# SPDX-License-Identifier: MPL-2.0
# Central Reusable actions/cache SHA Corruption — 2026-06-21
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
#
# Machine-readable companion to audit-hypatia-cache-sha-corruption-2026-06-21.adoc.
# Sibling to audit-hypatia-pin-orphan-2026-05-27.a2ml (a different SHA-pin class).

[manifest]
schema            = "audit/action-sha-corruption/v1"
date              = "2026-06-21"
campaign_kind     = "central_reusable_action_repin"
human_companion   = "audit-hypatia-cache-sha-corruption-2026-06-21.adoc"
sibling_audit     = "audit-hypatia-pin-orphan-2026-05-27.a2ml"
umbrella_issue    = "hyperpolymath/hypatia#464"
out_of_scope_central_ref = "hyperpolymath/nextgen-typing#69"

[diagnosis]
failure_class     = "third_party_action_pin_unresolved_in_central_reusable"
failure_stage     = "Prepare all required actions"
failure_banner    = "Unable to resolve action actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b"
corrupt_sha       = "d4373f267a887d77f9eb0683a479ec60b1fe5b2b"
corrupt_sha_comment = "# v4.2.0"
likely_source     = "corruption of v4.2.2 commit d4323d4df104b026a6aa633fdb11d772146be0bf"
location          = "central only — zero consumer workflows carry the SHA"
affected_reusables = [
  ".github/workflows/hypatia-scan-reusable.yml",
  ".github/workflows/governance-reusable.yml",
]
observed_failing  = ["nextgen-databases#41", "KnotTheory.jl#29", "nextgen-typing#67", "wokelangiser"]

[verification]
method            = "git ls-remote https://github.com/actions/cache"
corrupt_sha_resolves = false
repair_pin        = "1bd1e32a3bdc45362d1e726936510720a7c30a57"
repair_pin_ref    = "refs/tags/v4.2.0"
known_good_v4     = "0057852bfaa89a56745cba8c7296529d2fc39830"   # refs/tags/v4 + v4.3.0
known_good_v5     = "27d5ce7f107fe9357f9df03efb73ab90386fccae"   # main + v5 + v5.0.5
grep_after_fix    = "zero matches for d4373f… across standards + hypatia"

[fix]
pr                = "hyperpolymath/standards#394"
merged_at         = "2026-06-21T10:52:13Z"
merge_commit      = "d72fe5a14e841ac6d78514b53624b6173038ee20"
change            = "actions/cache@d4373f… -> actions/cache@1bd1e32a… (# v4.2.0 preserved, now accurate)"
status            = "MERGED to standards/main — central root cause resolved + verified"

[propagation]
caveat            = "necessary but not sufficient: consumers pin reusables by standards commit SHA, not @main"
consumer_pin_hypatia       = "5eb28d7d8790d5389b7b6a5233fe6265a775e3d0"
consumer_pin_most_repos    = "861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613"
staleness_check   = "scripts/check-workflow-staleness.sh fails any consumer whose pinned SHA != current standards HEAD"
staleness_red_meaning = "expected drift after #394, not a new defect — signals pending re-enrollment"
re_enroll_target  = "d72fe5a (or later standards HEAD)"
re_enroll_tool    = "gitbot-fleet enroll-repos"
re_enroll_scope   = "out_of_scope (consumer repos + gitbot-fleet are not standards/hypatia)"

[companion_findings_nextgen_databases.k9_pedigree]
file              = "verisimdb/connectors/test-infra/deploy.k9.ncl"
error             = "Pedigree block missing 'name'"
schema_ref        = "k9-svc/pedigree.ncl Metadata.name (String, no default -> mandatory)"
sample_ref        = "k9-svc/pandoc/container/deploy.k9.ncl"
fix               = "add metadata.name; ideally metadata.version + validation.pedigree_version + trust_level/security_level ('Kennel|'Yard|'Hunt)"
scope             = "out_of_scope (nextgen-databases repo-internal, pre-existing)"

[companion_findings_nextgen_databases.trusted_base]
check             = "governance / trusted-base"
policy_ref        = "docs/TRUSTED-BASE-REDUCTION-POLICY.adoc + scripts/check-trusted-base.sh"
cause             = "undocumented soundness-relevant escape hatch in a proof-bearing file"
fix               = "discharge / budget / axiom / dated-debt entry in nextgen-databases docs/proof-debt.md"
scope             = "out_of_scope (nextgen-databases repo-internal, pre-existing)"

[not_discharged]
consumer_re_enrollment     = "gitbot-fleet enroll-repos repin of consumers to d72fe5a+ — tracked on hypatia#464"
nextgen_databases_internal = "K9 pedigree + trusted-base — repo-internal, flagged via hypatia#464 / nextgen-typing#69"
