[bryansayler]

Outcome

Preserve the reusable validator's ubuntu-latest default while allowing only explicit ubuntu-24.04 retention or ubuntu-26.04 preflight. Unknown values cannot select arbitrary/self-hosted runners and fail before setup. Verify the exact PR head, record OS/image and bound execution to 20 minutes.

Governance Contracts tests the actual same-repository reusable workflow via GitHub's exact self-repository syntax on Ubuntu 24 and 26 using an npm fixture with locked Playwright 1.63.0 and Chromium/Firefox/WebKit. An additive Ubuntu 26 job tests the semantic registry and governance suite with system Python. Preserve the original validate/evidence gate, existing action pins, existing exemptions, permissions and consumers.

Exact subject

• Base: eb889ad
• Tested implementation subject: 9f77208
• Head, separate evidence commit: 7f18e49
• Receipt: .quirk/evidence/ubuntu26-preflight-9f7720814e8b.json
• Receipt digest: sha256:f51e95f0b0a7fc83aee48288ac7e47832b7afdc4a369f46d41ebf7dec10678f8

Scope and authority

IMPLEMENTATION_DETAIL; projection-only migration audit. No canonical concepts, schemas or existing remote consumer pins change. No merge, admission, runtime mutation, release, deployment, publication or protection changes are authorized by these files. Bryan retains the human merge gate. Head changes require fresh evaluation.

Evidence and verification

scripts/validate.sh passed at the implementation subject: 237 tests, existing receipts/decisions, registry, assets, manifests, portfolio, templates, tasks, tokens, living docs, JSON and offline pedantic zizmor. Ruff and actionlint unavailable locally; hosted lint remains required. Fixture lint/type-check/unit/build passed locally. Regression tests cover invalid runner choices, stale heads, known choices and the closed mapping. An existing checkout assertion was made gate-specific while enforcing nonpersistent credentials on every added checkout.

Hosted proof at exact head 7f18e49 is complete: Governance Contracts run https://github.com/Quirk-Systems/.github/actions/runs/37812277767 passed all four jobs. The actual reusable npm workflow installed OS dependencies and passed Chromium, Firefox and WebKit on both Ubuntu 24.04 and 26.04; the Ubuntu 26 system-Python governance probe passed. Workflow Lint, Dependency Review and CodeQL also passed. No universal compatibility claim. Shared fixture proof covers the npm path, not every package manager or app. docs/governance/UBUNTU_26_AUDIT.md records the public source inventory and selective-retention criteria; CHANGELOG.md and reusable-workflow docs document behavior and rollback.

Risk, rollback, and residue

Additive probes consume CI time; no secrets or write permissions. Remove the probe jobs/input/fixture to revert. Existing Ubuntu 24 governance policy remains. No observed default-branch caller consumes reusable-validate; older semantic-workflow SHA pins retain their own latest-label exposure until separately reviewed. Native dependency failures require app-specific repair or documented temporary job retention, not blanket pinning.

Hosted preflight repairs

Protected full-SHA policy rejected the inherited oven-sh/setup-bun@v2 even in a skipped npm step. Pin to verified v2.2.0 commit 0c5077e51419868618aeaa5fe8019c62421857d6; do not weaken the protection. The nested fixture then exposed root-only setup-node lockfile discovery on both OS images. Resolve npm/yarn/pnpm lockfiles from inputs.working-directory. These are infrastructure defects, not Ubuntu 26-specific failures.

Latest tested repair subject: dc7ada4; local scripts/validate.sh passed (237 tests and offline zizmor). Fresh repair receipt: .quirk/evidence/ubuntu26-preflight-repair-dc7ada466704.json, digest sha256:94bf76da98540d67fb7c1dd8eb5f17e4552f980b730652641adc4761507a79a2, base 51d671d. Receipt coverage is cumulative with the original receipt. Final-head hosted system-Python, browser, governance and evidence gates passed. Local cumulative exact-head evidence coverage passed (84 receipts). No approval or merge claim.