[frankiehot-tech]

背景

审计链只存在于数据侧的 .governance/（已 gitignore，含主机名/绝对路径，HMAC 链不可脱敏重写），无法在公开 CI 中生成。因此按"生成留在数据侧、验证与链路自检进 CI"分层实现。

改动

• scripts/verify_anchor_manifest.py：离线校验 ANCHOR_MANIFEST.json / anchors.jsonl / 令牌三者一致性与 openssl ts -verify，不访问 TSA、不读审计原文。
• .github/workflows/anchor-verify.yml：手动（可指定 run ID）或每周一复核 self-hosted 锚定产物。
• .github/workflows/anchor-smoke.yml：每周用合成审计记录端到端验证 anchor_governance_audit.py 与 freeTSA 集成，不接入 PR 必检。
• .github/workflows/anchor-audit.yml：self-hosted runner 每日锚定本机审计链；仅 schedule/workflow_dispatch 触发，产物中 audit_file 路径脱敏后上传。
• ci.yml：将新脚本纳入 ruff 检查。

验证

• ruff check / ruff format --check 通过。
• 新增 8 个测试全部通过。
• 真实 freeTSA 端到端：10 条合成记录 → 2 批，verify_anchor_manifest.py 复核通过。
• manifest 脱敏后复验仍通过。
• actionlint 除自定义 self-hosted label 外无告警。

边界

• 第 3 步需要在目标主机注册 self-hosted runner，label 为 self-hosted, macOS, maref-audit；配置前该 workflow 不会运行。
• 未把 TSA 依赖纳入 PR 必检路径，避免外部网络抖动阻断常规 CI。

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud