ci(verification): emit repository-wide execution receipt

.aegis/experiments/repository-wide-verification-v1.json

@@ -0,0 +1,24 @@
+{
+  "admission_executable": {"blob_id":"b9c998ddc85b9beeefec30121e88e828b15a8405","path":"sovereign-omega-v2/scripts/validate-experiment-plan.ts"},
+  "admission_workflow": {"blob_id":"01a59d129b0431c9ccb92b1227a0e46992b1562f","path":".github/workflows/experiment-admission.yml"},
+  "budget": {"max_cost_microunits":0,"max_duration_seconds":21600,"max_mutations":32},
+  "claims_ledger": {"path":".aegis/claims-ledger.json","root":"495a01d7a942d5f90b39f2d2b178b074aee60c5e6460e1622f1917982ac59652"},
+  "constitution": {"blob_id":"d0c210443e03313113e43da46c4d98269494baeb","path":"CONSTITUTIONAL_DECLARATION.md"},
+  "evidence_tier":"T1",
+  "execution_class":"EXPERIMENT",
+  "expected_outputs":["ADMISSION_RECEIPT.json","EVIDENCE_MANIFEST.json","EXPERIMENT_PLAN.json","INTEGRATION_LEDGER.json","INTEGRATION_LEDGER.md","SHA256SUMS"],
+  "expected_parent_sha":"afe904d0c313691353eae0d5c3ff782a2f740a7f",
+  "expected_parent_state_root":"7f12fe22431cb3af5b311f28174ca139434966a2d0a3ebed1bc232b246df824c",
+  "experiment_id":"repository-wide-verification-v1",
+  "integration_ledger_generator": {"blob_id":"28823ae5b630be273b78210f0addf9c0a86aad05","path":"scripts/integration_ledger.py"},
+  "observability": {"cancellation_mechanism":"github-actions-cancel-run","durable_execution_required":true,"emergency_stop_reference":"github-actions:cancel-run","heartbeat_max_seconds":3600,"provider":"github-actions"},
+  "operator_approval": {"approval_record_hash":"139577599338a7d056e2b78d41759a0182a1497157cbe93123b839d44fba8c71","authorization_basis":"user-explicit-pa-de-popravi-mi-sve-repository-wide-remediation-without-merge","decided_at":"2026-07-31T17:25:00Z","operator_actor_id":"tarikskalic","operator_session_id":"chatgpt-session-2026-07-31-repository-wide-remediation","required":true,"signature_mode":"GITHUB_OIDC_ATTESTATION","state":"APPROVED"},
+  "policy": {"blob_id":"5937cf4d9fc59f224faabfb7865bba7aa5da90dc","path":"docs/rfcs/0001-operator-sovereign-control-plane.md"},
+  "replay_package": {"include_admission_receipt":true,"include_evidence_manifest":true,"include_integration_ledger":true,"include_plan":true,"required":true},
+  "repository":"Aegis-Omega/AEGIS-OMEGA",
+  "requested_authority_domains":["github:artifact-metadata-write","github:attestation-write","github:oidc-token-mint","github:repository-content-write","github:workflow-artifact-write"],
+  "schema_version":"0.1.0",
+  "sovereignty_contracts": {"blob_id":"d53860f1340293cf08955ebb8729a853432551eb","path":"sovereign-omega-v2/src/sovereignty/contracts.ts"},
+  "termination_conditions":["budget_exhausted","observability_expired","operator_emergency_stop"],
+  "title":"Execute, reconcile, and remediate repository-wide test, lint, constitutional-integrity, dependency, and security-policy evidence"
+}

.claude.json

@@ -9,8 +9,8 @@
   "provenance": {
     "generator": "scripts/build-cognitive-manifest.py",
     "repository": "Aegis-Omega/AEGIS-OMEGA",
-    "source_ref": "claude/blissful-rubin-mt9jS",
-    "parent_state_hash": "410bcd49c721e65050382ae759db7af2f41fa9f572e625174252c72a8748ea93",
+    "source_ref": "verification/repository-wide-receipt-v1",
+    "parent_state_hash": "e9f0ec153b0b320a1e791092f73209442ec43a982e503203d9c101ec40949cba",
     "signature_mode": "GITHUB_OIDC_ATTESTATION"
   },
   "hashing": {
@@ -488,5 +488,5 @@
       "on_success": "broadcast-attested-verified-event-stream"
     }
   },
-  "state_hash": "e9f0ec153b0b320a1e791092f73209442ec43a982e503203d9c101ec40949cba"
+  "state_hash": "036fad30ebc01117e033a99cb1694748a788604f8e2fd689209b2bf517e7aba3"
 }

