ci: establish post-merge re-audit procedure for generated-CSS producers #2408

Out of scope

No automatic hash refresh merely to admit current source, per-file owner-map redesign, weakened producer/installation/command/path drift refusal, relaxed CI proof or new generated-artifact support. Do not replace independently owned positives with arbitrary current producer bytes. No runtime optimization or passing-CI claim follows from this ruling.

Context

After #2388 (fcb7d5c53), generated stylesheet/theme and inclusion self-tests bind their positive fixtures to producer bytes frozen at audited revision 498270fbdc4ef2788fdd3babb259b647d77f6c77 (const owner, tests/frozen-generated-source.ts:7). The production pin table (const auditedProducer, scripts/generated-build-inputs.ts:8-20) must keep those audited digests. The decision record (docs/decisions/ci-utility.md, Scheduling and selection) says "legitimate audit drift requires fresh proof and does not redefine the positive fixture".

Several pinned producers change routinely: .github/workflows/ci.yml, scripts/check-pr.ts, scripts/ci-proof.ts. Once one of them changes on main, generatedCssInputs returns undefined for the whole tree and the browser input closure falls back to ordinary resolution. Proof still runs fresh, which is safe, but the generated-CSS binding stays disabled until someone audits the new bytes. #2398 (#2363) is one such change: a one-line job-name edit in ci.yml. It keeps the audited digest, per the ruling above.

Nothing defines that re-audit step. A pin refresh cannot ride along in the changing PR, because the frozen owner must be a commit in main's history. A squash merge discards the PR's own commits, and CI hard-fails when the owner blob is unavailable.

Maintainer decision

Decision (maintainer, 2026-10-18): Select option 1: after each legitimate change to an audited generated-CSS producer lands on main, restore its qualification through a separate post-merge re-audit PR. Do not batch drift indefinitely, refresh pins automatically without audit, or change to per-file ownership as part of this issue.

The re-audit PR selects an available, delivered main revision as its frozen producer owner, reviews the changed producer behavior and the combined producer set, and updates the matching production digests and independently owned positive fixture provenance together. Record the reviewed owner, changed paths/digests, audit rationale and actual proof identities. Preserve #2373/#2388's frozen-positive/current-drift separation and runtime/negative controls. Unreviewed source drift continues to refuse binding and select fresh proof.

The changing PR must not manufacture its own positive-fixture owner from commits that squash merge will discard. Re-audit is a deliberate follow-up to the delivered main source. A new producer change during review requires renewed audit/proof or leaves that change unqualified; do not claim binding for unreviewed bytes. All normal candidate/head/base and merge-proof rules still apply.

Scope

Document and establish this procedure in docs/decisions/ci-utility.md, then perform one re-audit against delivered current-main producer source using the chosen workflow. This issue owns the durable decision-record update; no further maintainer policy choice is required before that documentation and first re-audit.

Acceptance criteria

• Record the post-merge trigger, main-history owner requirement, audit/proof responsibilities, update sequence and safe drift fallback in docs/decisions/ci-utility.md. Reconcile its existing frozen-positive ownership language without weakening the rule.
• Perform one post-merge re-audit against an identified delivered main revision. Review changed producer files and their combined build-before-browser/clean-output/locked-tool/checked-exit/receipt guarantees; record evidence rather than treating a digest recomputation as the audit.
• Update the complete relevant production pin set and matching positive-fixture provenance together, with owner blobs available offline from main history. Restore binding for the reviewed current producer tree; identify any remaining drift rather than masking it.
• Preserve real frozen positive controls and independent current-source drift negatives across generated CSS/theme and inclusion tests. Keep locked offline compiler and installed-asset byte/mode controls, and source/path/mode/command/order guards where applicable.
• Prove a producer-digest bypass fails the named intended negative assertion and corrupt positive ownership fails its intended positive assertion. Restore changes and record both receipts; a module-load error is not an intended failing-first receipt.
• Record audited owner, relevant source identities/digests and actual candidate/head/base/checkouts in the PR. Follow required local and complete selected hosted proof before merge. Newly changed producer bytes require fresh review/proof and cannot be admitted silently.

Verification

Run bun run test tests/generated-theme-inputs.test.ts tests/generated-build-inputs.test.ts tests/inclusion-inputs.test.ts through the ordinary offline wrapper with the real locked compiler controls and restored mutation receipts, then bun run check:pr --base origin/main and complete selected hosted proof as required by the repository. Existing failed receipts remain failed; this issue decision does not itself qualify a new producer tree.

Contract impact

None; internal CI procedure and audit/fixture ownership. No public CLI/MCP/configuration contract change is selected.

Updated 2026-10-18: maintainer selected a separate post-merge re-audit PR after each producer-changing merge. Scope, acceptance criteria and verification now describe the chosen procedure and first re-audit; no policy question remains. Implementation/documentation/audit proof remain outstanding delivery work.