mandrel-platform 0.24.0 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel-platform",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Shared CI/deploy workflows, composite toolchain action, npm config package, Renovate preset, and operator runbook templates.",
   "license": "MIT",
   "repository": {
@@ -44,7 +44,7 @@
     "provenance": true
   },
   "dependencies": {
-    "mandrel": "^1.81.0"
+    "mandrel": "^1.83.0"
   },
   "scripts": {
     "typecheck": "node --input-type=module --eval 'process.exit(0)'",

package/scripts/check-pin-drift.mjs

@@ -979,18 +979,61 @@ export function hasDrift(report) {
   return report.results.some((r) => r.error || r.drift);
 }
 
+/**
+ * Is EVERY configured consumer an `error` row (M11)? This is the signature of a
+ * dead cross-repo credential: a PIN_DRIFT_TOKEN that was *provided* but has
+ * expired (fine-grained PATs always expire) can no longer read ANY consumer, so
+ * every `fetchConsumerWorkflows` call fails closed to an `error` row. Contrast
+ * the not-yet-provisioned bootstrap case: there the token is *absent*, the run
+ * legitimately can't read the private consumers, and that benign state must keep
+ * its current exit-0 behavior. The caller distinguishes the two by whether the
+ * token was provided (see `runCli`'s `tokenProvided`); this predicate only
+ * answers "did every row error", which — given a provided token — means the
+ * credential died rather than "no drift".
+ *
+ * Requires at least one consumer (an empty registry is vacuously not a
+ * dead-credential signal).
+ *
+ * @param {{ results: Array<{ error?: string }> }} report
+ * @returns {boolean}
+ */
+export function allConsumersErrored(report) {
+  const results = Array.isArray(report.results) ? report.results : [];
+  return results.length > 0 && results.every((r) => Boolean(r.error));
+}
+
 // ---------------------------------------------------------------------------
 // CLI entry
 // ---------------------------------------------------------------------------
 
+/**
+ * Whether the cross-repo `PIN_DRIFT_TOKEN` was PROVIDED (non-empty) to the run
+ * (M11). The scheduled/dispatch workflow reads consumers over the `gh` CLI with
+ * `GH_TOKEN: ${{ secrets.PIN_DRIFT_TOKEN || github.token }}` — the built-in
+ * `github.token` fallback can only read THIS repo, so cross-repo reads fail
+ * closed to `error` rows both when the token is absent (bootstrap) AND when it
+ * is provided-but-dead (expired PAT). This env var is the only signal that
+ * distinguishes the two: the workflow sets it to the raw secret so an empty
+ * value ⇒ absent (bootstrap, benign) and a non-empty value ⇒ provided (a
+ * total error sweep then means the credential died).
+ *
+ * @param {Record<string, string | undefined>} env
+ * @returns {boolean}
+ */
+export function pinDriftTokenProvided(env) {
+  return typeof env.PIN_DRIFT_TOKEN === "string" && env.PIN_DRIFT_TOKEN.length > 0;
+}
+
 /**
  * @param {{
  *   argv?: string[],
  *   cwd?: string,
  *   stdout?: { write: (s: string) => void },
  *   stderr?: { write: (s: string) => void },
+ *   env?: Record<string, string | undefined>,
  *   runGh?: (args: string[]) => string,
  *   summaryPath?: string | undefined,
+ *   tokenProvided?: boolean,
  *   nowMs?: number,
  * }} [opts]
  * @returns {number} exit code
@@ -1000,8 +1043,10 @@ export function runCli({
   cwd = process.cwd(),
   stdout = process.stdout,
   stderr = process.stderr,
+  env = process.env,
   runGh = defaultGhRunner,
   summaryPath = process.env.GITHUB_STEP_SUMMARY,
+  tokenProvided = pinDriftTokenProvided(env),
   nowMs = Date.now(),
 } = {}) {
   const { config: configRel, json, strict } = parseArgv(argv);
@@ -1025,9 +1070,19 @@ export function runCli({
 
   const report = buildReport(config, runGh, nowMs);
   const drift = hasDrift(report);
+  // M11: a PROVIDED-but-dead PIN_DRIFT_TOKEN (expired PAT) can no longer read
+  // ANY consumer, so every row fails closed to `error`. That is a credential
+  // failure, NOT the benign not-yet-provisioned bootstrap (token absent) — fail
+  // the run unconditionally (even without --strict, which the scheduled path
+  // can never pass) so the death is loud instead of a green no-op. The absent-
+  // token bootstrap keeps its current behavior: tokenProvided is false, so this
+  // branch never fires and the run exits per the drift/--strict rules below.
+  const deadCredential = tokenProvided && allConsumersErrored(report);
 
   if (json) {
-    stdout.write(`${JSON.stringify({ kind: "pin-drift-report", drift, ...report }, null, 2)}\n`);
+    stdout.write(
+      `${JSON.stringify({ kind: "pin-drift-report", drift, deadCredential, ...report }, null, 2)}\n`,
+    );
   } else {
     const text = renderReport(report);
     stdout.write(`${text}\n`);
@@ -1042,6 +1097,16 @@ export function runCli({
     }
   }
 
+  if (deadCredential) {
+    stderr.write(
+      "::error::[pin-drift] PIN_DRIFT_TOKEN was provided but every cross-repo " +
+        "consumer read errored — the credential is dead (likely an expired " +
+        "fine-grained PAT), not a not-yet-provisioned bootstrap. Rotate the " +
+        "token. See docs/runbooks/pin-drift-dashboard.md.\n",
+    );
+    return 1;
+  }
+
   if (strict && drift) {
     stderr.write(`[pin-drift] ❌ drift detected (--strict)\n`);
     return 1;

package/scripts/check-pin-drift.test.mjs

@@ -20,6 +20,7 @@ import { join } from "node:path";
 import { test } from "node:test";
 
