[bokelley]

Summary

Make the 13.x generated-file gate deterministic by generating registry types from the checked-in schemas/registry/registry.yaml snapshot instead of the live unpinned registry endpoint.

The workflow hashes the checked-in schema, generates twice without --sync, verifies the second output is byte-identical, and retains the tracked generated-file diff gate so meaningful schema or type drift still fails.

Exact stack

• Base PR: fix(deps): remediate transitive audit advisories #2891 (conductor/repair-13x-dependency-audit)
• Base: e7ab513f0e5603fef3d754b0c128cbfc008bb4bd
• Head: ed30537c3222515b96613fbf7bb8318bbc65cbb4
• Tree: 6fcbc6b1d14e608dcfd442a2f9e1bc646cd54ca9
• Next: ci(13.x): run CI, CodeQL and interop on the maintenance branch #2893 (conductor/13x-ci-enablement) — CI, CodeQL, and interop enablement
• Final sequence: fix(deps): remediate transitive audit advisories #2891 → this P2 → ci(13.x): run CI, CodeQL and interop on the maintenance branch #2893 → refresh fix(compliance): align required tools selector semantics #2890 onto the resulting 13.x tip

Evidence

• Rebase range-diff: both reviewed commits =; P2 binary patch and workflow blobs are unchanged
• npm ci — passed
• npm audit — 0 vulnerabilities
• Workflow lint — 16/16 passed
• Two offline registry generations — schema and type hashes unchanged
• Detached normal generated-check sequence — passed with no tracked diff
• Workflow-only changeset simulation — passed
• Repository format and diff checks — passed
• Fresh independent exact-stack review — no blockers

Release and protection boundary

This PR is workflow-only and does not change package versions, release triggers, permissions, tags, npm state, or GitHub settings. Checks remain advisory because 13.x is currently unprotected.

The workflow changes cannot self-prove their new 13.x pull-request trigger on these PRs because the base workflows exclude 13.x. After P3 lands, maintainers must observe exact new checks, configure protection separately, and refresh #2890. No auto-merge is requested.

[aao-secretariat]

Ladon verdict: Approve

Approve — workflow-only PR (+7/-3, two files: .github/workflows/changeset-check.yml, .github/workflows/ci.yml).

Checked:

• Makes the 13.x registry-types generated-file gate deterministic by dropping --sync, hashing the checked-in schema, generating twice, and verifying byte-identical output. The determinism block does not flake on the // Generated at: timestamp because writeFileIfChanged skips writes when only the timestamp differs; the unchanged git diff -I gate still catches real schema drift.
• Changeset correctly not required — .github/workflows/** is exempt, and the exemption is correctly extended to ci.yml.
• No touches to src/lib/**, bin/**, or transport clients; witness-not-translator and official-transport rules not implicated.

No blocking or medium findings. high_risk false, gated_paths false, no author team gate. Falls through to row 9.