chore(sda): retire completed fixed-SHA reconciliation

[Lutar, Stephen P. (stephenlutar2-hash)]

Satisfies

Satisfies C-158 and completed report #221. Replaces conflicted signed PR #348 on current main without rewriting its history.

Root cause

The organization health digest still exposes Reconcile A11oy and Killinchu SDA shared source, a completed one-shot controller bound to historical PR #1028 and fixed branch SHAs. Current evidence already proves both shared szl_ecosystem_routes.py files resolve to Git blob 9564c47daf79c86815b2544ec51b06debc30d354; issue #221 is closed.

Keeping the controller executable permits it to target stale branches and reopen a resolved incident.

Permanent retirement

• delete the historical workflow
• delete its branch-mutating Python controller
• delete the historical fixed-SHA manifest
• add a tombstone regression rejecting the retired paths and historical markers
• retain issue [sda-reconcile-report] exact A11oy and Killinchu shared source #221 as the durable completion record

Clean signed lineage

Commit 2f8dfa8a2eeb8740f132879d6f5ab26c27ca00b3 is based directly on current protected main, SSH-signed, and DCO-signed-off. Its two added blobs are byte-for-byte identical to the previously verified signed replacement; the same three obsolete paths are deleted. No force push or history rewrite was used.

Verification

• retirement contract: 2 tests passed
• exact-source compilation passed
• git diff --check passed
• added test/workflow blob hashes match PR chore(sda): retire completed fixed-SHA reconciliation #348 exactly

Labels

PROVED exact signed replacement and retirement tombstone; MEASURED stale completed controller; NOT CLAIMED product-state change beyond removing obsolete mutation authority.

Rollback

Restore only through a protected pull request carrying a new reviewed reconciliation manifest and new immutable targets.

Risk class

Risk B — deletion of a completed source-control mutation one-shot and addition of a read-only tombstone test.

Solo-Operator-Authorization: confirmed

Signed-off-by: Stephen P. Lutar Jr. stephenlutar2@gmail.com

[Lutar, Stephen P. (stephenlutar2-hash)]

Superseded by #352 after live verification showed this replacement was based on a stale local remote-tracking ref. #352 is rebuilt on the server's exact current protected main SHA, with the same exact retirement tree and no force push or history rewrite. Closing this stale-base predecessor without merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f8dfa8253

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[chatgpt-codex-connector]

Run the tombstone for every scanned executable

When a PR adds a forbidden marker to any other .github/workflows/*.yml or .github/scripts/*.py, this workflow is skipped because the paths filter names only the tombstone and three retired paths, even though the test scans every workflow and script. The repository-wide tests.yml workflow also does not invoke this new test, so a renamed resurrection can merge without exercising the guard; use wildcard triggers for the scanned directories or add this test to the broadly triggered test suite.

Useful? React with 👍 / 👎.