Merge issue #25: correct workflow readiness integration

Author: suyog19

docs/adoption.md

@@ -37,6 +37,12 @@ display names, repository/ref-qualified values, and paths outside that directory
 with exact paths. Producers must expose the full workflow ref and protection
 state; reusable producers must also expose the caller workflow ref.
 
+Process 1.4.1 removes that caller-ref requirement because GitHub does not provide
+it as a default runner variable. Reusable workflows authorize the exact called
+workflow in `GITHUB_WORKFLOW_REF`; configure allowed callers with GitHub-native
+repository controls. Regenerate effective obligations so readiness receives the
+selected `adapter_mapping`, including any non-`main` protected branch.
+
 Optional `adapters.github_copilot.scoped_instructions` generate compact
 path-scoped `.github/instructions/*.instructions.md` files from canonical process
 identity and declared local-context paths. They are hash-locked and non-canonical.

docs/capability-status.md

@@ -1,6 +1,6 @@
 # Capability status
 
-Current process release: **1.4.0**.
+Current process release: **1.4.1**.
 
 Status terms: **implemented** is executable and tested; **partial** works with stated prerequisites/limits; **experimental** is usable but compatibility may change; **designed** has an accepted contract but no complete implementation; **deferred** is intentionally postponed with tracked rationale. Material implementation and release changes must update this matrix.
 

docs/evidence-lifecycle.md

@@ -85,3 +85,9 @@ Version 1.4.0 removes free-form and substring GitHub workflow authorization.
 Adopters keep exact `.github/workflows/*.yml` allowlist paths, provide the full
 GitHub workflow ref and protected-ref state, and provide the caller workflow ref
 for reusable workflows. Ambiguous legacy values fail with migration diagnostics.
+
+Version 1.4.1 corrects the reusable-workflow and protected-branch integration.
+Reusable calls authorize GitHub's exact called-workflow ref; caller permission is
+delegated to GitHub and repository-native controls rather than claimed as
+independently verified. Readiness consumes the serialized `adapter_mapping`, so a
+configured non-`main` protected branch is identical at production and join time.

enforcement/github/reference-flow.md

@@ -25,9 +25,12 @@ configured protected/default branch with `GITHUB_REF_PROTECTED=true`. A workflow
 SHA equal to the assessed target cannot bootstrap its own authorization; a
 reviewed authorization change affects later runs. `pull_request` is diagnostic
 only. `pull_request_target` and `workflow_dispatch` must use the protected base
-definition. `workflow_call` also requires `GITHUB_CALLER_WORKFLOW_REF`, with both
-caller and callee allowlisted. Fork review runs in the authorized base repository.
-Reruns bind both run ID and attempt.
+definition. For `workflow_call`, the exact called reusable-workflow identity in
+`GITHUB_WORKFLOW_REF` is the identity authorized here. GitHub resolves that
+workflow; caller authorization remains a repository ruleset/caller-permissions
+responsibility and is outside this adapter's trust claim. No undocumented caller
+environment variable is required. Fork review runs in the authorized base
+repository. Reruns bind both run ID and attempt.
 
 An independent reviewer runs `review-attest` from a protected review workflow
 after inspecting the objective artifact, then uploads

policy/core.yaml

@@ -1,6 +1,6 @@
 schema_version: 1
 process:
-  version: 1.4.0
+  version: 1.4.1
   source: suyog19/software-engineering-process
 controls:
   traceability:

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "software-engineering-process"
-version = "1.4.0"
+version = "1.4.1"
 description = "Technology-neutral engineering policy and assurance platform"
 readme = "README.md"
 requires-python = ">=3.11"

