build(acquisition): pin scheduled audit workflow actions and toolchain

[seonghobae]

Problem

Protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 runs .github/workflows/acquisition-readiness-scan.yml as a retained buyer-evidence producer. The protected version predates Noema's current immutable-action/exact-runtime/least-authority contracts: it uses mutable major-tag Actions, broad Node selection, default persisted checkout credentials, and executes npm ci even though the acquisition manifest/audit entrypoints are repository Node scripts composed from Node built-ins and local modules and do not require node_modules.

That final point matters: merely making installation deterministic would still leave avoidable dependency/lifecycle-script execution in the buyer-evidence authority plane.

RCA

• First failing boundary: trusted scheduled/manual acquisition audit -> executable setup/dependency execution -> retained acquisition artifact.
• Immediate causes: mutable Action tags, broad Node/npm identity, persisted checkout credential, and an unnecessary dependency installation step.
• Root cause: the acquisition evidence workflow reused a generic CI-style install pattern instead of declaring the smallest execution authority actually required by its entrypoints.
• Systemic risk: buyer-facing evidence can be generated/uploaded under executable identities or dependency lifecycle behavior not required by the evidence code itself, while repository Git credentials remain available longer than necessary.

Distinct remedies / feasibility

1. Pin trusted Actions and exact Node/npm, disable persisted checkout credentials, and remove dependency installation entirely — selected smallest root-cause remedy. Fresh source inspection confirmed acquisition:data-room-manifest and acquisition:audit execute Node built-ins/local modules without installed packages.
2. Keep the install but use the frozen protected-CI command — deterministic, but preserves unnecessary lifecycle/dependency execution authority.
3. Keep the install with --ignore-scripts — narrower than ordinary install, but still performs dependency materialization the entrypoints do not need.
4. Replace acquisition auditing with a separate service/image — substantially larger trust/provenance change without need for this bounded defect.

Active test-first repair

PR #148 (fix(acquisition): pin scheduled audit toolchain) is the current direct-main repair.

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• branch: fix/acquisition-scan-immutable-toolchain;
• no-install RED contract: 07a6514250c8100f0362c28391a855c6033a7809;
• exact current GREEN head: 358eaa053ee7de7bcaa0a412ea858cb61cd376a9;
• changed paths: .github/workflows/acquisition-readiness-scan.yml, test/acquisition-readiness-scan-toolchain-integrity.test.ts.

The RED contract rejects npm ci, npm install, npm i, and an install step in this acquisition workflow and requires tracked-source/exact-workflow-SHA validation immediately before evidence generation. GREEN removes the install step, preserves exact Node 24.19.0 / npm 11.17.0 verification, and retains scheduled report-only/manual strict, manifest, audit, and artifact semantics.

Exact current proof

For unchanged #148 head 358eaa053ee7de7bcaa0a412ea858cb61cd376a9:

• application ci run 31467514954: terminal success;
• reviewer-ci run 31467514985: terminal success;
• eligible central Security Scan run 31467514947: terminal success;
• current formal reviews: 0;
• current inline review threads: 0;
• GitHub reports the PR Ready and mergeable.

Technical GREEN is not independent approval, live governance authority, protected-main operational acceptance, production KPI evidence, immutable release/deployment evidence, legal/outbound-rights evidence, revenue evidence, transfer evidence, or acquisition readiness.

Acceptance

Repository-owned implementation on #148 current exact head

• Test-first contract demonstrates the unnecessary dependency-execution boundary.
• Checkout/setup-node/upload-artifact use immutable reviewed revisions.
• Checkout does not persist credentials.
• Node 24.19.0 and npm 11.17.0 are explicitly verified.
• Acquisition evidence generation performs no dependency installation or lifecycle-script execution.
• Tracked source is clean and checked-out HEAD equals exact github.sha immediately before manifest/audit execution.
• Scheduled report-only/manual strict, manifest, audit, and artifact semantics remain unchanged.
• Exact-head application CI, reviewer-ci, eligible central Security Scan, reviews, and threads are freshly revalidated.
• No outbound license, rights, revenue, KPI, deployment, transfer, or acquisition-readiness evidence is manufactured.

Remaining protected integration / operation

• Obtain actual live chore(governance): protect main and enforce release checks #27 governance plus qualifying independent non-author formal approval required by chore(operations): provision and activate hourly maintainer App #29 where applicable.
• Merge only the unchanged exact head after all applicable gates remain satisfied.
• Run the acquisition evidence path from protected main after integration and retain its exact source/workflow/artifact evidence separately from production/release/legal/commercial evidence.

Related: #5, #27, #29, #68, #69, #77, #79, #145, #148, #155

[seonghobae]

Protected integration advanced on current-main successor #219. Exact GREEN head c89e86947d8f6df984fa4f545edfa65cccf3df1b had terminal-success application ci 31586570677, reviewer-ci 31586570716, and protected-base eligible central Security Scan 31586570557 with zero formal reviews/threads; live ruleset 18794436 requires only the central Security Scan workflow and has no bypass actors. #219 merged unchanged as protected-main commit 8273b350b633eae245f5cab8da4cb1d43799c3a2.

Historical #148 was then closed unmerged only after exact protected-main blob equality was proven for both owned paths: .github/workflows/acquisition-readiness-scan.yml blob a825687a5aada1b363faa7ab67f5eec3c3422fa4 and test/acquisition-readiness-scan-toolchain-integrity.test.ts blob d5453c3551342b936fd597065d0c5ea143f12f62.

Repository-owned source integration is therefore complete. Keep this issue open until protected-main operational acceptance is terminal: current push-side checks on 8273b350... are still queued/non-passing, and no scheduled/manual acquisition-audit execution on that protected head is yet retained. Do not promote PR-head checks or the merge itself to production/acquisition evidence.

[seonghobae]

Protected-main post-merge verification advanced on exact main 8273b350b633eae245f5cab8da4cb1d43799c3a2: push application ci run 31587660047 completed success, and push reviewer-ci run 31587659862 completed success. This proves the integrated source still satisfies the repository's protected-source application/reviewer verification path.

Issue remains open. These push checks are not the scheduled/manual acquisition evidence workflow itself, and they do not create production KPI, immutable publication/deployment, customer/revenue, owner/legal/IP, or transfer evidence. Close only after the acquisition workflow executes on this protected source (or a later exact protected head) and its retained artifact/evidence semantics are verified separately.