[rmcdaniel]

The required workflow is loaded from protected main, so #387 cannot update the runtime used to judge its own changed CI/Sonar bytes. This separate wrapper update pins its checkout to source-only #391’s accepted immutable runtime d4770e6555fdb59b044f2e5919e95a24c0a25073 after all three actual-main workflows passed.

The complete change is one runtime SHA replacement in native-policy.yml and a stronger structural assertion requiring that exact accepted SHA. CI/Sonar workflows, parser/selector logic, permissions, credentials and runtime preparation commands are unchanged. The accepted source adds only the independently reviewed exact future CI/Sonar workflow identities and refusal controls; Security source PASS, source/main acceptance.

After exact wrapper review, normal required checks/merge and main readback here, #387 will refresh onto this accepted main and obtain fresh required-workflow/Sonar/exact-head review. No held proxy/installed/legacy/upgrade acceptance or gate bypass is claimed.

Validation: focused native workflow/native policy/protected context controls passed; diff and added-source secret checks passed. No build/runtime experiment or provider operation.

[rmcdaniel]

Security exact-head review: PASS for 1d3cd491111d710801c6e4ad0aed18ee031f7e38 (tree 3cf6a999a24635459f53cb90aae8d8281151dbdd).

The complete delta from accepted main d4770e6555fdb59b044f2e5919e95a24c0a25073 is exactly two literal lines:

• the required native-policy wrapper's single central-runtime checkout changes from accepted predecessor b7da972634348e9bb27ff3653c383e93965ce043 to accepted Register exact response-loss CI workflow identities #391 main d4770e6555fdb59b044f2e5919e95a24c0a25073; and
• the existing workflow control now requires that exact 40-character ref rather than only its shape.

Repository, path, credential persistence, permissions, bootstrap, parser installation, validation command, and every other workflow byte are unchanged. Live CI and Sonar remain at their predecessor hashes 363540f9... / f7fad836...; this PR does not adopt #387's successors.

git diff --check is clean, the focused native-policy workflow suite passes 5/5, and the actual required Validate native policy subject job passes. CodeQL and analysis lanes are green; shared contracts and Sonar were still pending at this readback and remain merge gates.

This approves only the minimal accepted-wrapper runtime pin. After normal merge and green actual-main gates, #387 must refresh onto that accepted main and pass its own exact protected caller; no #387 source or consumer acceptance is inferred here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Wrapper #392 delivered at main fe31a00ab3081004846fedd914404df9fdf1e00e, tree 3cf6a999a24635459f53cb90aae8d8281151dbdd, exactly equal to independently reviewed 1d3cd49. All nine current PR checks were green before normal merge. The owned topic branch was deleted after verifying its head; remote absence was verified.

All three actual-main workflows passed: Repository checks 43450873776, Sonar 43450873870, CodeQL 43450873424. Exact Security verdict.

Protected main now loads only the previously accepted immutable d4770e6 runtime. CI/Sonar remain unchanged in this wrapper merge. Separate #387 has been normal-refreshed onto this accepted wrapper and requires a fresh actual protected job, exact Security review, all current checks and main acceptance. No held fixture/consumer/#216 acceptance is inferred here.