schemas/effective-obligations.schema.json

@@ -1,14 +1,17 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object",
-  "required": ["process", "repository", "classification", "required_capabilities", "required_evidence", "selected_skills", "native_enforcement", "prohibited_actions"],
+  "required": ["process", "repository", "classification", "required_capabilities", "required_evidence", "selected_skills", "native_enforcement", "prohibited_actions", "adapter_mapping"],
   "properties": {
     "process": {"type": "object"}, "repository": {"type": "object"}, "classification": {"type": "object"},
     "required_capabilities": {"type": "array", "items": {"type": "string"}, "uniqueItems": true},
     "required_evidence": {"type": "array", "items": {"type": "string"}, "uniqueItems": true},
     "selected_skills": {"type": "array", "items": {"type": "string"}, "uniqueItems": true},
     "approvals": {"type": "array", "items": {"type": "string"}},
     "native_enforcement": {"type": "object"}, "prohibited_actions": {"type": "array", "items": {"type": "string"}},
+    "adapter_mapping": {"type": ["object", "null"], "additionalProperties": false,
+      "required": ["platform"], "properties": {"platform": {"const": "github"},
+        "readiness_status": {"type": "string"}, "protected_branch": {"type": "string", "minLength": 1},
+        "production_environment": {"type": "string"}, "runner_labels": {"type": "array", "items": {"type": "string"}}}},
     "not_required": {"type": "array", "items": {"type": "string"}}
   }
 }
-

src/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Software Engineering Policy and Assurance platform."""
 
-__version__ = "1.4.0"
+__version__ = "1.4.1"

src/engineering_process/evidence.py

@@ -175,7 +175,15 @@ def verify_readiness(obligations: dict, attestations: Iterable[dict], schema: di
                 allowed_key = "trusted_ci_workflows" if record.get("producer_class") == "trusted-ci" else "authorized_review_workflows"
                 if record["workflow_repository"].lower() != str(repository).lower() or record["workflow_path"] not in repo.get(allowed_key, []):
                     raise ProcessError("GitHub provenance workflow identity is not authorized by resolved repository policy")
-                protected_branch = obligations.get("adapters", {}).get("github", {}).get("protected_branch", "main")
+                mapping = obligations.get("adapter_mapping")
+                if mapping is None:
+                    protected_branch = "main"
+                elif not isinstance(mapping, dict) or mapping.get("platform") != "github":
+                    raise ProcessError("GitHub provenance requires a valid GitHub adapter_mapping")
+                else:
+                    protected_branch = mapping.get("protected_branch", "main")
+                    if not isinstance(protected_branch, str) or not protected_branch.strip():
+                        raise ProcessError("GitHub adapter_mapping protected_branch must be a non-empty string")
                 workflow_ref = record["workflow_ref"]
                 immutable = len(workflow_ref) == 40 and all(char in "0123456789abcdef" for char in workflow_ref)
                 protected_default = workflow_ref == f"refs/heads/{protected_branch}" and record.get("ref_protected") is True

src/engineering_process/evidence_generation.py

@@ -71,11 +71,6 @@ def _workflow_identity(manifest: dict, target_sha: str) -> dict:
         raise ProcessError(f"pull_request workflow content is not trusted; permitted ref rule: {permitted}")
     if immutable and parsed["workflow_ref"] == target_sha:
         raise ProcessError("a target revision cannot bootstrap trust from its own workflow revision; approve the trust change for subsequent runs")
-    if event == "workflow_call":
-        caller = _parse_workflow_ref(os.environ.get("GITHUB_CALLER_WORKFLOW_REF"))
-        if caller["repository"].lower() != str(expected).lower():
-            raise ProcessError("workflow_call caller repository does not match the configured repository")
-        required["caller"] = caller
     if not (immutable or protected_default):
         raise ProcessError(f"unauthorized workflow ref {parsed['workflow_ref']!r}; permitted ref rule: {permitted}")
     return required
@@ -87,8 +82,7 @@ def _require_authorized_workflow(manifest: dict, workflow: dict, key: str) -> No
         normalized = [_normalized_workflow_path(path) for path in allowed]
     except (ProcessError, TypeError) as exc:
         raise ProcessError(f"ambiguous legacy configuration for {key}; use exact .github/workflows/*.yml paths: {exc}") from exc
-    identities = [workflow] + ([workflow["caller"]] if "caller" in workflow else [])
-    rejected = [identity["workflow_path"] for identity in identities if identity["workflow_path"] not in normalized]
+    rejected = [workflow["workflow_path"]] if workflow["workflow_path"] not in normalized else []
     if not normalized or rejected:
         raise ProcessError(f"GitHub workflow is not authorized for {key}: repository={workflow['repository']!r}; "
                            f"workflow_path={workflow['workflow_path']!r}; workflow_ref={workflow['workflow_ref']!r}; "