Finalize issues #1–#9 gates and history

.github/workflows/close-issues-1-9.yml

@@ -0,0 +1,131 @@
+name: Close roadmap issues 1-9
+
+on:
+  pull_request:
+    branches: ["agent/issues-1-9"]
+    paths:
+      - "automation/**"
+      - ".github/workflows/close-issues-1-9.yml"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: close-issues-1-9
+  cancel-in-progress: true
+
+jobs:
+  prepare:
+    name: Prepare and pre-validate rewritten history
+    runs-on: ubuntu-24.04
+    container: debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+    outputs:
+      final_sha: ${{ steps.candidate.outputs.final_sha }}
+      final_tree: ${{ steps.candidate.outputs.final_tree }}
+
+    steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install --yes --no-install-recommends \
+            build-essential \
+            ca-certificates \
+            git \
+            libudev-dev \
+            pkg-config \
+            rustup
+
+      - name: Check out automation branch
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.97.1 \
+            --profile minimal \
+            --component rustfmt \
+            --component clippy \
+            --component llvm-tools-preview
+          rustup default 1.97.1
+
+      - name: Build, autosquash, validate, and publish candidate branch
+        id: candidate
+        shell: bash
+        run: bash automation/close_issues_1_9_v2.sh
+
+  validate:
+    name: Validate exact candidate / ${{ matrix.arch }}
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    container: debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
+
+    steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install --yes --no-install-recommends \
+            build-essential \
+            ca-certificates \
+            git \
+            libudev-dev \
+            pkg-config \
+            rustup
+
+      - name: Check out exact candidate
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ needs.prepare.outputs.final_sha }}
+          fetch-depth: 0
+
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.97.1 \
+            --profile minimal \
+            --component rustfmt \
+            --component clippy \
+            --component llvm-tools-preview
+          rustup default 1.97.1
+
+      - name: Verify candidate identity and history
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ needs.prepare.outputs.final_sha }}"
+          test "$(git rev-parse HEAD^{tree})" = "${{ needs.prepare.outputs.final_tree }}"
+          git fetch origin main:refs/remotes/origin/main
+          test "$(git rev-list --count origin/main..HEAD)" -eq 9
+          for number in 1 2 3 4 5 6 7 8 9; do
+            test "$(git log --format='%s' origin/main..HEAD | grep -Ec "\\(#${number}\\)$")" -eq 1
+          done
+          test -z "$(git log --format='%s' origin/main..HEAD | grep '^fixup!' || true)"
+
+      - name: Run core quality gate
+        run: |
+          cargo metadata --locked --format-version 1 >/dev/null
+          cargo build --workspace --all-features --locked
+          cargo fmt --all -- --check
+          cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+          cargo test --workspace --all-features --locked
+          cargo doc --workspace --all-features --no-deps --locked
+          sh scripts/check-architecture.sh
+          sh scripts/check-supply-chain-baseline.sh
+          git diff --check origin/main...HEAD
+
+      - name: Run full pinned supply-chain gate
+        if: matrix.arch == 'amd64'
+        run: |
+          export VFD_LANTERN_TOOL_ROOT="$RUNNER_TEMP/vfd-tools"
+          export VFD_LANTERN_TOOL_TARGET_DIR="$RUNNER_TEMP/vfd-tools-target"
+          export PATH="$VFD_LANTERN_TOOL_ROOT/bin:$PATH"
+          lock_before="$(sha256sum Cargo.lock | cut -d ' ' -f 1)"
+          sh scripts/install-pinned-tools.sh
+          test "$(sha256sum Cargo.lock | cut -d ' ' -f 1)" = "$lock_before"
+          sh scripts/check-supply-chain.sh

automation/check-supply-chain-final.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+sh scripts/check-supply-chain-baseline.sh
+cargo machete
+cargo deny check
+cargo audit --file Cargo.lock
+cargo vet check