.github/workflows/production-dependency-audit.yml

@@ -0,0 +1,86 @@
+name: AEGIS Production Dependency Audit
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: production-audit-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  audit:
+    name: Production audit · ${{ matrix.surface }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - surface: sovereign-runtime
+            directory: sovereign-omega-v2
+            lockfile: sovereign-omega-v2/package-lock.json
+          - surface: studio
+            directory: studio
+            lockfile: studio/package-lock.json
+          - surface: mcp-server
+            directory: sovereign-omega-v2/mcp-server
+            lockfile: sovereign-omega-v2/mcp-server/package-lock.json
+    steps:
+      - name: Checkout exact candidate head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CANDIDATE_SHA }}
+
+      - name: Assert exact checkout identity
+        run: test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: ${{ matrix.lockfile }}
+
+      - name: Install locked graph
+        working-directory: ${{ matrix.directory }}
+        run: npm ci
+
+      - name: Audit production dependencies
+        id: audit
+        working-directory: ${{ matrix.directory }}
+        shell: bash
+        run: |
+          set +e
+          npm audit --omit=dev --audit-level=high --json > production-audit.json
+          status=$?
+          set -e
+          node - <<'NODE'
+          const fs = require('node:fs')
+          const report = JSON.parse(fs.readFileSync('production-audit.json', 'utf8'))
+          const vulnerabilities = report.metadata?.vulnerabilities ?? {}
+          console.log(JSON.stringify({
+            dependencies: report.metadata?.dependencies ?? null,
+            vulnerabilities,
+          }, null, 2))
+          NODE
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+
+      - name: Upload exact audit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: production-audit-${{ matrix.surface }}-${{ env.CANDIDATE_SHA }}
+          path: ${{ matrix.directory }}/production-audit.json
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Fail on high or critical production vulnerability
+        if: ${{ steps.audit.outputs.status != '0' }}
+        run: exit 1