 import {
+  allConsumersErrored,
   buildReport,
   classifyNpmPin,
   classifyStaleLiterals,
@@ -34,6 +35,7 @@ import {
   isWithinReleaseAgeWindow,
   parseDurationMs,
   parseSemver,
+  pinDriftTokenProvided,
   renderReport,
   resolveLatestRelease,
   runCli,
@@ -883,3 +885,126 @@ test("runCli --strict DOES exit 1 once the held release ages out", () => {
     rmSync(cfgDir, { recursive: true, force: true });
   }
 });
+
+// ---------------------------------------------------------------------------
+// M11 — provided-but-dead PIN_DRIFT_TOKEN (expired PAT) vs. not-yet-provisioned
+// bootstrap. A dead credential can read NO consumer, so every row fails closed
+// to an `error` row; that must hard-fail EVEN without --strict (the scheduled
+// path can never pass --strict). The absent-token bootstrap — identical row
+// shape but token unset — must keep its benign exit-0.
+// (temp/audits/workflow-robustness-review-2026-07-05.md M11)
+// ---------------------------------------------------------------------------
+
+const DEAD_CRED_CONFIG = {
+  platformRepo: PLATFORM,
+  consumers: [
+    { name: "c1", repo: "o/c1", branch: "main" },
+    { name: "c2", repo: "o/c2", branch: "main" },
+  ],
+};
+
+/**
+ * A gh runner where the platform's own release resolution succeeds (that read
+ * uses the built-in token, which CAN read this repo) but EVERY cross-repo
+ * consumer workflow-listing call fails with a non-404 (auth/transport) — the
+ * exact shape of a dead cross-repo PAT. Every consumer therefore becomes an
+ * `error` row.
+ */
+function makeAllConsumersFailRunGh() {
+  return (args) => {
+    const path = args[1];
+    if (path === `repos/${PLATFORM}/releases/latest`) {
+      return JSON.stringify({ tag_name: TAG });
+    }
+    if (path === `repos/${PLATFORM}/git/ref/tags/${TAG}`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (/\/contents\/\.github\/workflows/.test(path)) {
+      // 403/5xx (not 404) → fail-closed to an `error` row, mirroring an expired
+      // PAT that can no longer read the private consumer repo.
+      throw ghHttpError(403, "Forbidden");
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+}
+
+test("pinDriftTokenProvided: non-empty ⇒ true, empty/absent ⇒ false", () => {
+  assert.equal(pinDriftTokenProvided({ PIN_DRIFT_TOKEN: "ghp_live" }), true);
+  assert.equal(pinDriftTokenProvided({ PIN_DRIFT_TOKEN: "" }), false);
+  assert.equal(pinDriftTokenProvided({}), false);
+});
+
+test("allConsumersErrored: true only when every row errored and ≥1 consumer", () => {
+  const report = buildReport(DEAD_CRED_CONFIG, makeAllConsumersFailRunGh());
+  assert.equal(allConsumersErrored(report), true);
+  // A single clean row flips it back to false — that is drift/partial, not a
+  // dead credential.
+  assert.equal(
+    allConsumersErrored({ results: [{ error: "x" }, { drift: true }] }),
+    false,
+  );
+  assert.equal(allConsumersErrored({ results: [] }), false);
+});
+
+test("runCli: PROVIDED-but-dead PIN_DRIFT_TOKEN (all rows error) exits 1 with ::error:: even without --strict", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-dead-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(DEAD_CRED_CONFIG));
+  const stderr = capture();
+  try {
+    const code = runCli({
+      argv: ["--config", p], // NOTE: no --strict.
+      env: { PIN_DRIFT_TOKEN: "ghp_expired" },
+      runGh: makeAllConsumersFailRunGh(),
+      stdout: capture(),
+      stderr,
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+    assert.match(stderr.text(), /::error::/);
+    assert.match(stderr.text(), /credential is dead/);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});
+
+test("runCli: dead-credential also surfaces in the --json envelope (deadCredential:true)", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-dead-json-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(DEAD_CRED_CONFIG));
+  const stdout = capture();
+  try {
+    const code = runCli({
+      argv: ["--config", p, "--json"],
+      env: { PIN_DRIFT_TOKEN: "ghp_expired" },
+      runGh: makeAllConsumersFailRunGh(),
+      stdout,
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+    const envelope = JSON.parse(stdout.text());
+    assert.equal(envelope.deadCredential, true);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});
+
+test("runCli: ABSENT PIN_DRIFT_TOKEN bootstrap (all rows error, token unset) stays exit 0 — benign", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-bootstrap-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(DEAD_CRED_CONFIG));
+  try {
+    const code = runCli({
+      argv: ["--config", p], // no --strict, no token.
+      env: {}, // PIN_DRIFT_TOKEN absent → not-yet-provisioned bootstrap.
+      runGh: makeAllConsumersFailRunGh(),
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});

package/scripts/deploy-boot-smoke.mjs

@@ -40,10 +40,15 @@
  * appended to $GITHUB_ENV so the workflow's `Rollback failed workers` step
  * fires. Exit code 1 on any smoke failure.
  *
- * Wrangler: the workers.dev subdomain derivation shells out to the
- * consumer's lockfile-pinned `pnpm exec wrangler whoami` (installed by
- * setup-toolchain, preflighted via its `require-wrangler` input). This
- * script never fetches a registry-latest wrangler.
+ * Subdomain derivation (M14): the workers.dev account subdomain is derived
+ * via the Cloudflare REST endpoint
+ * `GET /accounts/{account_id}/workers/subdomain` using the in-scope
+ * CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID — NOT `wrangler whoami`. This
+ * removes the root-wrangler dependency for probe-only consumers: every real
+ * consumer is a pnpm workspace with wrangler in an app sub-package (not the
+ * root), so the former `pnpm exec wrangler whoami` derivation failed the
+ * smoke preflight AFTER the worker already deployed. The REST call needs no
+ * wrangler at all.
  *
  * Environment contract (all read from process.env):
  *   DEPLOYED_WORKERS       csv of deployed worker names (required)
@@ -53,6 +58,8 @@
  *   WORKERS_DEV_SUBDOMAIN  explicit workers.dev slug (optional)
  *   VERIFY_COMMIT_SHA      'true' to assert the health JSON version field
  *   EXPECTED_SHA           the SHA verify-commit-sha asserts (github.sha)
+ *   CLOUDFLARE_API_TOKEN   CF API token for the subdomain REST derivation
+ *   CLOUDFLARE_ACCOUNT_ID  CF account id for the subdomain REST derivation
  *   SMOKE_FAILED_FILE      rollback-list path (default: a freshly-created
  *                          private temp dir via mkdtemp — never a predictable
  *                          world-writable path; CI sets this explicitly)
@@ -61,13 +68,16 @@
  * Exit codes:
  *   0 — every probe passed.
  *   1 — a probe failed (rollback list written), or the probe target could
- *       not be resolved (no subdomain derivable — no rollback list).
+ *       not be resolved (no subdomain derivable — no rollback list), or an
+ *       unhandled error crashed the run (terminal-write-before-exit — the
+ *       rollback file + smoke_failed=true flag are still written so the
+ *       workflow's rollback step fires, M2).
  */
 
 import { writeFileSync, appendFileSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 
 // ---------------------------------------------------------------------------
 // Pure helpers (unit-tested)
@@ -87,12 +97,28 @@ export function parseSmokePaths(csv) {
 }
 
