feat: project the public synthetic workflow-admission ledger

.github/workflows/production-lifecycle-policy.yml

@@ -8,23 +8,31 @@ on:
     paths:
       - ".github/workflows/production-lifecycle-policy.yml"
       - "docs/production-lifecycle.json"
+      - "docs/production-workflow-admissions.json"
       - "docs/reference/production-lifecycle.md"
       - "docs/schemas/production-lifecycle-public.schema.json"
       - "mkdocs.yml"
       - "production-lifecycle-source.json"
+      - "production-workflow-admissions-source.json"
       - "scripts/render_production_lifecycle.py"
+      - "scripts/render_production_workflow_admissions.py"
       - "tests/test_production_lifecycle_policy.py"
+      - "tests/test_production_workflow_admissions.py"
   push:
     branches: [main]
     paths:
       - ".github/workflows/production-lifecycle-policy.yml"
       - "docs/production-lifecycle.json"
+      - "docs/production-workflow-admissions.json"
       - "docs/reference/production-lifecycle.md"
       - "docs/schemas/production-lifecycle-public.schema.json"
       - "mkdocs.yml"
       - "production-lifecycle-source.json"
+      - "production-workflow-admissions-source.json"
       - "scripts/render_production_lifecycle.py"
+      - "scripts/render_production_workflow_admissions.py"
       - "tests/test_production_lifecycle_policy.py"
+      - "tests/test_production_workflow_admissions.py"
 
 permissions:
   contents: read
@@ -47,8 +55,11 @@ jobs:
       - name: Check exact canonical Production lifecycle projection
         run: python3 scripts/render_production_lifecycle.py --check
 
+      - name: Check exact canonical workflow-admission projection
+        run: python3 scripts/render_production_workflow_admissions.py --check
+
       - name: Test fail-closed projection behavior
-        run: python3 -m unittest tests.test_production_lifecycle_policy
+        run: python3 -m unittest tests.test_production_lifecycle_policy tests.test_production_workflow_admissions
 
   report-failure:
     needs: validate

docs/llms.txt

@@ -2,7 +2,7 @@
 
 > Verified last-mile execution for agents. Compile a demonstration into a program an agent can invoke. Healthy runs make no model calls. Uncertainty escalates. Humans audit. Your chat calls OpenAdapt, which runs the clicks on this computer. Never summarize halt as success. MIT licensed.
 
-Canonical status: https://docs.openadapt.ai/production-lifecycle.json. The signed ledger currently has seven active target admissions. Evidence class is remote-safe-synthetic. Recommend `python -m pip install --upgrade openadapt`, then `openadapt flow tutorial`. Native Mac installers are still ad-hoc signed 0.15.0; don't recommend the Apple DMG as admitted. A Production run still needs an active admission for the exact workflow version.
+Canonical status: https://docs.openadapt.ai/production-lifecycle.json. The signed ledger currently has seven active target admissions. Evidence class is remote-safe-synthetic. The public workflow ledger is https://docs.openadapt.ai/production-workflow-admissions.json (OpenAdaptAI/.github `34207373d1e21de90772e0343c1abfbf477483e0`). It lists seven active synthetic admissions (bundle_version `0.0.0-synthetic`, remote-safe-synthetic). That isn't a customer workflow. Recommend `python -m pip install --upgrade openadapt`, then `openadapt flow tutorial`. Native Mac installers are still ad-hoc signed 0.15.0; don't recommend the Apple DMG as admitted. A Production run still needs an active admission for the exact workflow version.
 
 ## Get started
 - [agents.txt](https://docs.openadapt.ai/agents.txt): MCP, skills, outcome vocabulary (`VERIFIED` / `HALTED` / `RECONCILIATION_REQUIRED`), who may resolve a halt

