ci: qualify native signed effects with an offline reader

.github/workflows/probity-evidence.yml

@@ -0,0 +1,100 @@
+name: Native signed-effect contract
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '29 1 * * *'
+  pull_request:
+    paths:
+      - 'haystack/components/agents/**'
+      - 'haystack/core/pipeline/**'
+      - 'haystack/tools/**'
+      - 'haystack/tracing/**'
+      - 'haystack/dataclasses/**'
+      - 'e2e/probity_evidence/**'
+      - 'pyproject.toml'
+      - 'VERSION.txt'
+      - '.github/workflows/probity-evidence.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-signed-effect-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  signed-effects:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      UV_LINK_MODE: copy
+      UV_CONCURRENT_BUILDS: '1'
+      CMAKE_BUILD_PARALLEL_LEVEL: '1'
+      OMP_NUM_THREADS: '1'
+      OPENBLAS_NUM_THREADS: '1'
+      MKL_NUM_THREADS: '1'
+      NUMEXPR_NUM_THREADS: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+          path: host
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          repository: probityai/agent-evidence-observer
+          ref: 5d9feedcfffcf441380e11e9f25a5db44d274068
+          persist-credentials: false
+          path: selected-observer
+          sparse-checkout: |
+            src
+            interop/haystack-native-2026-10-03
+            pyproject.toml
+            README.md
+            LICENSE
+          sparse-checkout-cone-mode: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.13.3'
+      - name: Install repository tooling
+        run: python -m pip install hatch==1.16.5
+      - name: Check source mutation refusals
+        working-directory: host/e2e/probity_evidence
+        run: >-
+          hatch run python -m unittest -v test_source_selection
+          > '${{ runner.temp }}/haystack-source-guards.stdout'
+          2> '${{ runner.temp }}/haystack-source-guards.stderr'
+      - name: Qualify the current framework and installed consumer
+        working-directory: host/e2e/probity_evidence
+        run: >-
+          hatch run python run.py
+          --source ../../../selected-observer
+          --selection observer-source-selection.json
+          --framework-source ../..
+          --output '${{ runner.temp }}/haystack-evidence-contract'
+          --python 3.13.3
+      - name: Retain original native records and decisions
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: native-signed-effect-contract
+          path: |
+            ${{ runner.temp }}/haystack-source-guards.stdout
+            ${{ runner.temp }}/haystack-source-guards.stderr
+            ${{ runner.temp }}/haystack-evidence-contract/packet/
+            ${{ runner.temp }}/haystack-evidence-contract/changed-input-packet/
+            ${{ runner.temp }}/haystack-evidence-contract/changed-input-publication/
+            ${{ runner.temp }}/haystack-evidence-contract/unselected-publication/
+            ${{ runner.temp }}/haystack-evidence-contract/wheels/
+            ${{ runner.temp }}/haystack-evidence-contract/framework-wheels/
+            ${{ runner.temp }}/haystack-evidence-contract/reference-derivation/
+            ${{ runner.temp }}/haystack-evidence-contract/host-selected*.json
+            ${{ runner.temp }}/haystack-evidence-contract/publication/
+            ${{ runner.temp }}/haystack-evidence-contract/*source-selection.json
+            ${{ runner.temp }}/haystack-evidence-contract/commands.json
+            ${{ runner.temp }}/haystack-evidence-contract/native-tests.xml
+            ${{ runner.temp }}/haystack-evidence-contract/COMPLETE.json
+            ${{ runner.temp }}/haystack-evidence-contract/*.stdout
+            ${{ runner.temp }}/haystack-evidence-contract/*.stderr
+          if-no-files-found: error
+          retention-days: 14

e2e/probity_evidence/README.md

@@ -0,0 +1,41 @@
+# Native signed-effect contract
+
+This end-to-end job checks native agent effects against a separately installed reader.
+It helps Haystack maintainers catch changes in tool, trace and terminal behavior.
+
+It uses published Observer source pinned to `5d9feedcfffcf441380e11e9f25a5db44d274068` and its hash locks.
+The workflow selects that source automatically.
+For a local run, put the selected Observer checkout beside the Haystack checkout.
+
+```sh
+cd e2e/probity_evidence
+hatch run python run.py \
+  --source ../../../selected-observer \
+  --selection observer-source-selection.json \
+  --framework-source ../.. \
+  --output /tmp/fresh-haystack-evidence-contract \
+  --python 3.13.3
+```
+
+The runner builds and installs the current Haystack checkout's wheel.
+It checks installed source bytes against the selected Git tree and checks package dependencies.
+It copies only selected, rechecked bytes into each build.
+The reader has no Haystack installation.
+
+The job derives a current-host reference contract from the frozen release profile.
+It binds only `SDK_VERSION` and `SDK_SOURCE` to the selected host version and commit.
+It keeps all 31 original tests and all substantive guards.
+It retains original and derived module bytes, hashes and the exact two-selector diff.
+Derived wheel metadata carries a distinct local version, matching producer dependency and embedded receipt.
+This is a declared source transformation, not the unchanged frozen release profile.
+
+The fixed workload runs real `Pipeline`, `Agent`, `Tool` and tracer transitions with scripted generator replies.
+Its seven cases cover permission, wrong content, faults before and after durable writes, step limits and truncated replies.
+Only the permitted effect reaches publication.
+Two changed-input controls must refuse, including a changed invocation whose artifact digest was updated.
+Original packets, decisions, refusal output, wheel hashes and process receipts remain in the job artifact.
+
+This is a framework contract test, not a model-quality benchmark.
+The producer, initial policy and keys share one operator.
+Separate environments do not establish outside custody.
+The repository operator owns the job, reference-source updates, policy and artifact retention after acceptance.