fix(ci): initialize required PCS workspace checkout and contributor toolchains

.gitattributes

@@ -1,3 +1,7 @@
 # Bash recipes and shims must stay LF (Git Bash / Linux CI).
 *.sh text eol=lf
 scripts/node_bin/node text eol=lf
+
+# These externally digested release artifacts must retain exact byte encodings.
+tests/pcs/fixtures/computation-release/*.json -text
+tests/pcs/fixtures/computation-rejected-release/*.json -text

.github/workflows/benchmark.yml

@@ -11,6 +11,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Checkout pcs-core (workspace dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
+          path: pcs-core
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
+
       - uses: astral-sh/setup-uv@v4
 
       - name: Install deps

.github/workflows/contributor-dry-run-monthly.yml

@@ -10,14 +10,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Checkout pcs-core (workspace dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
+          path: pcs-core
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
       - uses: astral-sh/setup-uv@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: "10.0.0"
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
           cache: "pnpm"
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
+      - name: Install elan for Lean build
+        run: |
+          curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y --default-toolchain none
+          echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
       - name: Install Python deps
         run: uv sync --all-packages
       - name: Install portal deps

.github/workflows/corpus-validation.yml

@@ -15,8 +15,16 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
           path: pcs-core
-        continue-on-error: true
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
 
       - uses: astral-sh/setup-uv@v4
 
@@ -29,7 +37,7 @@ jobs:
 
       - name: Sync PCS benchmark schemas from pcs-core
         if: hashFiles('pcs-core/schemas/**') != ''
-        run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core
+        run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core/schemas
 
       - name: Install pcs-core extra (when checked out)
         run: |
@@ -46,11 +54,11 @@ jobs:
 
       - name: Install pcs-bench CLI
         if: hashFiles('pcs-bench/pyproject.toml') != ''
-        run: uv pip install --system -e pcs-bench
+        run: uv pip install --python .venv/bin/python -e pcs-bench
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: "10.0.0"
 
       - uses: actions/setup-node@v4
         with:
@@ -77,7 +85,7 @@ jobs:
         run: uv run --project pipeline python -m sm_pipeline.cli validate-all
 
       - name: Run pipeline tests
-        run: uv run --project pipeline pytest
+        run: uv run --all-packages pytest
 
       - name: Run PCS contract tests
         env:

.github/workflows/mcp-contract.yml

@@ -11,6 +11,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Checkout pcs-core (workspace dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
+          path: pcs-core
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
       - uses: astral-sh/setup-uv@v4
       - name: Install deps (including MCP extras)
         run: uv sync --all-packages --extra mcp

.github/workflows/pcs-bench-producer.yml

@@ -29,8 +29,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
           path: pcs-core
 
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
+
       - name: Checkout pcs-bench
         uses: actions/checkout@v4
         with:
@@ -49,7 +58,7 @@ jobs:
         run: uv pip install --system -e pcs-bench
 
       - name: Sync PCS benchmark schemas
-        run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core
+        run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core/schemas
 
       - name: LabTrust producer gate (release-grade)
         env:

.github/workflows/portal-ci.yml

@@ -13,7 +13,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: "10.0.0"
 
       - uses: actions/setup-node@v4
         with:

.github/workflows/release.yml

@@ -15,10 +15,25 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Checkout pcs-core (workspace dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
+          path: pcs-core
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
+
       - uses: astral-sh/setup-uv@v4
       - uses: pnpm/action-setup@v4
         with:
-          version: 10
+          version: "10.0.0"
       - uses: actions/setup-node@v4
         with:
           node-version: 22

