feat: add protected Chongqing admission verifier workflow

.github/workflows/cd-staging.yml

@@ -170,6 +170,7 @@ jobs:
             data_agent/test_chongqing_source_governance.py \
             data_agent/test_chongqing_admission_readiness.py \
             data_agent/test_chongqing_protected_admission.py \
+            data_agent/test_chongqing_protected_admission_workflow.py \
             data_agent/test_dolphinscheduler_adapter.py \
             data_agent/test_dolphinscheduler_command_consumer.py \
             data_agent/test_dolphinscheduler_command_worker.py \

.github/workflows/ci.yml

@@ -179,6 +179,7 @@ jobs:
             data_agent/test_chongqing_source_governance.py \
             data_agent/test_chongqing_admission_readiness.py \
             data_agent/test_chongqing_protected_admission.py \
+            data_agent/test_chongqing_protected_admission_workflow.py \
             data_agent/test_dolphinscheduler_adapter.py \
             data_agent/test_dolphinscheduler_command_consumer.py \
             data_agent/test_dolphinscheduler_command_worker.py \

.github/workflows/verify-chongqing-admission.yml

@@ -0,0 +1,128 @@
+# Evaluates a metadata-only external attestation bundle against the immutable
+# M3-31 readiness record. This workflow is read-only and grants no ingestion
+# or provider authority.
+name: Verify - Chongqing Protected Admission
+
+on:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  attestations: write
+  contents: read
+  id-token: write
+
+concurrency:
+  group: chongqing-protected-admission
+  cancel-in-progress: false
+
+jobs:
+  verify-chongqing-admission:
+    name: Evaluate the external admission attestation bundle
+    if: github.ref == 'refs/heads/main'
+    runs-on: [self-hosted, linux, gda-admission]
+    environment: chongqing-admission
+    timeout-minutes: 20
+
+    env:
+      GDA_CHONGQING_READINESS_SHA256: 2f5ae24ab904af0eed18ee7c517ab5c4638cbdf0923c9345b0041af185d25591
+      GDA_CHONGQING_READINESS_FILE_SHA256: c595065e152988529ff12e2301d59caebb31d2889658a676c9d1f8239e6f8372
+      PYTHONPATH: ${{ github.workspace }}/protected-source
+
+    steps:
+      - name: Check out the exact protected verifier revision
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          path: protected-source
+          persist-credentials: false
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install verifier dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r protected-source/requirements.txt
+
+      - name: Require protected metadata-only attestation input
+        env:
+          GDA_CHONGQING_ADMISSION_PROTECTED: ${{ vars.GDA_CHONGQING_ADMISSION_PROTECTED }}
+          GDA_CHONGQING_ATTESTATION_BUNDLE_B64: ${{ secrets.GDA_CHONGQING_ATTESTATION_BUNDLE_B64 }}
+        run: |
+          set -euo pipefail
+          if [[ "$GDA_CHONGQING_ADMISSION_PROTECTED" != "true" ]]; then
+            echo "chongqing-admission environment is not explicitly enabled" >&2
+            exit 1
+          fi
+          if [[ -z "$GDA_CHONGQING_ATTESTATION_BUNDLE_B64" ]]; then
+            echo "protected admission attestation bundle is missing" >&2
+            exit 1
+          fi
+          input_root="$RUNNER_TEMP/chongqing-admission-input"
+          mkdir -p "$input_root"
+          umask 077
+          printf '%s' "$GDA_CHONGQING_ATTESTATION_BUNDLE_B64" | \
+            base64 --decode > "$input_root/attestation.json"
+          python -m json.tool "$input_root/attestation.json" >/dev/null
+          echo "GDA_CHONGQING_ATTESTATION_PATH=$input_root/attestation.json" >> "$GITHUB_ENV"
+
+      - name: Evaluate the protected admission contract
+        run: |
+          set -euo pipefail
+          mkdir -p chongqing-protected-admission
+          python -m data_agent.chongqing_protected_admission evaluate \
+            --readiness protected-source/docs/evidence/chongqing-admission-readiness-2026-08-17.json \
+            --attestation "$GDA_CHONGQING_ATTESTATION_PATH" \
+            --output chongqing-protected-admission/report.json
+
+      - name: Verify the report and preserve the no-authority boundary
+        run: |
+          set -euo pipefail
+          python -m data_agent.chongqing_protected_admission verify \
+            --input chongqing-protected-admission/report.json
+          python - <<'PY'
+          import json
+          import os
+
+          report = json.load(open("chongqing-protected-admission/report.json"))
+          assert report["readiness_evidence_sha256"] == os.environ[
+              "GDA_CHONGQING_READINESS_SHA256"
+          ]
+          assert report["readiness_evidence_file_sha256"] == os.environ[
+              "GDA_CHONGQING_READINESS_FILE_SHA256"
+          ]
+          assert report["attestation_valid"] is True
+          assert report["admission_eligible"] is True
+          assert report["content_admission_authorized"] is False
+          assert report["source_content_admitted"] is False
+          assert report["landing_authority_created"] is False
+          assert report["resource_version_created"] is False
+          assert report["platform_run_created"] is False
+          assert report["scheduler_submission_authorized"] is False
+          assert report["provider_mutation_authorized"] is False
+          assert report["production_ready"] is False
+          PY
+
+      - name: Stage the metadata-only attestation bundle
+        run: |
+          install -m 0600 \
+            "$GDA_CHONGQING_ATTESTATION_PATH" \
+            chongqing-protected-admission/attestation.json
+
+      - name: Attest the protected admission evidence
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            chongqing-protected-admission/attestation.json
+            chongqing-protected-admission/report.json
+
+      - name: Upload the protected admission evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: chongqing-protected-admission-${{ github.run_id }}
+          path: chongqing-protected-admission/
+          if-no-files-found: error
+          retention-days: 90

