ORESoftware · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026
diff --git a/.github/workflows/gitops-current-main-adversarial.yml b/.github/workflows/gitops-current-main-adversarial.yml
@@ -0,0 +1,170 @@
+name: current-main GitOps adversarial matrix
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/gitops-current-main-adversarial.yml
+      - scripts/gitops_current_main_adversarial.py
+      - docs/gitops-current-main-adversarial.md
+  workflow_dispatch:
+    inputs:
+      product_commit:
+        description: Exact zed-pkg/zed-cli main commit
+        required: false
+        default: 5d1d13119be5784f545a7d812cdfaae3ca120693
+        type: string
+      cluster_commit:
+        description: Exact ORESoftware/k8s-cluster repair candidate commit
+        required: false
+        default: 4bc664a651cd912e8c16a15dd8f0dfcb1e1870b5
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gitops-current-main-adversarial-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  ZED_CLI_COMMIT: ${{ inputs.product_commit || '5d1d13119be5784f545a7d812cdfaae3ca120693' }}
+  K8S_CLUSTER_COMMIT: ${{ inputs.cluster_commit || '4bc664a651cd912e8c16a15dd8f0dfcb1e1870b5' }}
+
+jobs:
+  certify:
+    name: GitOps adversarial / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 50
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, windows-2025]
+
+    steps:
+      - name: Check out independent security harness
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out exact current zed-cli main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_COMMIT }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out exact k8s-cluster repair candidate without submodules
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ORESoftware/k8s-cluster
+          ref: ${{ env.K8S_CLUSTER_COMMIT }}
+          path: product/k8s-cluster
+          fetch-depth: 1
+          submodules: false
+          persist-credentials: false
+          show-progress: false
+
+      - name: Verify immutable checkout identities
+        run: |
+          set -euo pipefail
+          [[ "$ZED_CLI_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$K8S_CLUSTER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+          test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_COMMIT"
+          test "$(git -C product/k8s-cluster rev-parse HEAD)" = "$K8S_CLUSTER_COMMIT"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - name: Install Python 3.12
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Run exact product and native contract quality gates
+        run: |
+          set -euo pipefail
+          python -m py_compile scripts/gitops_current_main_adversarial.py
+          rm -rf scripts/__pycache__
+          cargo fmt --manifest-path product/zed-cli/Cargo.toml --all --check
+          cargo test --manifest-path product/zed-cli/Cargo.toml --locked --lib external_subcommands::tests
+          cargo test --manifest-path product/zed-cli/Cargo.toml --locked --test external_gitops_dispatch
+          cargo test --manifest-path product/zed-cli/Cargo.toml --locked --bin zed-gitops
+          cargo clippy --manifest-path product/zed-cli/Cargo.toml --locked \
+            --lib --bin zed --bin zed-gitops --test external_gitops_dispatch -- -D warnings
+          bash product/zed-cli/scripts/validate-zed-package-graph.sh
+          python product/k8s-cluster/tools/test_gitops_composition.py -v
+
+      - name: Build exact release siblings
+        run: |
+          set -euo pipefail
+          cargo build --manifest-path product/zed-cli/Cargo.toml --locked --release \
+            --bin zed --bin zed-gitops
+
+      - name: Select platform binary paths
+        run: |
+          set -euo pipefail
+          zed="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          gitops="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed-gitops"
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            zed="${zed}.exe"
+            gitops="${gitops}.exe"
+          fi
+          test -x "$zed" || [[ "$RUNNER_OS" == "Windows" ]]
+          test -f "$gitops"
+          echo "ZED_BINARY=$zed" >> "$GITHUB_ENV"
+          echo "ZED_GITOPS_BINARY=$gitops" >> "$GITHUB_ENV"
+
+      - name: Run current-main positive and adversarial certification
+        run: |
+          set -euo pipefail
+          mkdir -p artifacts
+          python scripts/gitops_current_main_adversarial.py \
+            --zed "$ZED_BINARY" \
+            --zed-gitops "$ZED_GITOPS_BINARY" \
+            --product product/zed-cli \
+            --cluster product/k8s-cluster \
+            --product-commit "$ZED_CLI_COMMIT" \
+            --cluster-commit "$K8S_CLUSTER_COMMIT" \
+            --work "$RUNNER_TEMP/gitops-current-main-adversarial" \
+            --evidence "artifacts/gitops-current-main-${RUNNER_OS}-${RUNNER_ARCH}.json"
+          rm -rf scripts/__pycache__
+
+      - name: Require pristine source checkouts and harness
+        run: |
+          set -euo pipefail
+          for checkout in product/zed-cli product/k8s-cluster; do
+            git -C "$checkout" diff --exit-code
+            git -C "$checkout" diff --cached --exit-code
+            status="$(git -C "$checkout" status --porcelain --untracked-files=all)"
+            if [[ -n "$status" ]]; then
+              printf 'unexpected checkout drift in %s:\n%s\n' "$checkout" "$status" >&2
+              exit 1
+            fi
+          done
+          harness_status="$(git status --porcelain --untracked-files=all | grep -vE '^\?\? (artifacts|product)/' || true)"
+          if [[ -n "$harness_status" ]]; then
+            printf 'unexpected harness drift:\n%s\n' "$harness_status" >&2
+            exit 1
+          fi
+
+      - name: Upload exact-SHA adversarial evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: gitops-current-main-${{ runner.os }}-${{ runner.arch }}-${{ env.ZED_CLI_COMMIT }}-${{ env.K8S_CLUSTER_COMMIT }}
+          path: artifacts/gitops-current-main-${{ runner.os }}-${{ runner.arch }}.json
+          if-no-files-found: error
+          retention-days: 14
+          include-hidden-files: false
diff --git a/docs/gitops-current-main-adversarial.md b/docs/gitops-current-main-adversarial.md
@@ -0,0 +1,79 @@
+# Current-main GitOps adversarial certification
+
+This test-org lane verifies that the merged DEN-2724/DEN-2725 contract remains intact after later product and cluster changes. It is intentionally different from the original exact-parent feature canary: it certifies the current product head, validates a proposed cluster repair, and mutates disposable worktrees to prove fail-closed behavior.