 /**
- * Extract the workers.dev account subdomain slug from `wrangler whoami`
- * output (the first `<slug>.workers.dev` token). Returns null when absent.
+ * Extract the workers.dev account subdomain slug from a Cloudflare REST
+ * `GET /accounts/{account_id}/workers/subdomain` response body (M14). The API
+ * returns `{ success, result: { name: "<slug>" } }`; this reads the top-level
+ * `result.name`. Returns null when the body is not JSON, not the expected
+ * shape, unsuccessful, or the name is missing / not a non-empty string.
+ * Deliberately tolerant of a full `<slug>.workers.dev` value (some responses
+ * echo the host) by stripping a trailing `.workers.dev`.
  */
-export function extractSubdomain(whoamiOutput) {
-  const m = String(whoamiOutput ?? "").match(/([A-Za-z0-9-]+)\.workers\.dev/);
-  return m ? m[1] : null;
+export function extractSubdomain(responseBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(responseBody);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === false) return null;
+  const result = parsed.result;
+  if (result === null || typeof result !== "object" || Array.isArray(result)) return null;
+  const name = result.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  return name.replace(/\.workers\.dev$/, "");
 }
 
 /**
@@ -199,7 +225,7 @@ export async function runSmoke(env, deps = {}) {
     log = (line) => process.stdout.write(`${line}\n`),
     probe = probeUrl,
     runShell = defaultRunShell,
-    whoami = defaultWhoami,
+    deriveSubdomain = defaultDeriveSubdomain,
   } = deps;
 
   const workers = parseCsv(env.DEPLOYED_WORKERS);
@@ -228,15 +254,20 @@ export async function runSmoke(env, deps = {}) {
   // ----- Built-in probe -----
   // Resolve the workers.dev subdomain slug. NEVER the account ID (a UUID) —
   // workers.dev subdomains are keyed by the account name/slug. Prefer the
-  // explicit input, else derive from `wrangler whoami`.
+  // explicit input, else derive from the Cloudflare REST endpoint
+  // GET /accounts/{account_id}/workers/subdomain (M14 — no wrangler needed).
   let subdomain = (env.WORKERS_DEV_SUBDOMAIN ?? "").trim();
   if (!subdomain && !smokeBaseUrl) {
-    log("::group::Deriving workers.dev subdomain from wrangler whoami");
-    subdomain = extractSubdomain(whoami());
+    log("::group::Deriving workers.dev subdomain from the Cloudflare REST API");
+    subdomain = await deriveSubdomain({
+      accountId: (env.CLOUDFLARE_ACCOUNT_ID ?? "").trim(),
+      apiToken: (env.CLOUDFLARE_API_TOKEN ?? "").trim(),
+    });
     if (!subdomain) {
       log(
-        "::error::Could not derive workers.dev subdomain from 'wrangler whoami'. " +
-          "Pass workers_dev_subdomain or smoke_base_url explicitly."
+        "::error::Could not derive workers.dev subdomain from the Cloudflare REST API " +
+          "(GET /accounts/{account_id}/workers/subdomain). Check CLOUDFLARE_ACCOUNT_ID / " +
+          "CLOUDFLARE_API_TOKEN, or pass workers_dev_subdomain / smoke_base_url explicitly."
       );
       log("::endgroup::");
       // No rollback list: the target could not be resolved, so nothing was
@@ -306,18 +337,30 @@ function defaultRunShell(command, extraEnv) {
   return res.status ?? 1;
 }
 
-function defaultWhoami() {
-  // Consumer lockfile-pinned wrangler (`pnpm exec wrangler`), installed and
-  // preflighted by setup-toolchain (require-wrangler). Failure tolerated —
-  // an empty output falls through to the "could not derive" error above.
+/**
+ * Derive the workers.dev subdomain slug via the Cloudflare REST endpoint
+ * `GET /accounts/{account_id}/workers/subdomain` (M14). Uses the in-scope
+ * CLOUDFLARE_* creds — no wrangler. Any failure (missing creds, network
+ * error, non-2xx, unparsable body) is tolerated and returns null, which the
+ * caller surfaces as the "could not derive" error above. fetchImpl is
+ * injectable for the test suite.
+ */
+export async function defaultDeriveSubdomain({ accountId, apiToken }, fetchImpl = fetch) {
+  if (!accountId || !apiToken) return null;
+  const url = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/workers/subdomain`;
   try {
-    return execFileSync("pnpm", ["exec", "wrangler", "whoami"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      maxBuffer: 8 * 1024 * 1024,
+    const res = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json",
+      },
+      signal: AbortSignal.timeout(15000),
     });
+    if (!res.ok) return null;
+    return extractSubdomain(await res.text());
   } catch {
-    return "";
+    return null;
   }
 }
 
@@ -341,18 +384,55 @@ export function resolveFailedFile(env, mkdtempImpl = mkdtempSync) {
   return join(mkdtempImpl(join(tmpdir(), "deploy-boot-smoke-")), "smoke-failed-workers.txt");
 }
 
