[schlessera]

Refs #2279. Post-merge follow-up to #2458; the full-pressure and hosted acceptance work on #2279 stays open.

What changed

Generated stylesheet inputs qualify again at delivered main 736a3445e82aee509e10f3c8d00b95fc77749202. Refresh the six drifted production digests and move the independent positive-fixture owner/provenance to that same immutable main commit. All 12 producer pins and three reader pins match that owner's Git blobs and the actual checkout. Current producer drift still refuses binding and requires fresh proof.

Why this shape

Follow the reviewed re-audit procedure selected in #2408. The changing PR cannot own a positive fixture through commits a squash discards; this separate follow-up names the delivered main squash instead.

Reviewed each changed producer against the previous owner b7f6360a86be68f7da8cefa93c316ecc0bf9bf42:

• scripts/build.ts (fix(ci): build runtime packages once per test invocation #2458): advance output-generation revocation after exclusive lease admission and before the first output mutation; pass that token to execution. Every selected package still rebuilds and unqualified isolated-operation contexts still fall back to the ordinary builder.
• scripts/build-execution.ts (fix(ci): build runtime packages once per test invocation #2458): pass optional generation into the receipt. Package dist cleaning, checked TSC/Tailwind exits, exact stylesheet source/output paths and verbatim theme/token copies remain intact.
• scripts/build-receipt.ts (fix(ci): build runtime packages once per test invocation #2458): add a validated invocation UUID and output-generation identity to an owner-local diagnostic receipt. finish still records completion/success only after the checked execution result; errors cannot attest a successful build.
• scripts/workspace-lease.mjs (fix(ci): build runtime packages once per test invocation #2458): add live ancestor/start-time, checkout inode and held-flock validation plus output-generation revocation. Existing exclusive output ownership remains; the generation token revokes authority and cannot by itself establish a fresh build.
• scripts/check-pr.ts (chore(ci): allow local sandbox setup up to 1000 ms before refusing preflight #2472): the merged local sandbox setup threshold becomes a named 1000 ms bound instead of 250 ms, retaining the three probes, 5000 ms per-probe timeout and refusal path. No builder or build/browser order changes.
• .github/workflows/ci.yml (fix(ci): retain hygiene and native export diagnostics #2545): only additional native-export/hygiene diagnostic upload paths. No selected job, build, image, proof gate, execution order or failure policy changes.

The combined set retains cleaned package output, the locked Tailwind CLI, build-before-browser command order, checked exits and a fresh post-build receipt. The other six producer pins and all three reader pins are unchanged. Re-audit changes no producer implementation, dependency or package output.

Reviewed replacement SHA-256 values:

scripts/build.ts 6e83f426cf6a084e531f7e1aacc6d1574600dedfca890747df33199e2b3c9fd7
scripts/build-execution.ts 89571c3af89489abe25f2b1113411c128c51a06fcd5f5b948e0899e4f6df8e89
scripts/build-receipt.ts b22743a8a943cd63d56519f4551715c4bbf2ff05e17ae8bd65cca2aeed88fa68
scripts/workspace-lease.mjs d1e427171a70f906f219b43ea6e47f69c628e60c126a2bb7ac30ff5e2c9a81ad
scripts/check-pr.ts 44edfa9c7da42c301988fda62e9f2bf9e72eb56d9eedfb2bf1b4c77af9764bd0
.github/workflows/ci.yml ba93d519013905c8bbd943bf8887733a45911e5309a622f34827f70fdef94427

Proof

Base and audited owner: 736a3445e82aee509e10f3c8d00b95fc77749202. Head: 0749b143c7505ea8d726e2607321c78d2d20ed08. Bun 1.4.2. Local mount table: 101 entries.

