Add inactive GitHub Actions CI normalizer payload

[yihanzhu]

Scope

Add the inactive, pure-jq GitHub Actions CI normalizer payload and its focused proof.

The payload validates caller-bound workflow, run, run-attempt, check-suite, job, check, app, head, base, time, instruction, config, and execution-boundary facts. It returns deterministic generic CI states while leaving provider names, text, and details as opaque data.

This is payload-first delivery. It intentionally has no adapter manifest or default-set wiring. Those wait for a later assembly PR that can reference the durable payload commit on main.

Changed paths:

• README.md
• RESTORE.md
• adapters/github-actions-ci/v1/normalize.jq
• ci/required-files.txt
• scripts/test/default-github-actions-ci-adapter.test.sh

Safety

The package is inactive, offline, and unqualified. It grants no authority or qualification, exposes no capability or permission surface, uses no credential, performs no network fetch, and cannot rerun, cancel, dispatch, comment, label, merge, or write provider state.

Exact tuple

• Base: 0e10634657c127a6fb3185f1ab3f84c61fc8f7d0
• Head: 1b8580b0c0818d8a725305404d6cdeeb78f4fd4b
• Main merge: 9bef02ec5b283fe5bb8516a2780d4a37ae9ed39a
• Merge parents: a53450355a6b88ea6a9c858d9979dd8f396d9144, then 0e10634657c127a6fb3185f1ab3f84c61fc8f7d0

Proof on the exact head

• Focused payload test: 76/76 assertions passed with verified jq 1.6.
• Run-attempt identity, independent job/check identity, parent-run-bounded job timelines, terminal child closure, incomplete in-progress precedence, and public content-reference boundaries are covered.
• bash -n: passed.
• ShellCheck 0.11.0 with -x -S style: passed.
• Static jq/offline boundary and canonical repeat output: passed.
• Rename, diff-check, exact-path, manifest-absent, and append-only restore-manifest checks: passed.
• Exact tracked scan found no remaining portable-core module import, so the schema test was not widened.

Per the construction brief, the full suite, advisory, independent review, and merge were not run here.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	1b8580b
Status:	✅  Deploy successful!
Preview URL:	https://2ff034bd.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-default-github-actions.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 1b8580b
Reviewed-base: 0e10634
reviewer: review_actions_payload_219 @ high

Bugs

No Important findings. Fresh review confirmed that a complete, completed run requires every visible child to be completed before success or any of the six terminal conclusion families is evaluated. Queued-child contradictions reject across failure, cancelled, timed out, action required, stale, and neutral. Incomplete snapshots stay fail-closed or inconclusive. Attempt, job/check identity, timeline, ordering, content-reference, and canonical-output boundaries remain exact.

Security

No Important findings. Provider strings remain bounded untrusted data. Repository, workflow, suite, run, attempt, app, revision, evidence, config, instruction, and execution-boundary values are exact. The jq payload is offline, inactive, unqualified, authority-free, and effect-free; it exposes no credential, network, write, dispatch, rerun, cancellation, merge, activation, permission, tool, or capability surface.

Compliance

No Important findings. The reviewed diff is exactly the five permitted payload/test/docs/restore-manifest paths, with no manifest, constitution, forbidden, live, or process path. The restore manifest change is append-only. Required CI run 33665624320 attempt 2, check 100372133001, app 15368 succeeded on the exact reviewed head. Focused tests passed 76 assertions; relevant portable-core schema proof, bash syntax, diff checks, and final clean-worktree checks passed.

Final review: clean, with zero unresolved Important findings.

[yihanzhu]

Construction receipt

• reviewed head/base: 1b8580b0c0818d8a725305404d6cdeeb78f4fd4b / 0e10634657c127a6fb3185f1ab3f84c61fc8f7d0
• required CI: app 15368, run 33665624320 attempt 2, check 100372133001, success
• final independent review: comment 5514806425, zero unresolved Important
• squash main: 4dcd5121323bd4557d93e6a693760e97c0ca2fee
• sole parent: 0e10634657c127a6fb3185f1ab3f84c61fc8f7d0
• reviewed/merged tree: 865b9597d86cb81c286ff1a48fba00ce6588e970
• normalizer blob: 2fad7d2d217a5704fcd4e2d1f559309aa832d16d
• publisher receipt SHA-256: 171b15d842843d86a80474c48e06adedc9acf77a3bce1bf1b4d82b845e0b4382
• local main fast-forwarded and clean