+/**
+ * Write the rollback terminal state: the failed-worker list to `failedFile`
+ * (overwrite, never append) and `smoke_failed=true` to $GITHUB_ENV so the
+ * workflow's rollback step fires. No-op when `failedWorkers` is empty.
+ * Extracted so both the normal smoke-failure path AND the crash path (M2 —
+ * terminal-write-before-exit) share one writer, and so the write is
+ * unit-testable via injected fs seams.
+ *
+ * Overwrite rationale: a reused self-hosted runner may carry a stale list
+ * from a previous run, and rolling back workers this run never deployed would
+ * widen the blast radius.
+ */
+export function writeRollbackState(
+  failedFile,
+  failedWorkers,
+  { githubEnv, writeFile = writeFileSync, appendFile = appendFileSync } = {}
+) {
+  if (!failedWorkers || failedWorkers.length === 0) return;
+  writeFile(failedFile, `${failedWorkers.join("\n")}\n`);
+  if (githubEnv) {
+    appendFile(githubEnv, "smoke_failed=true\n");
+  }
+}
+
 async function main() {
   const failedFile = resolveFailedFile(process.env);
-  const { exitCode, failedWorkers } = await runSmoke(process.env);
-
-  if (failedWorkers.length > 0) {
-    // Overwrite (never append): a reused self-hosted runner may carry a
-    // stale list from a previous run, and rolling back workers this run
-    // never deployed would widen the blast radius.
-    writeFileSync(failedFile, `${failedWorkers.join("\n")}\n`);
-    if (process.env.GITHUB_ENV) {
-      appendFileSync(process.env.GITHUB_ENV, "smoke_failed=true\n");
-    }
+  let exitCode;
+  try {
+    const result = await runSmoke(process.env);
+    exitCode = result.exitCode;
+    writeRollbackState(failedFile, result.failedWorkers, {
+      githubEnv: process.env.GITHUB_ENV,
+    });
+  } catch (err) {
+    // Crash path (M2): an unhandled error must NOT leave a deployed worker
+    // serving unverified code with no rollback. Write the terminal rollback
+    // state — rolling back EVERY deployed worker, since the crash gives no
+    // per-worker attribution — BEFORE exiting non-zero, so the workflow's
+    // rollback step still fires. This is the terminal-write-before-exit
+    // guarantee the former (write-only-on-a-clean-return) shape lacked.
+    process.stdout.write(
+      `::error::deploy-boot-smoke crashed: ${err?.message ?? err}. ` +
+        "Marking every deployed worker for rollback.\n"
+    );
+    const deployed = uniqueSorted(parseCsv(process.env.DEPLOYED_WORKERS));
+    writeRollbackState(failedFile, deployed, {
+      githubEnv: process.env.GITHUB_ENV,
+    });
+    exitCode = 1;
   }
   process.exit(exitCode);
 }

package/scripts/deploy-boot-smoke.test.mjs

@@ -11,6 +11,8 @@ import {
   probeUrl,
   runSmoke,
   resolveFailedFile,
+  defaultDeriveSubdomain,
+  writeRollbackState,
 } from "./deploy-boot-smoke.mjs";
 
 // ---------------------------------------------------------------------------
@@ -29,26 +31,67 @@ test("parseSmokePaths enforces a leading slash", () => {
 });
 
 // ---------------------------------------------------------------------------
-// extractSubdomain
+// extractSubdomain — parses the Cloudflare REST subdomain response (M14)
 // ---------------------------------------------------------------------------
 
-test("extractSubdomain finds the first workers.dev slug in whoami output", () => {
-  const whoami = [
-    "Getting User settings...",
-    "👋 You are logged in!",
-    "┌──────────────┬──────────────────────────┐",
-    "│ Account Name │ dsj1984's Account        │",
-    "│ Subdomain    │ dsj1984.workers.dev      │",
-    "└──────────────┴──────────────────────────┘",
-  ].join("\n");
-  assert.equal(extractSubdomain(whoami), "dsj1984");
+test("extractSubdomain reads result.name from the REST subdomain response", () => {
+  assert.equal(
+    extractSubdomain('{"success":true,"errors":[],"messages":[],"result":{"name":"dsj1984"}}'),
+    "dsj1984"
+  );
+});
+
+test("extractSubdomain strips a trailing .workers.dev when the API echoes the host", () => {
+  assert.equal(extractSubdomain('{"success":true,"result":{"name":"dsj1984.workers.dev"}}'), "dsj1984");
 });
 
-test("extractSubdomain returns null when no slug is present", () => {
-  assert.equal(extractSubdomain("no subdomain here"), null);
+test("extractSubdomain returns null for unsuccessful, malformed, or missing bodies", () => {
+  assert.equal(extractSubdomain('{"success":false,"result":null}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":""}}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":42}}'), null);
+  assert.equal(extractSubdomain('{"result":{}}'), null);
+  assert.equal(extractSubdomain('{"result":"dsj1984"}'), null);
+  assert.equal(extractSubdomain("<html>not json</html>"), null);
   assert.equal(extractSubdomain(""), null);
 });
 
+// ---------------------------------------------------------------------------
+// defaultDeriveSubdomain — the REST GET /accounts/{id}/workers/subdomain call
+// ---------------------------------------------------------------------------
+
+test("defaultDeriveSubdomain calls the workers/subdomain endpoint with a bearer token", async () => {
+  let seenUrl;
+  let seenOptions;
+  const fetchImpl = async (url, options) => {
+    seenUrl = url;
+    seenOptions = options;
+    return { ok: true, text: async () => '{"success":true,"result":{"name":"dsj1984"}}' };
+  };
+  const slug = await defaultDeriveSubdomain({ accountId: "acct-123", apiToken: "tok-abc" }, fetchImpl);
+  assert.equal(slug, "dsj1984");
+  assert.equal(
+    seenUrl,
+    "https://api.cloudflare.com/client/v4/accounts/acct-123/workers/subdomain"
+  );
+  assert.equal(seenOptions.method, "GET");
+  assert.equal(seenOptions.headers.Authorization, "Bearer tok-abc");
+});
+
+test("defaultDeriveSubdomain returns null without creds, on non-2xx, and on network error", async () => {
+  assert.equal(await defaultDeriveSubdomain({ accountId: "", apiToken: "tok" }, async () => ({})), null);
+  assert.equal(await defaultDeriveSubdomain({ accountId: "a", apiToken: "" }, async () => ({})), null);
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => ({ ok: false, text: async () => "" })),
+    null
+  );
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => {
+      throw new Error("ECONNRESET");
+    }),
+    null
+  );
+});
+
 // ---------------------------------------------------------------------------
 // parseVersionField — the jq/JSON.parse replacement for grep-for-"version"
 // ---------------------------------------------------------------------------
@@ -315,21 +358,30 @@ test("runSmoke fails without a rollback list when no subdomain is derivable", as
   const { log, lines } = collectLogs();
   const result = await runSmoke(
     { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
-    { log, whoami: () => "not logged in", probe: async () => ({ status: 200, body: "{}" }) }
+    { log, deriveSubdomain: async () => null, probe: async () => ({ status: 200, body: "{}" }) }
   );
   assert.equal(result.exitCode, 1);
   assert.deepEqual(result.failedWorkers, []);
   assert.ok(lines.some((l) => l.includes("Could not derive workers.dev subdomain")));
 });
 
-test("runSmoke derives the subdomain from whoami output when not provided", async () => {
+test("runSmoke derives the subdomain via the REST endpoint when not provided", async () => {
   const { log } = collectLogs();
   const probed = [];
+  let seenCreds;
   const result = await runSmoke(
-    { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      CLOUDFLARE_ACCOUNT_ID: "acct-123",
+      CLOUDFLARE_API_TOKEN: "tok-abc",
+    },
     {
       log,
-      whoami: () => "│ Subdomain │ dsj1984.workers.dev │",
+      deriveSubdomain: async (creds) => {
+        seenCreds = creds;
+        return "dsj1984";
+      },
       probe: async (url) => {
         probed.push(url);
         return { status: 200, body: "{}" };
@@ -338,6 +390,8 @@ test("runSmoke derives the subdomain from whoami output when not provided", asyn
   );
   assert.equal(result.exitCode, 0);
   assert.deepEqual(probed, ["https://api.dsj1984.workers.dev/health"]);
+  // The REST creds are threaded through from the environment.
+  assert.deepEqual(seenCreds, { accountId: "acct-123", apiToken: "tok-abc" });
 });
 
 // ---------------------------------------------------------------------------
@@ -379,3 +433,70 @@ test("resolveFailedFile creates a private temp dir when SMOKE_FAILED_FILE is uns
   assert.equal(path, "/var/folders/xyz/deploy-boot-smoke-Zzz999/smoke-failed-workers.txt");
   assert.notEqual(path, "/tmp/smoke-failed-workers.txt");
 });
+
+// ---------------------------------------------------------------------------
+// writeRollbackState — the shared terminal writer (crash-path fix, M2)
+// ---------------------------------------------------------------------------
+
+test("writeRollbackState writes the sorted list and the smoke_failed flag", () => {
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", ["api", "worker-cron"], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});
+
+test("writeRollbackState is a no-op for an empty worker list", () => {
+  let wrote = false;
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", [], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: () => {
+      wrote = true;
+    },
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.equal(wrote, false);
+  assert.equal(appended, false);
+});
+
+test("writeRollbackState skips the GITHUB_ENV append when githubEnv is unset (still writes the list)", () => {
+  const writes = [];
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", ["api"], {
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\n" }]);
+  assert.equal(appended, false);
+});
+
+// ---------------------------------------------------------------------------
+// Crash-path terminal write (M2): runSmoke throwing must still mark every
+// deployed worker for rollback. main() catches and calls writeRollbackState
+// with uniqueSorted(parseCsv(DEPLOYED_WORKERS)); this asserts the exact
+// derivation main() feeds the writer on the crash path.
+// ---------------------------------------------------------------------------
+
+test("crash-path derives the full deployed-worker rollback set (uniqueSorted + parseCsv)", () => {
+  // Mirrors main()'s catch block: on an unhandled error, EVERY deployed
+  // worker is marked (no per-worker attribution survives a crash).
+  const deployed = uniqueSorted(parseCsv("worker-cron, api ,worker-cron"));
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", deployed, {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});

package/scripts/platform-repair.mjs

@@ -68,7 +68,12 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { buildReport, isFullSha } from "./check-pin-drift.mjs";
+import {
+  allConsumersErrored,
+  buildReport,
+  isFullSha,
+  pinDriftTokenProvided,
+} from "./check-pin-drift.mjs";
 import { defaultGhRunner } from "./lib/gh-json.mjs";
 import { parseSemver } from "./lib/semver-duration.mjs";
 
@@ -602,6 +607,13 @@ export function runRepair({
 }) {
   // Reuse the detector to classify every consumer (single SSOT for drift).
   const report = buildReport(config, runGh, nowMs);
+  // M11: mirror check-pin-drift's dead-credential signal. When EVERY consumer
+  // row errored the detector could read no repo at all — the signature of a
+  // provided-but-dead PIN_DRIFT_TOKEN (an expired PAT). The caller pairs this
+  // with `tokenProvided` to fail the run instead of silently reporting a green
+  // "no repairable drift" (which is what an all-error sweep degrades to, since
+  // every error row classifies `repairable: false, reason: "error"`).
+  const allErrored = allConsumersErrored(report);
   const latestTag = report.latestRelease?.tag ?? null;
   const targetSha = report.latestRelease?.sha ?? null;
   // The pin target is the latest release tag (so the `# <ref>` annotation reads
@@ -648,7 +660,14 @@ export function runRepair({
     }
   }
 
-  return { ref: effectiveRef, targetSha, dryRun, hasToken: Boolean(token), rows };
+  return {
+    ref: effectiveRef,
+    targetSha,
+    dryRun,
+    hasToken: Boolean(token),
+    allErrored,
+    rows,
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -743,6 +762,23 @@ export function runCli({
       }
     }
   }
+
+  // M11: the repair loop reads consumers with the SAME cross-repo credential the
+  // dashboard uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that token was PROVIDED
+  // but every detector row errored, the credential is dead (expired PAT) rather
+  // than not-yet-provisioned — every consumer degraded to `error` / repairable
+  // false, which otherwise renders a reassuring green "no repairable drift". Fail
+  // the run loudly so the dead credential is fixed. The absent-token bootstrap
+  // (pinDriftTokenProvided false) keeps its exit-0 read-only behavior.
+  if (pinDriftTokenProvided(env) && report.allErrored) {
+    stderr.write(
+      "::error::[platform-repair] PIN_DRIFT_TOKEN was provided but every " +
+        "cross-repo consumer read errored — the credential is dead (likely an " +
+        "expired fine-grained PAT), not a not-yet-provisioned bootstrap. Rotate " +
+        "the token. See docs/runbooks/pin-drift-dashboard.md.\n",
+    );
+    return 1;
+  }
   return 0;
 }
 

package/scripts/platform-repair.test.mjs

@@ -21,6 +21,9 @@
  */
 
 import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { test } from "node:test";
 
 import {
@@ -32,6 +35,7 @@ import {
   parsePrNumberFromUrl,
   renderRepairPrBody,
   renderRepairReport,
+  runCli,
   runRepair,
 } from "./platform-repair.mjs";
 
