bootstrap(trust-root): fix selective-rerun security evidence binding

[safal207]

Dedicated trust-root bootstrap

This PR fixes a concrete Security Baseline failure discovered while validating ASTRA PR #298. It is intentionally isolated from #298 because .github/workflows/security.yml and its executed helpers are protected trust-root material.

Failure reproduced

A partial rerun increments github.run_attempt for the workflow, but successful jobs that were not rerun keep artifacts from their earlier attempts.

Observed shape:

dependency  -> attempt 1
secret      -> attempt 2
codeql      -> attempt 1
security gate current attempt -> 2

The previous gate downloaded only cml-security-lane-*-<run_id>-<current_attempt> and then required all three lane files under that attempt. This made a valid selective rerun fail during evidence-manifest assembly even when every security lane result was success.

New invariant

Security evidence is bound to one stable workflow run_id and one exact tested_sha, while each lane preserves its own latest produced run_attempt.

The resolver:

• downloads all lane artifacts for the current run_id across attempts;
• selects the highest existing attempt independently for dependency, secret, and codeql;
• requires the expected schema, exact tested_sha, and passed: true for that newest artifact;
• never falls back to an older artifact if a newer artifact exists but is malformed, stale, or failed;
• copies only validated evidence into stable artifacts/resolved/<lane>/... paths;
• emits security-evidence-selection.json recording the chosen artifact name, lane attempt, SHA-256 digest, and byte count;
• keeps the final evidence manifest bound to the current workflow run attempt while preserving per-lane attempt provenance.

Files

• .github/workflows/security.yml
• scripts/ci/resolve_security_evidence.py
• tests/test_security_evidence_rerun.py
• .github/trust-root/protected_files.json

Regression controls

Focused tests cover:

• successful selective rerun with lane attempts 1 / 2 / 1;
• newer evidence with the wrong tested_sha fails closed without old fallback;
• newer passed: false evidence fails closed;
• missing lane evidence fails closed;
• evidence from another run_id is never reused.

The focused resolver suite passed locally: 5 passed.

Bootstrap authority boundary

This PR intentionally changes protected CI identities. The existing CML Trust Root Gate is expected to reject it under the current base trust root. That red status is the bootstrap boundary, not something to bypass.

Do not merge based only on ordinary CI. The exact tree requires explicit human + independent review of the workflow change, resolver semantics, regression tests, and updated protected identities.

authority_granted = false
merge_authority = false
bootstrap_approved = false

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d913acdc-347a-4904-b019-0d9e76483f93

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Relevant CML Memory

Deterministic retrieval for PR #301 at head 19df661a8d34 against accepted memory on base efe9832561ed.

No publishable accepted memory matched this change

No publishable accepted memory met the relevance threshold.

---

Publishable candidates evaluated: 0 · selected: 0.
Public-repository policy surfaces only packs with visibility=public and contains_private_data=false.

CML memory is advisory: verify that the recorded constraints still apply. This comment grants no approval, execution, or merge authority.