data_agent/test_chongqing_protected_admission_workflow.py

@@ -0,0 +1,111 @@
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_protected_admission_workflow_is_read_only_and_fail_closed():
+    path = ROOT / ".github/workflows/verify-chongqing-admission.yml"
+    rendered = path.read_text(encoding="utf-8")
+    workflow = yaml.safe_load(rendered)
+    job = workflow["jobs"]["verify-chongqing-admission"]
+    steps = job["steps"]
+    named = {step.get("name"): index for index, step in enumerate(steps)}
+
+    assert workflow["name"] == "Verify - Chongqing Protected Admission"
+    assert "workflow_dispatch" in rendered
+    assert workflow["permissions"] == {
+        "actions": "read",
+        "attestations": "write",
+        "contents": "read",
+        "id-token": "write",
+    }
+    assert job["if"] == "github.ref == 'refs/heads/main'"
+    assert job["runs-on"] == ["self-hosted", "linux", "gda-admission"]
+    assert job["environment"] == "chongqing-admission"
+    assert job["timeout-minutes"] == 20
+    assert workflow["concurrency"] == {
+        "group": "chongqing-protected-admission",
+        "cancel-in-progress": False,
+    }
+
+    assert (
+        named["Check out the exact protected verifier revision"]
+        < named["Require protected metadata-only attestation input"]
+        < named["Evaluate the protected admission contract"]
+        < named["Verify the report and preserve the no-authority boundary"]
+        < named["Attest the protected admission evidence"]
+        < named["Upload the protected admission evidence"]
+    )
+    checkout = steps[named["Check out the exact protected verifier revision"]]
+    assert checkout["with"] == {
+        "ref": "${{ github.sha }}",
+        "path": "protected-source",
+        "persist-credentials": False,
+    }
+    assert job["env"]["PYTHONPATH"] == "${{ github.workspace }}/protected-source"
+    assert job["env"]["GDA_CHONGQING_READINESS_SHA256"] == (
+        "2f5ae24ab904af0eed18ee7c517ab5c4638cbdf0923c9345b0041af185d25591"
+    )
+    assert job["env"]["GDA_CHONGQING_READINESS_FILE_SHA256"] == (
+        "c595065e152988529ff12e2301d59caebb31d2889658a676c9d1f8239e6f8372"
+    )
+
+    require_input = steps[named["Require protected metadata-only attestation input"]]
+    assert require_input["env"]["GDA_CHONGQING_ADMISSION_PROTECTED"] == (
+        "${{ vars.GDA_CHONGQING_ADMISSION_PROTECTED }}"
+    )
+    assert require_input["env"]["GDA_CHONGQING_ATTESTATION_BUNDLE_B64"] == (
+        "${{ secrets.GDA_CHONGQING_ATTESTATION_BUNDLE_B64 }}"
+    )
+    assert "umask 077" in require_input["run"]
+    assert "base64 --decode" in require_input["run"]
+    assert "python -m json.tool" in require_input["run"]
+
+    evaluate = steps[named["Evaluate the protected admission contract"]]["run"]
+    assert "data_agent.chongqing_protected_admission evaluate" in evaluate
+    assert "chongqing-admission-readiness-2026-08-17.json" in evaluate
+    assert '--attestation "$GDA_CHONGQING_ATTESTATION_PATH"' in evaluate
+    assert "--output chongqing-protected-admission/report.json" in evaluate
+
+    verify = steps[
+        named["Verify the report and preserve the no-authority boundary"]
+    ]["run"]
+    assert "data_agent.chongqing_protected_admission verify" in verify
+    assert 'report["attestation_valid"] is True' in verify
+    assert 'report["admission_eligible"] is True' in verify
+    for claim in (
+        "content_admission_authorized",
+        "source_content_admitted",
+        "landing_authority_created",
+        "resource_version_created",
+        "platform_run_created",
+        "scheduler_submission_authorized",
+        "provider_mutation_authorized",
+        "production_ready",
+    ):
+        assert f'report["{claim}"] is False' in verify
+
+    attest = steps[named["Attest the protected admission evidence"]]
+    assert attest["uses"] == "actions/attest-build-provenance@v3"
+    assert "chongqing-protected-admission/attestation.json" in attest["with"][
+        "subject-path"
+    ]
+    assert "chongqing-protected-admission/report.json" in attest["with"][
+        "subject-path"
+    ]
+    upload = steps[named["Upload the protected admission evidence"]]
+    assert upload["uses"] == "actions/upload-artifact@v4"
+    assert upload["with"]["retention-days"] == 90
+    assert upload["with"]["if-no-files-found"] == "error"
+
+    for forbidden in (
+        "kubectl ",
+        "helm ",
+        "terraform ",
+        "docker ",
+        "dolphinscheduler",
+        "provider mutation",
+    ):
+        assert forbidden not in rendered.lower()