@@ -269,6 +273,12 @@ function makeGh({ consumerWorkflow, npmVersion, openPrs = {}, calls }) {
 
 const noopGit = () => "";
 
+/** A minimal write-sink that records everything written, for stdout/stderr. */
+function capture() {
+  const chunks = [];
+  return { write: (s) => chunks.push(s), text: () => chunks.join("") };
+}
+
 function laggingConfig() {
   return {
     platformRepo: PLATFORM_REPO,
@@ -456,3 +466,106 @@ test("renderRepairReport tabulates outcomes and a repaired section", () => {
   assert.ok(text.includes("Repaired (1)"));
   assert.ok(text.includes("#101"));
 });
+
+// ---------------------------------------------------------------------------
+// M11 — provided-but-dead read credential vs. not-yet-provisioned bootstrap.
+// The repair loop reads consumers with the SAME cross-repo PAT the dashboard
+// uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that PAT is provided-but-dead every
+// detector row errors → every consumer classifies `error`/repairable-false,
+// which otherwise renders a reassuring green "no repairable drift". runCli must
+// hard-fail on that when the token was provided, and stay exit-0 when it was
+// absent (bootstrap). Mirrors scripts/check-runner-health.mjs error-row
+// handling. (temp/audits/workflow-robustness-review-2026-07-05.md M11)
+// ---------------------------------------------------------------------------
+
+/**
+ * A gh runner where the platform's own release resolution succeeds but EVERY
+ * cross-repo consumer read fails non-404 (auth/transport) — the shape of a dead
+ * cross-repo PAT. No PR surface is reached because every consumer errors out
+ * before repair.
+ */
+function makeAllConsumersFailGh() {
+  return (args) => {
+    const path = args[1];
+    if (args[0] !== "api") {
+      throw new Error(`unexpected non-api gh call under dead credential: ${args.join(" ")}`);
+    }
+    if (path === `repos/${PLATFORM_REPO}/releases/latest`) {
+      return JSON.stringify({ tag_name: "mandrel-platform-v1.2.3", published_at: "2020-01-01T00:00:00Z" });
+    }
+    if (path === `repos/${PLATFORM_REPO}/git/ref/tags/mandrel-platform-v1.2.3`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (/\/contents\/\.github\/workflows/.test(path)) {
+      // 403 (not 404) → fail-closed error row, mirroring an expired PAT.
+      const err = new Error("gh: Forbidden (HTTP 403)");
+      err.stderr = "gh: Forbidden (HTTP 403)\n";
+      throw err;
+    }
+    if (/^repos\/[^/]+\/[^/]+$/.test(path)) {
+      return JSON.stringify({ default_branch: "main" });
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+}
+
+function deadCredConfigFile() {
+  const dir = mkdtempSync(join(tmpdir(), "platform-repair-dead-"));
+  const p = join(dir, "consumers.json");
+  writeFileSync(
+    p,
+    JSON.stringify({
+      platformRepo: PLATFORM_REPO,
+      consumers: [
+        { name: "domio", repo: "dsj1984/domio" },
+        { name: "athportal", repo: "dsj1984/athportal" },
+      ],
+    }),
+  );
+  return { dir, p };
+}
+
+test("runCli: PROVIDED-but-dead PIN_DRIFT_TOKEN (every consumer read errors) exits 1 with ::error::", () => {
+  const { dir, p } = deadCredConfigFile();
+  const stderr = capture();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: { PIN_DRIFT_TOKEN: "ghp_expired" },
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync under a dead credential");
+      },
+      stdout: capture(),
+      stderr,
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+    assert.match(stderr.text(), /::error::/);
+    assert.match(stderr.text(), /credential is dead/);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("runCli: ABSENT PIN_DRIFT_TOKEN bootstrap (every consumer read errors, token unset) stays exit 0", () => {
+  const { dir, p } = deadCredConfigFile();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: {}, // PIN_DRIFT_TOKEN absent → not-yet-provisioned bootstrap.
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync during bootstrap");
+      },
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/scripts/semgrep-requirements.txt

