${cleanup_root}" ]; then
-              chmod -R u+w "${cleanup_root}"
-            fi
-          done
-          rm -rf .qualification-kit .cache/raes-sdl/tooling .qualification-restored \
-            implementations/python/.venv implementations/tooling/python/.venv
-          mkdir .qualification-restored
-          tar -xf bootstrap-offline-kit.tar -C .qualification-restored --strip-components=1
-          restored_root="${{ github.workspace }}/.qualification-restored"
-          restored_python="$(find "${restored_root}/python" -path '*/bin/python3.14' -print)"
-          test -n "${restored_python}"
-          export UV_PYTHON="${restored_python}"
-          export PATH="${restored_root}/bin:/usr/bin:/bin"
-          export UV_PYTHON_INSTALL_DIR="${restored_root}/python"
-          export UV_PYTHON_DOWNLOADS=never
-          export UV_OFFLINE=1
-          runtime_root="$(mktemp -d "${GITHUB_WORKSPACE}/.raes-bootstrap-runtime.XXXXXX")"
-          export UV_CACHE_DIR="${runtime_root}/uv-cache"
-          mkdir "${UV_CACHE_DIR}"
-          "${restored_python}" -m tools.python_closure bootstrap-wheelhouse-verify \
-            --profile "${{ matrix.tool_closure }}" --wheelhouse "${restored_root}/tool-wheelhouse" \
-            --manifest-snapshot "${restored_root}/tool-wheelhouse-manifest.json"
-          if [ -n "${{ matrix.project_closure }}" ]; then
-            "${restored_python}" -m tools.python_closure bootstrap-wheelhouse-verify \
-              --profile "${{ matrix.project_closure }}" --wheelhouse "${restored_root}/project-wheelhouse" \
-              --manifest-snapshot "${restored_root}/wheelhouse-manifest.json"
-          fi
-          restored_tool_environment="${runtime_root}/tool-environment"
-          "${restored_root}/bin/uv" venv --no-project --python "${restored_python}" \
-            "${restored_tool_environment}"
-          restored_tool_python="${restored_tool_environment}/bin/python"
-          "${restored_root}/bin/uv" pip install --python "${restored_tool_python}" \
-            --requirements "${{ matrix.tool_requirements }}" --require-hashes --only-binary :all: \
-            --offline --no-index --find-links "${restored_root}/tool-wheelhouse"
-          "${restored_tool_python}" -m tools.bootstrap_profile offline-kit-verify \
-            "${{ matrix.profile }}" "${restored_root}" --python-artifact-id cpython-3.14 \
-            --trusted-manifest-sha256 "${{ steps.kit.outputs.manifest_sha256 }}"
-          if [ -n "${{ matrix.project_closure }}" ]; then
-            export UV_FIND_LINKS="${restored_root}/tool-wheelhouse,${restored_root}/project-wheelhouse"
-            export UV_NO_INDEX=1
-            export RAES_PYTHON_CLOSURE_WHEELHOUSE="${restored_root}/project-wheelhouse"
-            "${restored_tool_python}" -m nox -f noxfile.py -s python-compatibility
-          else
-            "${restored_tool_python}" -c \
-              'import cryptography; from importlib.metadata import version; print(version("nox"))'
-          fi
-          "${restored_tool_python}" -m tools.bootstrap_profile record-case T02 "${{ github.sha }}" noxfile.py \
-            --artifact-id cpython-3.14 --artifact-id uv --artifact-id conftest --artifact-id gitleaks \
-            --artifact-id osv-scanner --artifact-id vale > t02-result.json
-          if [ "${{ matrix.profile }}" = public-linux-arm64 ] || [ "${{ matrix.profile }}" = public-macos-arm64 ]; then
-            "${restored_tool_python}" -m tools.bootstrap_profile record-case T12 "${{ github.sha }}" \
-              tools/bootstrap_profile.py --artifact-id cpython-3.14 --artifact-id uv --artifact-id conftest \
-              --artifact-id gitleaks --artifact-id osv-scanner --artifact-id vale > t12-result.json
-          fi
+          uv run --project implementations/tooling/python --frozen --no-default-groups python \
+            -m tools.bootstrap_profile generic-tools
       - name: Exercise maintained curl behavior
         run: |
-          uv run --project implementations/tooling/python --frozen --no-default-groups python \
-            -m tools.bootstrap_profile inspect-profile "${{ matrix.profile }}"
-          uv run --project implementations/tooling/python --frozen --no-default-groups python -m pytest -q \
-            implementations/python/tests/test_issue_1217_bootstrap_profiles.py \
+          uv run --project implementations/tooling/python --frozen --no-default-groups --group acquisition-tests python \
+            -m pytest -q implementations/python/tests/test_issue_1217_bootstrap_profiles.py \
             implementations/python/tests/test_issue_1220_isabelle_acquisition.py -m integration -k real_curl
-          uv run --project implementations/tooling/python --frozen --no-default-groups python \
-            -m tools.bootstrap_profile record-case T08 "${{ github.sha }}" \
-            implementations/python/tests/test_issue_1217_bootstrap_profiles.py > t08-result.json
       - name: Exercise verified local installation behavior
         run: >-
           uv run --project implementations/tooling/python --frozen --no-default-groups nox -f noxfile.py
           -s local-installation-qualification -- --output local-installation-qualification.json
-      - name: Record exact measured profile evidence
-        run: |
-          mkdir .qualification-evidence-root
-          tar -xf bootstrap-offline-kit.tar -C .qualification-evidence-root --strip-components=1
-          case_results=(--case-result t02-result.json --case-result t08-result.json)
-          if [ -f t12-result.json ]; then
-            case_results+=(--case-result t12-result.json)
-          fi
-          uv run --project implementations/tooling/python --frozen --no-default-groups python \
-            -m tools.bootstrap_profile qualification-evidence \
-            "${{ matrix.profile }}" "${{ github.sha }}" \
-            "github-actions:${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}" \
-            --python-artifact-id cpython-3.14 "${case_results[@]}" \
-            --slice-evidence local-installation-qualification.json \
-            --offline-kit-root .qualification-evidence-root --offline-kit bootstrap-offline-kit.tar \
-            --offline-kit-manifest-sha256 "${{ steps.kit.outputs.manifest_sha256 }}" \
-            > bootstrap-qualification.json
-      - name: Retain bounded qualification evidence
+      - name: Retain local installation results
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: bootstrap-${{ matrix.profile }}-${{ github.sha }}
-          path: |
-            bootstrap-qualification.json
-            bootstrap-offline-kit.tar
+          path: local-installation-qualification.json
           if-no-files-found: error
 
   development-image:
@@ -203,7 +98,7 @@ jobs:
         with:
           python-version: "3.14.7"
       - name: Install exact uv payload
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v8
         with:
           version: "0.12.4"
           enable-cache: false
@@ -234,8 +129,9 @@ jobs:
       - name: Prepare a clean checkout owned by the development user
         run: |
           git clone --no-local --no-hardlinks "${GITHUB_WORKSPACE}" "${RUNNER_TEMP}/rae"
-          sudo chown -R "$(jq -r '"\(.development_user.uid):\(.development_user.gid)"' \
-            "${RUNNER_TEMP}/development-image-plan.json")" "${RUNNER_TEMP}/rae"
+          development_uid="$(docker run --rm --entrypoint id raes-development-image:smoke -u)"
+          development_gid="$(docker run --rm --entrypoint id raes-development-image:smoke -g)"
+          sudo chown -R "${development_uid}:${development_gid}" "${RUNNER_TEMP}/rae"
       - name: Open the container as a dev-container client does
         run: |
           workspace=/workspaces/rae
@@ -265,7 +161,7 @@ jobs:
                 command -v "${tool}"
               done
               test -x .git/hooks/pre-commit
-              test -x .git/hooks/pre-push
+              test ! -e .git/hooks/pre-push
               nox -s policy -- --skip-requirement
               nox -s lint
               nox -s tests
@@ -304,9 +200,7 @@ jobs:
               source_revision: $source_revision,
               declared_base_image_index_digest: .base_image_index_digest,
               declared_base_image_digest: .base_image_digest,
-              native_repository_snapshot,
               resulting_image_id: $image_id,
-              policy_sha256,
               artifact_lock_sha256: $lock_sha256,
               development_profiles_sha256: $profiles_sha256,
               commands: [