+
+## Drift discovered by the first run
+
+The initial exact-current pair was:
+
+```text
+zed-pkg/zed-cli@5d1d13119be5784f545a7d812cdfaae3ca120693
+ORESoftware/k8s-cluster@18f1fa1dc8360c4817e1adbc1351b93f7d8604de
+```
+
+All product/native source gates and release builds passed. Real catalog validation then correctly rejected a stale declaration:
+
+```text
+catalog inventory/source pin: 32be546f5ee020c1de3b099a47e6760d00e3f6e4
+indexed fabrication-server gitlink: 5e305b9bf40d28139bdabf9342c304f759cbfee5
+```
+
+The existing GitOps workflow did not include `remote/deployments/**` in its path filters, so a gitlink-only update could bypass the catalog parity check. `ORESoftware/k8s-cluster#1209` aligns the catalog and adds the missing trigger boundary.
+
+## Current immutable inputs
+
+```text
+zed-pkg/zed-cli@5d1d13119be5784f545a7d812cdfaae3ca120693
+ORESoftware/k8s-cluster@4bc664a651cd912e8c16a15dd8f0dfcb1e1870b5
+```
+
+The workflow runs on Ubuntu 24.04, macOS 15, and Windows Server 2025.
+
+## Positive regression boundary
+
+Each platform:
+
+1. verifies both immutable checkout identities;
+2. runs rustfmt, focused dispatcher and validator tests, strict Clippy, package-graph validation, and the native `k8s-cluster` validator suite;
+3. builds exact release `zed` and `zed-gitops` siblings;
+4. validates the repaired real `k8s-cluster` catalog through standalone `zed-gitops`, root-dispatched `zed gitops`, and the native Python validator;
+5. requires root/direct Zed report identity and native/Zed record-count agreement;
+6. renders the native deterministic preview and requires one rendered item per validated record; and
+7. requires the ApplicationSet pilot to retain its inert annotation, fail-closed template settings, exact child revision source, collision-free generated name, and zero references from other Argo YAML/JSON.
+
+## Disposable adversarial scenarios
+
+For each policy mutation, the harness creates a detached worktree at the exact cluster commit. The original checkout remains untouched. Both Zed entry points and the native validator must exit with policy status 2 and report the required rule:
+
+- source target revision differs from the inventory pin — `source.pin-drift`;
+- catalog inventory/source pins differ from the indexed gitlink — `inventory.gitlink-drift`;
+- broad default AppProject and namespace — `argo.project`, `argo.namespace`;
+- automated sync, prune, or self-heal enabled while `pilot-inert` — `migration.inert-sync`;
+- an `*-infra` repository classified as a deployable app — `policy.infra-is-not-app`;
+- parent-owned static Application path escapes the repository — `migration.static-application`; and
+- no catalog records — `catalog.empty`.
+
+Unix runners additionally replace the catalog directory with an escaping symlink. The Zed validator must fail as a tool/configuration error before reading the external records.
+
+## Evidence and isolation
+
+Each runner uploads a JSON record under:
+
+```text
+zed-pkg-test/gitops-current-main-adversarial/v1
+```
+
+The evidence contains only immutable commits, platform identity, report/preview digests, scenario names, expected rules, and passed check names.
+
+The workflow uses public exact-commit checkouts with persisted credentials disabled. Product subprocesses receive no inherited token, secret, password, private key, access key, API key, authorization, cookie, or Zed credential variables. It performs no private submodule read, publication, registry write, Kubernetes mutation, Argo reconciliation, Cloudflare request, DNS change, R2 access, database write, or persistent namespace operation.
+
+Passing this lane does not authorize activation of the inert ApplicationSet. Activation still requires a separate production change with resource-ownership parity, prune/deletion behavior, and rollback evidence.
+
+## Coordination
+
+- Catalog parity repair: `ORESoftware/k8s-cluster#1209`
+- Root dispatcher merge: `zed-pkg/zed-cli#242`
+- Exact-parent canary: `zed-pkg-test/zed-pkg-e2e#134`
+- Cluster contract merge: `ORESoftware/k8s-cluster#1109`
+- Roadmap: `ORESoftware/k8s-cluster#1097`
+- Linear: `DEN-2724`, `DEN-2725`, `DEN-630`