docs/architecture-decisions/adr-080-chongqing-protected-admission-workflow.md

@@ -0,0 +1,83 @@
+# ADR-080: Chongqing protected admission verifier workflow
+
+**Status**: Accepted
+
+**Date**: 2026-08-17
+
+**Decision owners**: Platform Architecture, Data Platform, Data Governance, Security
+
+## Context
+
+M3-32 defines a deterministic intake/evaluate/verify contract for the fifteen
+external inputs required by the Chongqing admission readiness record. Running
+that evaluator from a developer shell, however, cannot establish protected
+verifier identity, environment approval or artifact provenance. The workflow
+boundary must be explicit before real attestations can be consumed.
+
+The boundary must not gain source-payload access, provider credentials,
+scheduler permissions or ingestion authority. A successful evidence evaluation
+is still only eligibility for a separate admission decision.
+
+## Options considered
+
+| Option | Benefit | Limitation | Decision |
+|---|---|---|---|
+| Evaluate from a developer workstation | Minimal setup | No protected identity, approval or artifact provenance | Rejected |
+| Commit an attestation bundle to the repository | Easy CI integration | Makes mutable repository content look authoritative and may expose evidence metadata | Rejected |
+| Protected environment workflow consuming a metadata-only secret bundle | Environment approval, exact verifier revision and GitHub provenance; no source access | Requires dedicated runner/environment provisioning and secret rotation | Adopted |
+
+## Decision
+
+Adopt `.github/workflows/verify-chongqing-admission.yml` as the M3-33 protected
+verifier workflow contract.
+
+The workflow:
+
+1. can run only by manual dispatch from `main` in the protected
+   `chongqing-admission` environment;
+2. uses a dedicated `[self-hosted, linux, gda-admission]` runner and checks out
+   the exact `github.sha` without persisted credentials;
+3. accepts only a base64-encoded metadata attestation JSON from the protected
+   environment secret, writes it with a restrictive umask, and never reads the
+   Chongqing source payload;
+4. binds evaluation to the exact M3-31 logical and file fingerprints;
+5. runs the M3-32 evaluator and integrity verifier, requiring
+   `attestation_valid=true` and `admission_eligible=true` while asserting every
+   content, Landing, ResourceVersion, PlatformRun, scheduler, provider and
+   production authority claim remains false; and
+6. uses GitHub OIDC provenance to attest the metadata-only input bundle and
+   report, then uploads them as a bounded-retention artifact.
+
+The secret is an input transport, not an authority by itself. Environment
+reviewers, branch restrictions, runner ownership and secret rotation must be
+provisioned before the workflow can produce accepted protected evidence.
+
+## Authority boundary
+
+M3-33 contains no connector, source scan, payload copy, Landing creation,
+ResourceVersion mutation, PlatformRun creation, scheduler submission or
+provider client. The workflow cannot authorize ingestion or production. A
+successful report must be consumed by a separate admission decision and
+immutable Landing authority workflow that does not yet exist.
+
+The checked-in workflow and synthetic/static tests prove only the workflow
+contract. They do not prove that the protected environment, runner, reviewer
+policy, external attestations or production identities exist.
+
+## Consequences
+
+**Positive**: real external evidence now has one auditable execution path bound
+to an exact verifier revision and provenance artifact.
+
+**Positive**: environment configuration or evidence gaps fail before any
+authority-bearing action is possible.
+
+**Negative**: AR-2 remains `in_progress`; the dedicated environment and runner
+must be provisioned and all fifteen real attestations supplied before the first
+protected run.
+
+## Verification
+
+```bash
+python -m pytest data_agent/test_chongqing_protected_admission_workflow.py -q
+```