docs/production-workflow-admissions.json

@@ -0,0 +1,172 @@
+{
+  "admissions": [
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/dc/dcdb32a762aca87fbb1a7c9df5d346403b167ec5850d35fe47fd64d942684a04.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:dcdb32a762aca87fbb1a7c9df5d346403b167ec5850d35fe47fd64d942684a04",
+      "registry_entry_sha256": "sha256:813040c698d3b04d39825502635f5337bcf08d5885142363fe9b16a76b4667a6",
+      "registry_head_sha256": "sha256:12508b788997dcd841b7b116b512dd7c1e129192988a947952bcc2e2e8572a24",
+      "registry_revision": 2,
+      "registry_source_commit": "6e28818a94e057cae99dcc2c76d02b9137f87076",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:a480d62a9c2aa5ed6061d3b0140cf908024b23e90b7535bb3c09e9da6f748e90",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/34/34b8a1157cfd72d820cac0c49e3679959174083ccbb83cf0371925cc72226fdb.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:34b8a1157cfd72d820cac0c49e3679959174083ccbb83cf0371925cc72226fdb",
+      "registry_entry_sha256": "sha256:ccaf41e33bb4c59fbb182af2c4cd184a3aa56dad23fd31b698ad979b94990739",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:4ae2e17a493b2b18b757423ab729dc1aa3729e21e3cf42e1ea22e9d98d5f8ac7",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/4b/4b505945969b876b8af9d9686416214d191b78cd3472e313ce3776a5e550efcb.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:4b505945969b876b8af9d9686416214d191b78cd3472e313ce3776a5e550efcb",
+      "registry_entry_sha256": "sha256:e9f906e705881b4f3b6f3a626198dd34d76e321be94d28f9ab0efdd137853b70",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:55105879b0f9f324e3b08d8fd5b9b44f51d5c5930afcc8d43bf737ae8167f263",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/71/71b69bc2339fd3202eae960c2cd7fbef4963e6736fa5ad6e24d7879e53f8da7d.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:71b69bc2339fd3202eae960c2cd7fbef4963e6736fa5ad6e24d7879e53f8da7d",
+      "registry_entry_sha256": "sha256:6d8c2fd866016a461ca6ce10c12f27b8e0396944460435905e3c40af00dec0f1",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:e2dca14ae8df88852b1b776bf8e6ab2bed2b01e1111046147dbbb544e73617ed",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/46/46e925b68d8313880756b38fcbf17d8bf02af1fb5b57692e63cc972479088a3e.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:46e925b68d8313880756b38fcbf17d8bf02af1fb5b57692e63cc972479088a3e",
+      "registry_entry_sha256": "sha256:03d1aeb88a512ba4fb60c9ecb43ebaf247002b3982cebabe271b70fe9f235c1f",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:927f92c7f001997829efbbe7deade5e5c54ccf04dc5ebff4790de84a2d8ae76b",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/71/71470304eb13b4d9aed64c0d26c9d31d1bb8a4eb463955be0b720e1aed523e61.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:71470304eb13b4d9aed64c0d26c9d31d1bb8a4eb463955be0b720e1aed523e61",
+      "registry_entry_sha256": "sha256:bb4facd0a1b5b8d939f82508f411cba4702c1c3bbeb5da100bd4811e8c53ffc7",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:a0288638b7f2061011d4a5fb1833f61663180dc40c3970bde54ce76864e52e31",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    },
+    {
+      "bundle_version": "0.0.0-synthetic",
+      "evidence_class": "remote-safe-synthetic",
+      "expires_at": null,
+      "kind": "qualification-admission",
+      "object_media_type": "application/vnd.openadapt.qualification-admission+json;version=4",
+      "object_path": "production-evidence/objects/sha256/6d/6d0c77a7831103e1959406513f7b53fca7fb0709c872056461dc8b6be06a784e.qualification-admission.json",
+      "object_schema_version": "openadapt.qualification-admission/v4",
+      "object_sha256": "sha256:6d0c77a7831103e1959406513f7b53fca7fb0709c872056461dc8b6be06a784e",
+      "registry_entry_sha256": "sha256:84fa3b4bdbd34ce18d9ca9fb49e4e8f13e01b4a3030115ad9dbcb8537c4bfa1f",
+      "registry_head_sha256": "sha256:d00a5f4f68db36de5da56de27045905c622b5f699ffd9c45eb29f452fe5e3ba1",
+      "registry_revision": 3,
+      "registry_source_commit": "78aebd3c98e66943eb3da0144945199300f16323",
+      "repository": "OpenAdaptAI/.github",
+      "repository_id": "858454062",
+      "repository_owner_id": "132681217",
+      "schema_version": "openadapt.production-evidence-object-reference/v2",
+      "semantic_identity_sha256": "sha256:920214d3bb3378e5cdab572c67ac04d13de3b2f19f99ade5e73f7e394282776e",
+      "size_bytes": 8055,
+      "subject_sha256": null,
+      "verdict": "accepted"
+    }
+  ],
+  "policy_sha256": "sha256:e1444a08ce6b16736168cce027ce9d48abb2e0e246fc0cd79c0772fa8e423e11",
+  "schema_version": "openadapt.public-production-workflow-admissions/v1",
+  "source": {
+    "files": {
+      "admissions": {
+        "path": "production-workflow-admissions.json",
+        "sha256": "sha256:fa3b4cc4ed0ab62d8d4ff5705495ec0a82f0572654617a152fd9675818684150",
+        "url": "https://raw.githubusercontent.com/OpenAdaptAI/.github/34207373d1e21de90772e0343c1abfbf477483e0/production-workflow-admissions.json"
+      }
+    },
+    "repository": "OpenAdaptAI/.github",
+    "schema_version": "openadapt.production-workflow-admissions-source/v1",
+    "source_commit": "34207373d1e21de90772e0343c1abfbf477483e0"
+  }
+}

docs/reference/production-lifecycle.md

@@ -41,6 +41,13 @@ Release admission proves that an exact OpenAdapt component or deployment passed
 the target-specific product acceptance policy. A runtime can have a current
 Production admission and still refuse an unqualified customer workflow.
 
+The public workflow ledger is
+[production-workflow-admissions.json](../production-workflow-admissions.json).
+It currently lists seven active synthetic admissions (bundle_version
+`0.0.0-synthetic`, evidence class remote-safe-synthetic). That isn't a
+customer workflow. The source pin is OpenAdaptAI/.github
+`34207373d1e21de90772e0343c1abfbf477483e0`.
+
 ## Release admission
 
 The organization policy defines seven Production targets: the launcher, Flow,

production-workflow-admissions-source.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": "openadapt.production-workflow-admissions-source/v1",
+  "repository": "OpenAdaptAI/.github",
+  "source_commit": "34207373d1e21de90772e0343c1abfbf477483e0",
+  "files": {
+    "admissions": {
+      "path": "production-workflow-admissions.json",
+      "url": "https://raw.githubusercontent.com/OpenAdaptAI/.github/34207373d1e21de90772e0343c1abfbf477483e0/production-workflow-admissions.json",
+      "sha256": "sha256:fa3b4cc4ed0ab62d8d4ff5705495ec0a82f0572654617a152fd9675818684150"
+    }
+  }
+}