Add the repository-policy profile, validate actual legacy policy trees, normalize packed resource line endings, and scope maintenance requirements to branch source. Preserve canonical scanner enforcement for qqq-all and policy-only main branches.
Validation: 32 audit tests, 7 policy tests, all four target source trees, and Linux packed-generator check pass. Replaces this PR's unrecognized-email signatures using the established verified identity; signature enforcement remains enabled.
Co-authored-by: Codex <noreply@openai.com>
Validate every checkout before updating its orb pin. Preserve publication policy, filters, credentials contexts and forwarded parameters; reject custom callers and mismatched declarations. Cover all 12 profiles, dry runs, no-op repeats, invalid batches and duplicate input with six new tests in the existing contract job. Existing migration and standard tests pass; Linux packed generator check passes.
Co-authored-by: Codex <noreply@openai.com>
Add a read-only native worker and canonical consumer bridge. Verify the pinned Kustomize binary, render every configuration without logging resources, and audit adoption. Behavioral and audit tests pass; all five marketing GitOps configurations render successfully.
Co-authored-by: Codex <noreply@openai.com>
Add Actions and Python alongside Java and JavaScript before retiring duplicate default setup after hosted proof.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Preserve aggregate-app GA/RC validators in the shared worker, add exact-source Circle evidence, and own business E2E and workflow lint centrally. Audit explicit managed branches and verified no-CI exceptions without inventing merge checks.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Keep audited main-push release paths, bounded tag policies and test exclusions. Reject unknown filters and retain 630 original-to-generated publication comparisons across all 42 QBits.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Preserve native publication and database checks while removing POM-proven duplicate MCP compilation. Retain the disabled E2E exception and require credential equivalence before Circle retirement.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Keep release cuts short, validate exact publisher and Maven Central provenance before signed tags, and reconcile pending releases without paid polling runners.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Preserve the exact pinned Munitor workflow graph with one continuation. Execute packed test scripts from files to match CircleCI and avoid OS argv limits.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Own canonical consumer validation, selective workflow generation, Maven caching and RC completion in the shared orb. Centralize native workers and preserve acceptance/publication contracts with packed-output, behavioral and estate-audit tests.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandCodex