RC-CI-GUARD: scope immutable RC verification

[skylarbpayne]

Scope

• Exact base / consumed merged RC-04 SHA: 1979089e8f6b23241939b1bd63e14fe1007f62bc
• Exact allowlist: .github/workflows/test.yml only
• Ownership order: RC-04 -> RC-CI-GUARD -> RC-14 -> RC-09 -> RC-18 -> QUAL-FW
• Preserves the existing push/pull_request triggers, Python 3.9/3.11 pytest matrix, and release-candidate job/check name.
• Adds a fail-closed classifier inside release-candidate; only the RC build, immutable byte/package-identity verification, and upload steps are gated.

Classifier contract

Uses full-history checkout and exact PR base-to-head or push before-to-head endpoints. Paths come from git diff --name-only -z --no-renames. The RC path is required for the workflow itself or a direct docs/releases/*.json receipt; nested receipts, non-JSON release files, package/runtime-only changes, and valid empty diffs skip only the RC-specific steps. Unknown events, missing/malformed/all-zero/unavailable endpoints, and diff failures hard-fail.

Local acceptance matrix passed for:

• required: workflow change; direct receipt add/modify/delete; direct receipt rename represented as delete/add; mixed diff; push endpoints
• skipped: exact INT-C1 five paths; pyproject.toml + package manifest; nested release JSON; non-JSON release file; empty diff
• hard failure: unknown event; missing endpoints; all-zero SHA; malformed SHA; unavailable commit; forced git diff error

TDD and local verification

• RED: the base workflow had unconditional build, byte/identity verification, and upload steps for an INT-C1-only diff.
• GREEN: complete classifier matrix and structural guard assertions passed against the exact embedded workflow script.
• actionlint: passed
• YAML: yq and Ruby/Psych parse passed
• Python 3.9.6: 675 passed, 1 skipped
• Python 3.11.14: 674 passed, 2 skipped
• git diff --check: passed
• Ancestry: base is an ancestor; INT-C1 head 02f201c538a614b5df585f0d6f4559bd9f9e4bf4 and excluded PR feat: support custom select values in review queue #131 head fc9eb5ae0797c5cbdfcf51d6b9be551e6ba85331 are not ancestors
• Exact base-to-head path: .github/workflows/test.yml
• Local clean build reproduced hermes_workflows-0.0.1rc1-py3-none-any.whl: 183555 bytes, SHA-256 9995dfcdfbb05057d21401896d94f3fdc9e89891f18fe6f6f6097c616e595ba2, version 0.0.1rc1, manifest identity sha256:8c7dc41504681d7acdc0b1a9e085e99fb4445c2e5440e6ea29077fb599aec3fc

GitHub checks

Terminal on exact head d195a5e17655c540a777026096b12d1d7d798948:

• docs build: passed (run)
• pytest (3.9): passed
• pytest (3.11): passed
• release-candidate: passed (run)
• docs deploy: skipped as expected for a pull request
• RC step receipt: classifier, build, byte/package-identity verification, and actions/upload-artifact@v6 each concluded success (not skipped)
• uploaded artifact: hermes-workflows-0.0.1rc1-915f4fbd4743323267ae0b99f2a9b202fdaa789a (artifact id 8330646711)
• downloaded uploaded wheel: 183555 bytes; SHA-256 9995dfcdfbb05057d21401896d94f3fdc9e89891f18fe6f6f6097c616e595ba2; version 0.0.1rc1; manifest identity sha256:8c7dc41504681d7acdc0b1a9e085e99fb4445c2e5440e6ea29077fb599aec3fc

Rollback and boundaries

Rollback is a revert of this guard PR only. Do not alter the immutable release, tag, receipt, or artifact. No live profile install, registry/database mutation, service restart/reconfiguration, deploy/cutover, credential, cron, branch-protection, destructive/user-data, or external-send action occurred. Do not merge before fresh Palmer specification review and separate quality/security review at the exact head.