From 798559b4dbc2308485ff8b1e4d2c9abcdc06332b Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 19:34:09 -0500
Subject: [PATCH 1/6] test(ci): source-free native Git atomic lease provider
 probe

---
 .../synthetic-native-git-lease-probe.yml      | 95 +++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 .github/workflows/synthetic-native-git-lease-probe.yml

diff --git a/.github/workflows/synthetic-native-git-lease-probe.yml b/.github/workflows/synthetic-native-git-lease-probe.yml
new file mode 100644
index 0000000..71e01fb
--- /dev/null
+++ b/.github/workflows/synthetic-native-git-lease-probe.yml
@@ -0,0 +1,95 @@
+name: Synthetic native Git atomic lease probe
+on:
+  push:
+    branches: [ci/synthetic-native-git-lease-probe-20261030]
+  workflow_dispatch:
+permissions:
+  contents: write
+jobs:
+  native-git-lease:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 8
+    steps:
+      - name: Checkout local test repository only
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Exercise native two-ref atomic compare-and-delete on synthetic refs
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = "zed-pkg-test/python-lib"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          command -v git
+          command -v gh
+          # This credential is scoped to the local Actions repository and is
+          # never copied to another organization or committed to a tree.
+          gh auth setup-git --hostname github.com
+          remote="https://github.com/$GITHUB_REPOSITORY.git"
+          root="ci/sourcefree-lease-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          a="refs/heads/$root-a"
+          b="refs/heads/$root-b"
+          head="$(git rev-parse HEAD)"
+          moved=""
+          get_sha() {
+            git ls-remote "$remote" "$1" | awk '{print $1}'
+          }
+          cleanup() {
+            # Synthetic test refs only. Never blindly delete an unexpected SHA.
+            set +e
+            for ref in "$a" "$b"; do
+              now="$(get_sha "$ref")"
+              if [[ -z "$now" ]]; then continue; fi
+              if [[ "$now" == "$head" || ( -n "$moved" && "$now" == "$moved" ) ]]; then
+                git push --force-with-lease="$ref:$now" "$remote" ":$ref" >/dev/null 2>&1
+              else
+                echo "SYNTHETIC_REF_CLEANUP_REQUIRES_REVIEW=$ref" >&2
+              fi
+            done
+          }
+          trap cleanup EXIT
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          git push --atomic "$remote" "HEAD:$a" "HEAD:$b" >/dev/null
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          echo "EXACT_TWO_REF_INITIALIZATION=PASS"
+
+          # Another writer moves B after the first read. The stale deletion
+          # must fail atomically, leaving A untouched and B at the new SHA.
+          export GIT_AUTHOR_NAME="Synthetic Git Probe"
+          export GIT_AUTHOR_EMAIL="synthetic-atomic-probe@example.invalid"
+          export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME"
+          export GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"
+          moved="$(printf 'source-free synthetic lease mutation\n' | git commit-tree 'HEAD^{tree}' -p HEAD)"
+          git push --force-with-lease="$b:$head" "$remote" "$moved:$b" >/dev/null
+          test "$(get_sha "$b")" = "$moved"
+          if git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null 2>&1; then
+            echo "CRITICAL: stale lease deleted synthetic refs" >&2
+            exit 1
+          fi
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$moved"
+          echo "STALE_LEASE_ATOMIC_ABORT=PASS"
+
+          # Correct leases must then delete BOTH refs as one transaction.
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$moved" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          echo "TWO_REF_ATOMIC_DELETE=PASS"
+          echo "GITHUB_PROVIDER_ATOMIC_LEASE_PROBE=PASS"
+      - name: Delimit evidence and residual ABA risk
+        run: |
+          echo 'Only two synthetic same-repository Git ref names and synthetic commit were used.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'No source from another repository, cross-organization token, or publisher was involved.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'Exact-SHA force-with-lease does not detect ABA when a ref moves away and returns to the expected SHA.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'This is a provider transport probe, not private export authorization or retention remediation.' >> "$GITHUB_STEP_SUMMARY"

From deaa0a5cc1154ebf708955b680921578024d0ae3 Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 19:35:01 -0500
Subject: [PATCH 2/6] test(ci): verify GitHub absent-lease race and ABA
 limitation with synthetic refs

