[avivka]

Summary

Repair the public fork's task gate and merged-task notifier, which cannot load executable actions from the private Workspace repository. Keep the existing task contract and Workspace authority; do not skip checks or mark a task complete locally.

Task-ID: none

This is a non-task CI repair, not completion of native prewarm Task 34.01.03.

Related Issue

No issue required: localized repair of the existing CI action-resolution failure (Unable to resolve action globster-monday/workspace, not found). It blocks #32 before task validation starts.

Changes

• Independently authored public stdlib validator; no private executable source is downloaded or republished.
• Check task metadata using only immutable trusted default-branch code (github.sha) and a Workspace-scoped contents-read installation token.
• Preserve exactly-one Task-ID validation, bot/non-task exceptions, actionable task metadata and mirrored-record checks.
• Notify Workspace only after a main-branch merge, using the same trusted default-branch code, the existing task-merged payload and a separate Workspace-scoped dispatch token. Workspace still verifies the authoritative PR before updating state.
• Do not interpolate PR text into shell programs, check out an untrusted PR head, print private task contents, weaken fsGroup/grants, deploy anything or enable prewarm.

Testing

• Three focused unittest methods, including malformed/duplicate task IDs and metadata, incomplete/ambiguous tree, wrong task/status/mirror, non-main/unmerged notification rejection and dispatch compatibility.
• Repository-pinned Ruff 0.14.14 lint and format.
• Actionlint 1.7.12 on both changed workflows.
• Scoped SPDX and git diff checks.
• Actual native PR metadata parsing and read-only Workspace task validation with the local authenticated GitHub identity; system CA trust supplied for this host's Python. This does not prove installation-secret access on Actions.
• Aggregate mise run pre-commit: attempted with automatic tool installation disabled; blocked by missing cargo and markdownlint on the task runner PATH. Focused checks above pass.
• Hosted replacement workflow and installation-token verification: requires this trusted-base repair to land first. pull_request_target still runs the old base workflow on this PR.

Checklist

• Conventional Commit and DCO sign-off.
• Reviewed the CI skill maintenance map; no stale task-gate instructions in watch-github-actions.
• Updated the existing build architecture overview.

Maintainer action

Review and land this base-workflow repair using the repository's approved process; no required-check bypass or status override has been performed. Confirm the existing TASK_SYNC_APP_ID / TASK_SYNC_APP_PRIVATE_KEY organization-secret access for this public fork, then trigger and inspect the native task gate. The current account has write, not administrative access, and cannot confirm the organization-secret policy. Native prewarm remains draft, v2-rejected and disabled regardless of this CI repair.

The normal squash merge of the initial head was attempted on owner direction and rejected by base-branch policy. CodeQL also flagged the notifier's PR-provided merge SHA; both checkouts now use trusted github.sha instead, without suppressing the scanner or executing PR-selected code.

[avivka]

@NaveCohenMonday this needs a repository admin. The required check-task-id status is produced by the old default-branch workflow, which cannot load the private Workspace action, so this repair can never satisfy the check it replaces (bootstrap cycle). Please review and choose a landing path, and confirm TASK_SYNC_APP_ID / TASK_SYNC_APP_PRIVATE_KEY organization-secret access for this fork. Head 78de81b9 pins both privileged checkouts to trusted github.sha; the CodeQL result is neutral (missing Rust configuration on main), not a pass. It blocks the task gate for the native PR #32.

[avivka]

@orsharon7 review requested. Public task-ID CI repair; blocked by a bootstrap cycle because the required check-task-id status still runs the old default-branch workflow. Needs an admin landing path (Nave tagged) and confirmation that the task-sync org secrets reach this fork. CodeQL is neutral, not a pass.