• Failing first / actual checkout: a temporary five-case test calls generatedCssInputs for ui-kit styles/theme/tokens and ui-react styles/theme. Before refresh: 0 pass / 5 fail at CURRENT_AUDITED_PRODUCER_ENABLES_CSS_REUSE (Received: undefined). After refresh: 5 pass / 0 fail, each returning its tracked src entry and the checked producer list. The probe remains outside committed test discovery because later legitimate producer drift must remain allowed to run fresh.
• Mutated input: append a comment to the actual checkout's scripts/build.ts; those same five positives fail with undefined bindings, while current producer bytes qualify only when they match the frozen audit passes its drift-refusal assertions. Restore byte-for-byte: all five positives pass again.
• Required digest-bypass mutation: remove only the production digest comparison; producer, execution-order, receipt and package-script drift refuse generated stylesheet binding fails at toBeUndefined() with a returned binding. Restore byte-for-byte: the named negative control passes.
• Required positive-owner mutation: point the frozen owner back to the available old delivered commit while retaining the reviewed new pins; generated stylesheet imports own source and checked producer, without current dist artifacts fails at closure.unresolved.toEqual([]) with an unresolved generated CSS import. This is a behavioral assertion, not an unavailable-history/module-load error. Restore byte-for-byte: the positive control passes.
• Final focused run: 25 pass / 0 fail / 100 assertions, including all five actual-checkout positives plus generated CSS, generated theme and inclusion suites. This runs the real locked offline Tailwind CLI and the actual temporary-theme compiler command, including broken-input refusal.
• bun run typecheck: passed (tsc --noEmit, exit 0).
• bun run check:pr --base origin/main: passed on the stated final head (exit 0; 295.24 s wall, 364.13 s user + 95.14 s system): lint/leakage and metadata gates, 970 fast tests / 6439 assertions across 48 files, then 225 import-graph tests / 7981 assertions across 18 files, all with zero failures.
• Main advanced after local proof to 3125574b81b6c1b62f490ac88b946fa0e2f05576 (fix(ci): cover missing dummy driver without host autoload #2623, missing-driver launcher test coverage; test(ci): refresh browser shard costs after navigation split #2624, browser shard-cost metadata). Source review confirms no audited producer/reader or launcher implementation changed. That later base is not incorporated or relabeled as locally tested combined-tree evidence.
• Current-head draft gates: changeset passed; contract in progress; draft gates queued at the single current-head inspection. Other proof categories are intentionally skipped for draft cadence; no failing check was reported. Pending checks are handed to the coordinator without polling.. Complete selected hosted proof is reserved for the coordinator's later ready-candidate confirmation.

Focused command (the first file is a temporary local five-export positive probe):

bun run test ./tmp/generated-css-reaudit.test.ts tests/generated-build-inputs.test.ts tests/generated-theme-inputs.test.ts tests/inclusion-inputs.test.ts

A reproducible actual-checkout admission probe:

bun -e 'import assert from "node:assert/strict";
import {generatedCssInputs} from "./scripts/generated-build-inputs";
for (const artifact of ["ui-kit/dist/styles.css", "ui-kit/dist/theme.css", "ui-kit/dist/tokens.css", "ui-react/dist/styles.css", "ui-react/dist/theme.css"]) {
  const binding = generatedCssInputs(process.cwd(), `packages/${artifact}`);
  assert.equal(binding?.entry, `packages/${artifact.replace("/dist/", "/src/")}`, "CURRENT_AUDITED_PRODUCER_ENABLES_CSS_REUSE");
  console.log(`Generated-CSS reuse active: ${artifact}`);
}'

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof. (Local proof recorded above; full hosted confirmation remains with the coordinator.)
• Acceptance criteria from the issue are all met, or the gap is named below. (This is a Refs slice.)
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md. (PR chore(ci): re-audit generated CSS producers after invocation build #2625 and ci: attribute repeated hosted runtime setup hook timeouts #2279 both read back as 0.44.0.)
• A changeset is included, or this changes nothing a consumer can see. (CI qualification metadata and fixture provenance only.)
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved. (No contract change.)
• Docs under docs/ reflect the change, or nothing documented moved. (Existing re-audit procedure followed; fixture provenance updated.)
• Provider history stays append-only (docs/decisions/provider-history.md): the provider-history guard passes, or nothing on a turn's path changed.

Anything left open

The coordinator owns ready-candidate confirmation and merge. This PR stays draft. #2279 retains its separate full-pressure and hosted acceptance work. This proves generated-CSS source binding/admission, not reuse of a particular historical hosted job or a measured speedup. Any subsequent producer drift needs renewed review or continues to require fresh execution under the existing rule.