---
 .../synthetic-native-git-lease-probe.yml      | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/.github/workflows/synthetic-native-git-lease-probe.yml b/.github/workflows/synthetic-native-git-lease-probe.yml
index 71e01fb..51d022d 100644
--- a/.github/workflows/synthetic-native-git-lease-probe.yml
+++ b/.github/workflows/synthetic-native-git-lease-probe.yml
@@ -86,6 +86,43 @@ jobs:
           test -z "$(get_sha "$a")"
           test -z "$(get_sha "$b")"
           echo "TWO_REF_ATOMIC_DELETE=PASS"
+          # An authorization ref absent during pre-read may appear before
+          # the push. Its empty expected-old lease must abort BOTH deletions.
+          git push --force-with-lease="$a:" "$remote" "HEAD:$a" >/dev/null
+          test -z "$(get_sha "$b")"
+          git push --force-with-lease="$b:" "$remote" "HEAD:$b" >/dev/null
+          if git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:" \
+              "$remote" ":$a" ":$b" >/dev/null 2>&1; then
+            echo "CRITICAL: newly created marker escaped absent-ref lease" >&2
+            exit 1
+          fi
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          echo "CONCURRENT_CREATION_ATOMIC_ABORT=PASS"
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+
+          # Deliberate ABA demonstration: head -> other -> head. Git's SHA
+          # lease accepts the original hash after intervening changes.
+          # This is a confirmed LIMITATION, not a security PASS.
+          git push --atomic "$remote" "HEAD:$a" "HEAD:$b" >/dev/null
+          git push --force-with-lease="$b:$head" "$remote" "$moved:$b" >/dev/null
+          git push --force-with-lease="$b:$moved" "$remote" "$head:$b" >/dev/null
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          echo "GITHUB_ABA_NOT_DETECTED_BY_SHA_LEASE=CONFIRMED_LIMITATION"
           echo "GITHUB_PROVIDER_ATOMIC_LEASE_PROBE=PASS"
       - name: Delimit evidence and residual ABA risk
         run: |

From 9c06a42319f9d2e703dca56fae4a85ebd96a979b Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 19:37:35 -0500
Subject: [PATCH 3/6] test(ci): emit synthetic unreachable commit for GitHub
 object-retention check

---
 .github/workflows/synthetic-native-git-lease-probe.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/synthetic-native-git-lease-probe.yml b/.github/workflows/synthetic-native-git-lease-probe.yml
index 51d022d..d7d6829 100644
--- a/.github/workflows/synthetic-native-git-lease-probe.yml
+++ b/.github/workflows/synthetic-native-git-lease-probe.yml
@@ -123,6 +123,10 @@ jobs:
           test -z "$(get_sha "$a")"
           test -z "$(get_sha "$b")"
           echo "GITHUB_ABA_NOT_DETECTED_BY_SHA_LEASE=CONFIRMED_LIMITATION"
+          # A ref deletion is not an object erasure guarantee. Reveal only
+          # this newly synthesized, source-free commit for later read-only API
+          # reachability checks, never a private source object.
+          echo "SYNTHETIC_UNREFERENCED_COMMIT_SHA=$moved"
           echo "GITHUB_PROVIDER_ATOMIC_LEASE_PROBE=PASS"
       - name: Delimit evidence and residual ABA risk
         run: |

From bc60af697056d4b26c8fc2df7c13b7b816a431ed Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 20:04:41 -0500
Subject: [PATCH 4/6] test(ci): verify GitHub actual PR-head identity and exact
 clean checkout (source-free)

---
 .../sourcefree-exact-pr-preflight.yml         | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/sourcefree-exact-pr-preflight.yml

diff --git a/.github/workflows/sourcefree-exact-pr-preflight.yml b/.github/workflows/sourcefree-exact-pr-preflight.yml
new file mode 100644
index 0000000..d8a46a5
--- /dev/null
+++ b/.github/workflows/sourcefree-exact-pr-preflight.yml
@@ -0,0 +1,57 @@
+name: Synthetic exact-head PR admission proof
+on:
+  push:
+    branches: [ci/synthetic-native-git-lease-probe-20261030]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  source-free-head-admission:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 7
+    steps:
+      - name: Verify GitHub API PR head matches exact workflow commit
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = 'zed-pkg-test/python-lib'
+          expected_sha="$GITHUB_SHA"
+          [[ "$expected_sha" =~ ^[0-9a-f]{40}$ ]]
+          command -v gh
+          receipt="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/3" \
+            --jq '[.head.sha, .head.repo.full_name, .state, (.head.repo.private|tostring)] | @tsv')"
+          IFS=$'\t' read -r actual_sha actual_repo state private <<< "$receipt"
+          test "$actual_sha" = "$expected_sha"
+          test "$actual_repo" = "$GITHUB_REPOSITORY"
+          test "$state" = 'open'
+          test "$private" = 'false'
+          if [[ "$actual_sha" == 0000000000000000000000000000000000000000 ]]; then
+            echo "CRITICAL: invalid source commit admitted" >&2
+            exit 1
+          fi
+          echo 'SOURCEFREE_EXACT_PR_SHA_ADMISSION=PASS'
+      - name: Checkout pinned exact public source-free commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+          submodules: false
+          lfs: false
+      - name: Verify checked out tree and no persisted checkout credentials
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          git diff --quiet --exit-code
+          test -z "$(git ls-files --others --exclude-standard)"
+          test -f .github/workflows/synthetic-native-git-lease-probe.yml
+          test -f .github/workflows/sourcefree-exact-pr-preflight.yml
+          echo "SOURCEFREE_EXACT_TREE_SHA=$(git rev-parse 'HEAD^{tree}')"
+          echo 'SOURCEFREE_EXACT_CHECKOUT=PASS'
+      - name: Scope result
+        run: |
+          echo 'Source-free GitHub PR identity/checkout test only.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'This does not verify any private Oreslang code, self-hosted runner, or real guest execution.' >> "$GITHUB_STEP_SUMMARY"