.github/workflows/repository-verification.yml

@@ -0,0 +1,189 @@
+name: AEGIS Repository-Wide Verification
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repository-verification-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  PYTHONUNBUFFERED: '1'
+
+jobs:
+  verify:
+    name: Repository verification receipt
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - name: Checkout exact candidate head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CANDIDATE_SHA }}
+          fetch-depth: 0
+
+      - name: Assert exact checkout identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          actual="$(git rev-parse HEAD)"
+          test "$actual" = "$CANDIDATE_SHA"
+          echo "candidate=$actual tree=$(git rev-parse 'HEAD^{tree}')"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install shared Python verification dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pytest flask flask-cors psutil numpy scikit-learn 'PyYAML==6.0.2'
+          python -m pip install -r sovereign-omega-v2/python/requirements.txt
+
+      - name: Execute complete named verification corpus
+        id: corpus
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p verification-out verification-final
+          python -m py_compile scripts/repository_verification.py
+
+          python scripts/repository_verification.py census \
+            --output verification-out/definition-census.json \
+            --exclusion 'sovereign-omega-v2/python/tests/test_ledger_persist.py=requires approximately 4 GB and real CoreMatrix allocation; explicitly excluded by the current CI contract' \
+            --exclusion 'sovereign-omega-v2/python/tests/stress_test.py=performance stress program is not part of the deterministic unit and contract corpus'
+
+          failures=0
+
+          run_suite() {
+            suite_id="$1"
+            parser="$2"
+            classification="$3"
+            command="$4"
+            log="verification-out/${suite_id}.log"
+            result="verification-out/${suite_id}.json"
+
+            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+            echo "SUITE $suite_id"
+            echo "COMMAND $command"
+            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+            set +e
+            bash -lc "$command" >"$log" 2>&1
+            status=$?
+            set -e
+            cat "$log"
+
+            python scripts/repository_verification.py record \
+              --suite-id "$suite_id" \
+              --suite-command "$command" \
+              --parser "$parser" \
+              --classification "$classification" \
+              --log "$log" \
+              --exit-code "$status" \
+              --output "$result"
+
+            if [[ "$status" -ne 0 ]]; then
+              failures=$((failures + 1))
+            fi
+          }
+
+          run_suite rust-cl-psi cargo WIRED \
+            'cd aegis-cl-psi && cargo test --jobs 1 -- --test-threads 1'
+
+          run_suite rust-aegis-runtime cargo WIRED \
+            'cd aegis-runtime && cargo test'
+
+          run_suite rust-hypervisor cargo TESTED_ONLY \
+            'cargo test'
+
+          run_suite rust-constitutional-substrate cargo TESTED_ONLY \
+            'cd crates/constitutional-substrate && cargo test'
+
+          run_suite typescript-sovereign-runtime vitest TESTED_ONLY_MIXED_WITH_WIRED_SHELL \
+            'cd sovereign-omega-v2 && npm ci && npm run test -- --reporter=verbose && npm run typecheck && npm run build'
+
+          run_suite typescript-sovereign-lint none WIRED_QUALITY_GATE \
+            'cd sovereign-omega-v2 && npm ci && npm run lint'
+
+          run_suite constitutional-frozen-hashes none WIRED_CONSTITUTIONAL_INTEGRITY \
+            'node sovereign-omega-v2/scripts/verify-hashes.mjs && (cd sovereign-omega-v2 && node scripts/verify-hashes.mjs)'
+
+          run_suite repository-security-policy none WIRED_POLICY \
+            "grep -F '## Repository-Wide Security Invariants' SECURITY.md && grep -F 'deny-by-default' SECURITY.md && grep -F 'These requirements apply to every executable surface' SECURITY.md && grep -F 'A passing test suite proves only the named commands' SECURITY.md"
+
+          run_suite python-bridge pytest WIRED_AND_TESTED_ONLY \
+            'cd sovereign-omega-v2 && python -m pytest -q python/tests --ignore=python/tests/test_ledger_persist.py'
+
+          run_suite python-aegis-interface pytest WIRED \
+            'cd packages/aegis-interface && PYTHONPATH=. python -m pytest -q && PYTHONPATH=. python -m aegis_interface.cli check wit/skill_snapshot.wit --out generated && PYTHONPATH=. python -m aegis_interface.cli evolve --from wit/skill_snapshot.wit --to wit/skill_snapshot_v2.wit && PYTHONPATH=. python -m aegis_interface.cli compose wit/skill_snapshot.wit wit/skill_snapshot_v2.wit wit/skill_snapshot_v3.wit'
+
+          run_suite python-kernel-one unittest WIRED_LOCAL_REFERENCE \
+            'cd kernel-one && python -m py_compile kernel_one.py validator.py init_db.py test_kernel_one.py && python test_kernel_one.py'
+
+          run_suite typescript-mcp-server none WIRED \
+            'cd sovereign-omega-v2/mcp-server && npm ci && npm run test:resources && npm run test:automaton3'
+
+          run_suite cross-runtime-proofs none WIRED_PROOF \
+            'cd genomics && python3 test_replay_proof.py && python3 interpret_demo.py && cd ../verifiable && python3 test_generality.py && cd .. && bash verifiable/cross_language/verify.sh && cd verifiable && python3 certify_all.py --twice'
+
+          run_suite studio-build none WIRED_BUILD_NO_REMOTE_TEST_SCRIPT \
+            'cd studio && npm ci && npm run build'
+
+          set +e
+          python scripts/repository_verification.py aggregate \
+            --input-dir verification-out \
+            --required-suite constitutional-frozen-hashes \
+            --required-suite cross-runtime-proofs \
+            --required-suite python-aegis-interface \
+            --required-suite python-bridge \
+            --required-suite python-kernel-one \
+            --required-suite repository-security-policy \
+            --required-suite rust-aegis-runtime \
+            --required-suite rust-cl-psi \
+            --required-suite rust-constitutional-substrate \
+            --required-suite rust-hypervisor \
+            --required-suite studio-build \
+            --required-suite typescript-mcp-server \
+            --required-suite typescript-sovereign-lint \
+            --required-suite typescript-sovereign-runtime \
+            --json-output verification-final/REPOSITORY_VERIFICATION_RECEIPT.json \
+            --markdown-output verification-final/REPOSITORY_VERIFICATION_RECEIPT.md
+          aggregate_status=$?
+          set -e
+
+          cat verification-final/REPOSITORY_VERIFICATION_RECEIPT.md >> "$GITHUB_STEP_SUMMARY"
+
+          final_status=0
+          if [[ "$failures" -ne 0 || "$aggregate_status" -ne 0 ]]; then
+            final_status=1
+          fi
+          echo "status=$final_status" >> "$GITHUB_OUTPUT"
+
+      - name: Upload receipt, suite records and complete logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: aegis-repository-verification-${{ env.CANDIDATE_SHA }}
+          path: |
+            verification-final/*
+            verification-out/*
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Fail closed on incomplete repository evidence
+        if: ${{ steps.corpus.outputs.status != '0' }}
+        run: exit 1

.github/workflows/typescript-lint.yml

@@ -0,0 +1,44 @@
+name: AEGIS TypeScript Lint
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: typescript-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  lint:
+    name: TypeScript lint · sovereign runtime
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout exact candidate head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CANDIDATE_SHA }}
+
+      - name: Assert exact checkout identity
+        run: test "$(git rev-parse HEAD)" = "$CANDIDATE_SHA"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: sovereign-omega-v2/package-lock.json
+
+      - name: Install locked graph
+        working-directory: sovereign-omega-v2
+        run: npm ci
+
+      - name: Lint complete TypeScript source surface
+        working-directory: sovereign-omega-v2
+        run: npm run lint