feat(step7): host qualification and the execution binding, kept apart

.github/workflows/p022-merge-gate.yml

@@ -0,0 +1,70 @@
+name: P-022 merge gate
+
+# The merge order for the #263 preregistration, as a check rather than an
+# agreement. `mergegate.py` is run against the commit a merge would PRODUCE —
+# for a pull_request event that is `github.sha`, the merge ref, not the branch
+# head — because a PR number proves someone pressed a button and says nothing
+# about what the merged tree contains.
+#
+# Two jobs, and the gate needs the controls: a gate whose own controls are
+# failing must not be the thing that says a merge is safe. A failed controls job
+# leaves the gate job unreported, which a required check reads as unsatisfied.
+#
+# This workflow is one half of the wiring. The other half is a ruleset requiring
+# these two checks; without it the job reports and nothing is prevented. The
+# names below are the contexts that ruleset must name:
+#
+#     P-022 merge gate controls
+#     P-022 merge gate
+#
+# Least privilege as elsewhere in this repository: read-only, and every
+# third-party `uses:` pinned to a commit SHA with its version in a comment.
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  controls:
+    name: P-022 merge gate controls
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.11"
+      - name: the gate's own controls (fixtures ship the real tools and mutate them)
+        run: python tests/test_step7_mergegate.py
+      - name: the wiring's controls (applicability and co-change)
+        run: python tests/test_step7_mergegate_ci.py
+
+  gate:
+    name: P-022 merge gate
+    needs: controls
+    runs-on: ubuntu-latest
+    steps:
+      # Full history: the co-change rule compares the gate's own files against
+      # the base commit, which a shallow clone would not carry.
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.11"
+      - name: the gate, against the commit this merge would produce
+        env:
+          # Read through the environment rather than interpolated into the
+          # script body, so nothing from the event can be read as shell.
+          MERGE_COMMIT: ${{ github.sha }}
+          BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          if [ -n "${BASE_COMMIT}" ]; then
+            python scripts/step7/mergegate_ci.py --repo . \
+              --commit "${MERGE_COMMIT}" --base "${BASE_COMMIT}"
+          else
+            python scripts/step7/mergegate_ci.py --repo . --commit "${MERGE_COMMIT}"
+          fi

scripts/step7/examples/host-provisioning.example.json

@@ -0,0 +1,27 @@
+{
+  "_EXAMPLE": "EXAMPLE / NOT EVIDENCE. This file is a shape to copy, never a declaration. It lives outside docs/evidence/ so it cannot be mistaken for one, and it carries no real environment id, fingerprint, operator or host name. A real declaration is signed off by an operator who has checked every line of it, and is content-addressed into a host qualification.",
+  "_FORM": "This is the PHYSICAL-HOST form: is_vm is false, so the four VM-only fields are explicit 'n/a: <reason>' strings. On a VM invert it — is_vm true, and fixed_vcpu, fixed_ram, live_migration_disabled and dynamic_memory_disabled must ALL be literal true. A VM that cannot promise fixed vCPU, fixed RAM, no live migration and no dynamic memory is not a measurement host, and 'n/a' is not available there.",
+  "_DECLARED": "Everything here is DECLARED evidence. A guest operating system cannot establish that nobody else is using the machine or that the hypervisor will not migrate it; the checker validates shape and value and binds these bytes by sha256, and never calls them machine proof.",
+  "_SESSION": "Per-session facts are NOT here. 'No campaign workload is running', 'no interactive user', 'no prohibited background job' are properties of a moment, not of a machine, and belong in own.net/p022/session-declaration, taken fresh for each session.",
+
+  "kind": "own.net/p022/host-provisioning",
+  "schema": 1,
+
+  "environment_id": "EXAMPLE-environment-id-assigned-by-the-owner",
+  "host_fingerprint": "sha256:EXAMPLE-copy-the-value-the-environment-manifest-observed",
+
+  "dedicated_to_p022": true,
+  "no_concurrent_user_workload": true,
+  "hosted_ci_runner": false,
+
+  "virtualization": {
+    "is_vm": false,
+    "fixed_vcpu": "n/a: physical host, no hypervisor allocates its CPUs",
+    "fixed_ram": "n/a: physical host, installed memory does not balloon",
+    "live_migration_disabled": "n/a: physical host, nothing can migrate it",
+    "dynamic_memory_disabled": "n/a: physical host, no dynamic memory to disable"
+  },
+
+  "operator": "EXAMPLE-operator-name",
+  "recorded_at": "EXAMPLE-2026-01-01T00:00:00+00:00"
+}