From d1ddc66b6776c54f78033283ebb6a7a33e8dd2d5 Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 20:54:53 -0500
Subject: [PATCH 5/6] test(ci): live source-free denial of unprotected main and
 missing exact-head approval

---
 .../sourcefree-exact-pr-preflight.yml         | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/.github/workflows/sourcefree-exact-pr-preflight.yml b/.github/workflows/sourcefree-exact-pr-preflight.yml
index d8a46a5..274e50b 100644
--- a/.github/workflows/sourcefree-exact-pr-preflight.yml
+++ b/.github/workflows/sourcefree-exact-pr-preflight.yml
@@ -51,6 +51,31 @@ jobs:
           test -f .github/workflows/sourcefree-exact-pr-preflight.yml
           echo "SOURCEFREE_EXACT_TREE_SHA=$(git rev-parse 'HEAD^{tree}')"
           echo 'SOURCEFREE_EXACT_CHECKOUT=PASS'
+      - name: Verify source-free fail-closed negative gates against live GitHub
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = "zed-pkg-test/python-lib"
+          protected_main="$(gh api "repos/${GITHUB_REPOSITORY}/branches/main" --jq '.protected')"
+          test "$protected_main" = "false"
+          echo "UNPROTECTED_MAIN_WOULD_BE_DENIED=PASS"
+          last_review="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/3/reviews?per_page=100" \
+            --jq 'if length >= 100 then "TOO_MANY_REVIEWS" else
+              ([.[] | select(.user.login == "ORESoftware" and .submitted_at != null)]
+               | sort_by(.submitted_at) | last // {}
+               | [(.state // ""), (.commit_id // ""), (.user.id // 0 | tostring)] | @tsv)
+            end')"
+          expected="APPROVED"
+          actual_state="${last_review%%
+        run: |
+          echo 'Source-free GitHub PR identity/checkout test only.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'This does not verify any private Oreslang code, self-hosted runner, or real guest execution.' >> "$GITHUB_STEP_SUMMARY"
+\t'*}"
+          test "$actual_state" != "$expected"
+          echo "UNREVIEWED_PR_WOULD_BE_DENIED=PASS"
+          echo "SOURCEFREE_PROTECTED_MAIN_AND_REVIEW_NEGATIVE_PROBE=PASS"
       - name: Scope result
         run: |
           echo 'Source-free GitHub PR identity/checkout test only.' >> "$GITHUB_STEP_SUMMARY"

From 237ec2eec69395974e15d480e67b54103540890d Mon Sep 17 00:00:00 2001
From: "Mr. Denman Mills" <alexmillsmail@gmail.com>
Date: Fri, 30 Oct 2026 20:55:59 -0500
Subject: [PATCH 6/6] fix(ci): repair source-free negative proof YAML without
 replacement expansion

---
 .github/workflows/sourcefree-exact-pr-preflight.yml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/sourcefree-exact-pr-preflight.yml b/.github/workflows/sourcefree-exact-pr-preflight.yml
index 274e50b..79434dc 100644
--- a/.github/workflows/sourcefree-exact-pr-preflight.yml
+++ b/.github/workflows/sourcefree-exact-pr-preflight.yml
@@ -67,13 +67,8 @@ jobs:
                | sort_by(.submitted_at) | last // {}
                | [(.state // ""), (.commit_id // ""), (.user.id // 0 | tostring)] | @tsv)
             end')"
-          expected="APPROVED"
-          actual_state="${last_review%%
-        run: |
-          echo 'Source-free GitHub PR identity/checkout test only.' >> "$GITHUB_STEP_SUMMARY"
-          echo 'This does not verify any private Oreslang code, self-hosted runner, or real guest execution.' >> "$GITHUB_STEP_SUMMARY"
-\t'*}"
-          test "$actual_state" != "$expected"
+          IFS=$'\t' read -r review_state review_commit reviewer_id <<< "$last_review"
+          test "$review_state" != "APPROVED"
           echo "UNREVIEWED_PR_WOULD_BE_DENIED=PASS"
           echo "SOURCEFREE_PROTECTED_MAIN_AND_REVIEW_NEGATIVE_PROBE=PASS"
       - name: Scope result