@@ -0,0 +1,169 @@
+# Hash-pinned lockfile for the pr-quality SAST (semgrep) step.
+#
+# Target platform : Linux x86_64 / CPython 3.12 (GitHub Actions ubuntu-latest)
+# Tool            : semgrep 1.97.0 (+ complete transitive closure)
+# Consumed via    : pip install --require-hashes -r scripts/semgrep-requirements.txt
+#
+# Every requirement below is pinned with `==` and carries at least one
+# sha256 hash, as `--require-hashes` demands. The closure was resolved for
+# the linux/cp312 target specifically (via `pip download` with explicit
+# --platform manylinux/musllinux + --python-version 3.12 --abi cp312), NOT
+# from the local interpreter, so the native wheels (semgrep, protobuf,
+# rpds-py, wrapt, charset-normalizer, ruamel.yaml.clib) are the linux x86_64
+# cp312-compatible artifacts.
+#
+# setuptools is intentionally included: the workflow installs it alongside
+# semgrep so opentelemetry's transitive `pkg_resources` import works on
+# Python >=3.12 (which no longer ships setuptools by default).
+#
+# Regenerate with `pip download semgrep==<ver> setuptools --only-binary=:all:
+# --platform manylinux2014_x86_64 --platform manylinux_2_17_x86_64
+# --platform any --python-version 3.12 --implementation cp --abi cp312`.
+
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309
+
+boltons==21.0.0 \
+    --hash=sha256:b9bb7b58b2b420bbe11a6025fdef6d3e5edc9f76a42fb467afe7ca212ef9948b
+
+bracex==3.0 \
+    --hash=sha256:3833e61c2f092d5aa0468fa2e6c6e990a306185abf763b6d122f0158e59c58a5
+
+certifi==2026.6.17 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
+
+charset-normalizer==3.4.7 \
+    --hash=sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116
+
+click==8.4.2 \
+    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
+
+click-option-group==0.5.9 \
+    --hash=sha256:ad2599248bd373e2e19bec5407967c3eec1d0d4fc4a5e77b08a0481e75991080
+
+colorama==0.4.6 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+
+defusedxml==0.7.1 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
+
+deprecated==1.3.1 \
+    --hash=sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f
+
+exceptiongroup==1.2.2 \
+    --hash=sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b
+
+face==26.0.1 \
+    --hash=sha256:ab0a83c37c9789dce658a67a9a80eafaa113c9ec37c5a9d950ff5480542a062d
+
+glom==22.1.0 \
+    --hash=sha256:5339da206bf3532e01a83a35aca202960ea885156986d190574b779598e9e772
+
+googleapis-common-protos==1.75.0 \
+    --hash=sha256:961ed60399c457ceb0ee8f285a84c870aabc9c6a832b9d37bb281b5bebde43ed
+
+idna==3.18 \
+    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
+
+importlib-metadata==7.1.0 \
+    --hash=sha256:30962b96c0c223483ed6cc7280e7f0199feb01a0e40cfae4d4450fc6fab1f570
+
+jsonschema==4.26.0 \
+    --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
+
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe
+
+markdown-it-py==4.2.0 \
+    --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
+
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8
+
+opentelemetry-api==1.25.0 \
+    --hash=sha256:757fa1aa020a0f8fa139f8959e53dec2051cc26b832e76fa839a6d76ecefd737
+
+opentelemetry-exporter-otlp-proto-common==1.25.0 \
+    --hash=sha256:15637b7d580c2675f70246563363775b4e6de947871e01d0f4e3881d1848d693
+
+opentelemetry-exporter-otlp-proto-http==1.25.0 \
+    --hash=sha256:2eca686ee11b27acd28198b3ea5e5863a53d1266b91cda47c839d95d5e0541a6
+
+opentelemetry-instrumentation==0.46b0 \
+    --hash=sha256:89cd721b9c18c014ca848ccd11181e6b3fd3f6c7669e35d59c48dc527408c18b
+
+opentelemetry-instrumentation-requests==0.46b0 \
+    --hash=sha256:a8c2472800d8686f3f286cd524b8746b386154092e85a791ba14110d1acc9b81
+
+opentelemetry-proto==1.25.0 \
+    --hash=sha256:f07e3341c78d835d9b86665903b199893befa5e98866f63d22b00d0b7ca4972f
+
+opentelemetry-sdk==1.25.0 \
+    --hash=sha256:d97ff7ec4b351692e9d5a15af570c693b8715ad78b8aafbec5c7100fe966b4c9
+
+opentelemetry-semantic-conventions==0.46b0 \
+    --hash=sha256:6daef4ef9fa51d51855d9f8e0ccd3a1bd59e0e545abe99ac6203804e36ab3e07
+
+opentelemetry-util-http==0.46b0 \
+    --hash=sha256:8dc1949ce63caef08db84ae977fdc1848fe6dc38e6bbaad0ae3e6ecd0d451629
+
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+
+peewee==3.19.0 \
+    --hash=sha256:de220b94766e6008c466e00ce4ba5299b9a832117d9eb36d45d0062f3cfd7417
+
+protobuf==4.25.9 \
+    --hash=sha256:438c636de8fb706a0de94a12a268ef1ae8f5ba5ae655a7671fcda5968ba3c9be
+
+pygments==2.20.0 \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231
+
+requests==2.34.2 \
+    --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
+
+rich==13.5.3 \
+    --hash=sha256:9257b468badc3d347e146a4faa268ff229039d4c2d176ab0cffb4c4fbc73d5d9
+
+rpds-py==2026.6.3 \
+    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6
+
+ruamel.yaml==0.17.40 \
+    --hash=sha256:b16b6c3816dff0a93dca12acf5e70afd089fa5acb80604afd1ffa8b465b7722c
+
+ruamel.yaml.clib==0.2.15 \
+    --hash=sha256:11e5499db1ccbc7f4b41f0565e4f799d863ea720e01d3e99fa0b7b5fcd7802c9
+
+semgrep==1.97.0 \
+    --hash=sha256:996fe0b2bfac3a4d4511e470fdf5f3bca96b1f794f398e0336c8388802c218de
+
+# PINNED to 80.9.0 (the last release that still SHIPS `pkg_resources`):
+# setuptools 81+ removed the vendored `pkg_resources` module, but
+# semgrep 1.97.0's transitive `opentelemetry-instrumentation==0.46b0` imports
+# it at load. A py3.12 venv seeds no setuptools, so the lockfile must supply a
+# pkg_resources-bearing one — 83.0.0 broke the SAST step at runtime with
+# `ModuleNotFoundError: No module named 'pkg_resources'`. Do NOT bump past 80.x
+# without confirming pkg_resources is present (or bumping opentelemetry off it).
+setuptools==80.9.0 \
+    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922
+
+tomli==2.0.2 \
+    --hash=sha256:2ebe24485c53d303f690b0ec092806a085f07af5a5aa1464f3931eec36caaa38
+
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
+
+urllib3==2.7.0 \
+    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+
+wcmatch==8.5.2 \
+    --hash=sha256:17d3ad3758f9d0b5b4dedc770b65420d4dac62e680229c287bf24c9db856a478
+
+wrapt==1.17.3 \
+    --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828
+
+zipp==4.1.0 \
+    --hash=sha256:25ad4e16390cd314347dd8f1de67a2ac538ae658ed4ab9db16029c07c188e97f

