Guard listen source identity and preserve operator-owned deployment inputs

Draft
GI
9d ago
+431-38

Queued listen deployments can check out a later main commit than the operator reviewed, pusher cannot carry the private MEDIA_NOISE digest, and Cloud Run deployments overwrite the operator-owned batch percentage with zero.

  • Add optional full expected_source_sha admission, checked against both runtime checkout and workflow commit before mutation. Blank preserves current dispatch behavior.
  • Give the pusher canary and release the same validated, masked private-values file. The chart permits only MEDIA_NOISE_MODE_SERVE_UID_SHA256S, preventing private overlays from shadowing shared runtime controls; dependency installer children do not inherit the private YAML variable.
  • Omit the prod Cloud Run batch percentage when no explicit deploy override is supplied. Dev retains zero and new services retain the code default zero. Align staging composition and checks with optional-input omission while preserving explicit-literal precedence and drift detection.

DRAFT / rollout hold: merge only after the active paired25 window is explicitly RELEASED. The rollout lead owns merge and deployment. Do not include these workflow changes in that window. Secret content and access changes are separate from this source PR.

Validation at 93e74f6fbaf4c5f2408b279a56b62b2de94e3b88: 233 changed-file unit tests, 20 additional cross-service contract tests (three historical replay cases keep their existing opt-in skip), and 13 hermetic listen-STT tests. Tests include real Helm rejection of private cohort overrides, executable installer-environment red/green checks, actual admit-step Bash, and staging omission/override behavior. Normal pre-push gates pass. Independent read-only Luna delta review is SHIP; the reviewer ran no tests. GitHub checks own current CI state; deployed behavior is unmeasured.

The CI-budget inventory records the new optional input and one conservative minute of forecast headroom per existing listen job. It adds no event, job, runner, automatic run, or expected run frequency; this allowance is not a measured duration.

Rollback source changes before deployment; a runtime rollback requires a separate lead-approved rollout that preserves the operator-owned percent.

Product invariants affected:

  • INV-DATA-1: source admission is strengthened; no data-plane routing change.
  • INV-MEM-4: no memory intake, promotion, or content mutation change.

Failure-Class: FC-deploy-literal-reverts-operator-value

The existing class covers the batch-percent overwrite. Its artifact list includes the reusable rendering guard; the private-overlay restriction preserves the same operator ownership boundary.