Outcome

The protected GPU controller can project independently approved OpenShell installer and runtime templates from the candidate commit. Candidates covered by main's existing trust records retain their existing path.

Reason

The controller rejected the approved OpenShell upgrade in #12603 before GPU qualification started. It validated candidate templates only against main's registry, although the installer check already supported commit-bound candidate admission.

Historical failure: protected GPU job in run 39206820005.

Related issues

Refs #12603.

Changes

• Reuse the existing independent maintainer approval check for new candidate trust during prepare, verify, and restore.
• Compare the admitted registry and installer consumers with immutable candidate Git blobs before changing the trusted checkout.
• Pass the admitted releases to both installer and feature-gate validation; retain artifact identity, revocation, SDK archive, and projection restrictions.
• Give only the four admission steps a read-only GitHub token. Verify approval before installing the reviewed SDK or building the controller, then recheck before live qualification.
• Preserve rejection without mutation, partial-write rollback, and ownership checks. Document restoration failure when approval is revoked.

Verification

• node node_modules/vitest/vitest.mjs run --project e2e-support with the protected workspace, projection, workflow, candidate trust, and upgrade admission test files — 241 tests passed.
• Workspace regressions rerun after fixture restructuring — 22 tests passed.
• Revision 95cad4745bec8bf5d0d1b0d6a69d37d77858aaaa: the focused protected-runtime workflow guard suite passed 111 tests, including rejection of SDK installation before approval verification.
• npm run docs — 125 routes checked; Fern reported zero errors and two warnings.
• Normal pre-commit, commit-msg, and pre-push hooks — passed, including publication validation and CLI/plugin/JS-config TypeScript checks.
• Exact-head manual PR E2E passed: jobs=cloud-onboard,full-e2e,security-posture (run 39302613910) and jobs=managed-image-protected-runtime (run 39305366189). See the E2E evidence comment for selectors, tested commit, and receipts.
• No live E2E assertions or budgets changed. No secrets, API keys, or credentials added.

Review notes

This repairs candidate admission only. The full protected GPU suite passed on this PR head with the candidate OpenShell 0.0.116 inputs recorded in its artifact. That result does not qualify the separate OpenShell 0.1.3 upgrade in #12603. Its trusted harness still needs the inference set and Docker bridge migrations before that upgrade can be qualified.

The workflow change must land on main before #12603's trusted controller can use it. This PR does not authorize merging #12603 or claim 0.1.3 GPU platform qualification. Independent code, security, and documentation review covered commit 18b4a45c22aa066f6ad6d7e1a44499f14200614b. Exact-head CI and CodeRabbit review completed on 95cad4745bec8bf5d0d1b0d6a69d37d77858aaaa; the self-hosted llama.cpp GPU check passed on its second attempt. The Advisor reported three P1 findings, all rejected in the maintainer disposition; its blocker gate remains red. Independent human review and maintainer acceptance remain required.

If approval is revoked or GitHub admission becomes unavailable after preparation, verification and restoration fail without changing projected files. The isolated checkout remains for diagnosis; stale approval is not reused.

Signed-off-by: Prekshi Vyas [email protected] Signed-off-by: Rebecca Sliter [email protected]

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->

Summary by CodeRabbit

• Security
  • Protected E2E runtime operations now check candidate approval before projecting OpenShell sources when the candidate is not already trusted. Approval checks apply to preparation, verification, and restoration.
  • OpenShell verification now runs before SDK download and remains in place after installation. The workflow has read-only access to pull request details for approval checks.
• Documentation
  • Clarified approval requirements, token scope, verification order, failure outcomes, and recovery guidance. Approval does not permit new SDK dependency graphs on protected E2E hosts, qualify Pi, or pass candidate catalogs to the Jetson operator. <!-- end of auto-generated comment: release notes by coderabbit.ai -->