package/templates/workflows/deploy-staging-run.yml

@@ -51,16 +51,56 @@ on:
 permissions:
   contents: read
 
-# Serialize staging deploys: only the freshest dispatch should reach the
-# staging surfaces. The shared deploy-cloudflare.yml additionally serializes
-# per-environment.
+# Serialize staging deploys: QUEUE, don't cancel (Story #284 / audit H2). An
+# in-flight `wrangler d1 migrations apply` must never be cancelled mid-apply by
+# the next dispatch — a half-applied forward-only migration has no automatic
+# restore. `cancel-in-progress: false` lets a second dispatch wait for the
+# first to finish. (The dispatcher half keeps `cancel-in-progress: true`:
+# cancelling a superseded PENDING dispatch is safe.) The shared
+# deploy-cloudflare.yml additionally serializes per-environment.
 concurrency:
   group: deploy-staging-run
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
+  # M4: sha-drift preflight (Story #284). The CI-green gate is TOCTOU-racy — a
+  # commit A goes green and dispatches, but commit B (CI pending, possibly
+  # later red) may already be on main, so the deploy would ship B under A's
+  # green credential. When `sha` is supplied (dispatcher path), assert the main
+  # tip still equals it and FAIL loudly on drift, naming both SHAs. A job with
+  # `uses:` cannot carry `steps:`, so this preflight is a SEPARATE preceding
+  # job that the `uses:` deploy job `needs:`. Manual dispatches without `sha`
+  # skip the assertion (the operator is deploying the current tip on purpose).
+  sha-drift-preflight:
+    name: Sha-drift preflight (deploy what CI verified)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout main tip
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: main
+          persist-credentials: false
+      - name: Assert HEAD matches the CI-verified sha
+        env:
+          INPUT_SHA: ${{ inputs.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${INPUT_SHA}" ]; then
+            echo "No sha input — manual dispatch deploying the current main tip; skipping sha-drift preflight."
+            exit 0
+          fi
+          head="$(git rev-parse HEAD)"
+          if [ "${head}" != "${INPUT_SHA}" ]; then
+            echo "::error::sha drift: main tip is ${head} but the dispatched (CI-verified) sha is ${INPUT_SHA}. main advanced after CI went green; refusing to deploy an unverified tip." >&2
+            exit 1
+          fi
+          echo "sha-drift preflight OK: main tip ${head} matches the CI-verified sha ${INPUT_SHA}."
+
   deploy:
     name: Staging deploy (shared deploy-cloudflare.yml)
+    needs: [sha-drift-preflight]
     uses: dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml@<MANDREL_PLATFORM_SHA> # <MANDREL_PLATFORM_TAG>
     with:
       environment: staging

package/templates/workflows/deploy-staging.yml

@@ -71,10 +71,23 @@ jobs:
     name: Dispatch staging deploy on CI-green
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    # CI-green gate: dispatch the deploy ONLY when the upstream CI run
-    # concluded 'success'. `workflow_run` fires on both success and failure, so
-    # this guard is load-bearing — without it a red main would still deploy.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # CI-green gate — three load-bearing conditions, all required (Story #284):
+    #   1. `conclusion == 'success'` — `workflow_run` fires on both success and
+    #      failure; without this a red main would still deploy.
+    #   2. `event == 'push'` — the upstream CI run must itself have been a push
+    #      to the repo, not a `pull_request` run. `workflow_run.branches:
+    #      [main]` filters on the *head branch NAME*, so a fork PR whose head
+    #      branch is literally named `main` with green CI otherwise satisfies
+    #      the branch filter and the success guard (audit M3).
+    #   3. `head_repository.full_name == github.repository` — the CI run must
+    #      have originated from THIS repo, not a fork. Belt-and-suspenders with
+    #      condition 2: even a same-name fork branch cannot spoof same-repo
+    #      provenance, so an external contributor can no longer attacker-time a
+    #      staging deploy off their fork's green CI.
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success'
+        && github.event.workflow_run.event == 'push'
+        && github.event.workflow_run.head_repository.full_name == github.repository }}
     steps:
       - name: Dispatch deploy-staging-run.yml (workflow_dispatch)
         env:
@@ -84,8 +97,54 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          gh workflow run deploy-staging-run.yml \
-            --repo "${REPO}" \
-            --ref main \
-            -f sha="${SHA}"
-          echo "Dispatched staging deploy for ${SHA} (deploy runs on workflow_dispatch so environment: jobs execute)."
+
+          # L3: the dispatch is otherwise fire-and-forget — a transient GitHub
+          # API 5xx fails `gh workflow run`, and the only signal is a red run in
+          # a low-visibility dispatcher while that green commit never reaches
+          # staging. Retry with backoff, then VERIFY a run was actually created
+          # (a 2xx from the dispatch API is not proof a run materialized).
+          dispatched=false
+          for attempt in 1 2 3; do
+            if gh workflow run deploy-staging-run.yml \
+              --repo "${REPO}" \
+              --ref main \
+              -f sha="${SHA}"; then
+              dispatched=true
+              break
+            fi
+            echo "::warning::gh workflow run attempt ${attempt} failed; retrying after backoff."
+            sleep $((attempt * 5))
+          done
+
+          if [ "${dispatched}" != "true" ]; then
+            echo "::error::Failed to dispatch deploy-staging-run.yml after 3 attempts for ${SHA}." >&2
+            exit 1
+          fi
+
+          # Verify a runner workflow run was actually created. The dispatch API
+          # returns before the run row is queryable, so poll `gh run list` for a
+          # recent workflow_dispatch run of the runner workflow. Fail loudly if
+          # none appears — a silent non-creation is exactly the failure mode
+          # this check exists to surface.
+          created=false
+          for attempt in 1 2 3 4 5; do
+            count="$(gh run list \
+              --repo "${REPO}" \
+              --workflow deploy-staging-run.yml \
+              --event workflow_dispatch \
+              --limit 5 \
+              --json databaseId --jq 'length' 2>/dev/null || echo 0)"
+            if [ "${count:-0}" -gt 0 ]; then
+              created=true
+              break
+            fi
+            echo "Run not visible yet (attempt ${attempt}); waiting for the run row to appear."
+            sleep $((attempt * 3))
+          done
+
+          if [ "${created}" != "true" ]; then
+            echo "::error::Dispatched deploy-staging-run.yml for ${SHA} but no runner workflow run appeared via 'gh run list'." >&2
+            exit 1
+          fi
+
+          echo "Dispatched and verified staging deploy for ${SHA} (deploy runs on workflow_dispatch so environment: jobs execute)."