.github/workflows/security-sarif.yml

@@ -15,12 +15,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Checkout pcs-core (workspace dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: SentinelOps-CI/pcs-core
+          ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b
+          path: pcs-core
+
+      - name: Make PCS dependency available at uv.lock sibling path
+        run: |
+          test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml"
+          ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core"
+
+      - name: Verify pinned PCS revision and repair upstream packaging metadata
+        run: python scripts/prepare_pcs_core_workspace.py
       - uses: astral-sh/setup-uv@v4
       - name: Install Python deps
         run: uv sync --all-packages
       - name: Generate Ruff SARIF (warning-first)
         run: |
-          uv run --project pipeline ruff check pipeline kernels kernels/conformance scripts tests --output-format sarif --exit-zero > ruff.sarif
+          uvx --from ruff==0.17.0 ruff check pipeline kernels kernels/conformance scripts tests --output-format sarif --exit-zero > ruff.sarif
       - name: Upload SARIF to code scanning
         uses: github/codeql-action/upload-sarif@v3
         with:

portal/app/pcs/claims/[claimId]/page.tsx

@@ -22,9 +22,14 @@ export default async function PcsClaimRoute({
         <h1 className="text-3xl font-semibold">PCS claim not found</h1>
         <p className="mt-2 text-gray-600">
           No imported claim with id “{claimId}”. Run{" "}
-          <code className="rounded bg-gray-100 px-1">just pcs-import-bundle</code>{" "}
+          <code className="rounded bg-gray-100 px-1">
+            just pcs-import-bundle
+          </code>{" "}
           then{" "}
-          <code className="rounded bg-gray-100 px-1">just pcs-render-claim</code>.
+          <code className="rounded bg-gray-100 px-1">
+            just pcs-render-claim
+          </code>
+          .
         </p>
       </main>
     );

portal/app/pcs/page.tsx

@@ -16,9 +16,14 @@ export default async function PcsClaimsIndexPage() {
       {claimIds.length === 0 ? (
         <p className="mt-6 text-sm text-gray-600">
           No claims imported yet. Run{" "}
-          <code className="rounded bg-gray-100 px-1">just pcs-import-release</code>{" "}
+          <code className="rounded bg-gray-100 px-1">
+            just pcs-import-release
+          </code>{" "}
           then{" "}
-          <code className="rounded bg-gray-100 px-1">just pcs-render-claim claim-pcs-qc-release-v0.1</code>.
+          <code className="rounded bg-gray-100 px-1">
+            just pcs-render-claim claim-pcs-qc-release-v0.1
+          </code>
+          .
         </p>
       ) : (
         <ul className="mt-6 space-y-3">
@@ -29,7 +34,11 @@ export default async function PcsClaimsIndexPage() {
               const stale = model?.staleness?.stale === true;
               return (
                 <li key={claimId} className="rounded border p-4">
-                  <ClaimListHeader claimId={claimId} releaseId={releaseId} stale={stale} />
+                  <ClaimListHeader
+                    claimId={claimId}
+                    releaseId={releaseId}
+                    stale={stale}
+                  />
                   {model?.claim?.text != null && (
                     <p className="mt-2 line-clamp-2 text-sm text-gray-700">
                       {model.claim.text}

portal/lib/pcsData.ts

@@ -13,7 +13,9 @@ async function readPcsExport(): Promise<PcsPortalExport | null> {
   return JSON.parse(raw) as PcsPortalExport;
 }
 
-async function readClaimFromCorpus(claimId: string): Promise<PcsClaimReadModel | null> {
+async function readClaimFromCorpus(
+  claimId: string,
+): Promise<PcsClaimReadModel | null> {
   const p = path.join(CORPUS_PCS, claimId, "read_model.json");
   const raw = await fs.readFile(p, "utf8").catch(() => null);
   if (!raw) return null;
@@ -25,7 +27,9 @@ export async function getAllPcsClaimIds(): Promise<string[]> {
   if (exported?.claim_ids?.length) {
     return exported.claim_ids;
   }
-  const entries = await fs.readdir(CORPUS_PCS, { withFileTypes: true }).catch(() => []);
+  const entries = await fs
+    .readdir(CORPUS_PCS, { withFileTypes: true })
+    .catch(() => []);
   return entries.filter((e) => e.isDirectory()).map((e) => e.name);
 }