test: bootstrap trusted Fleet qualification consumer

.github/workflows/relay-cleanroom-qualification-request.yml

@@ -0,0 +1,69 @@
+name: Relay cleanroom qualification request
+
+on:
+  repository_dispatch:
+    types:
+      - relay_candidate_qualification
+  workflow_dispatch:
+    inputs:
+      qualification_manifest_json:
+        description: Exact immutable qualification manifest JSON
+        type: string
+        required: true
+
+permissions: {}
+
+jobs:
+  emit-request:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Materialize the no-secret qualification request
+        env:
+          REQUEST_MANIFEST_JSON: ${{ github.event.client_payload.qualification_manifest_json || inputs.qualification_manifest_json }}
+          REQUEST_EVENT: ${{ github.event_name }}
+          REQUEST_RUN_ID: ${{ github.run_id }}
+          REQUEST_RUN_ATTEMPT: ${{ github.run_attempt }}
+          REQUEST_HEAD_BRANCH: ${{ github.ref_name }}
+          REQUEST_HEAD_SHA: ${{ github.sha }}
+          REQUEST_ACTOR: ${{ github.actor }}
+          REQUEST_TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          set -euo pipefail
+          install -d -m 0700 "${RUNNER_TEMP}/relay-cleanroom-qualification-request"
+          node - <<'NODE'
+          const fs = require('node:fs');
+          const manifest = JSON.parse(process.env.REQUEST_MANIFEST_JSON || '');
+          const request = {
+            schemaVersion: 1,
+            kind: 'relayCleanroomQualificationRequest',
+            producer: {
+              repository: process.env.GITHUB_REPOSITORY,
+              workflow: 'Relay cleanroom qualification request',
+              workflowPath: '.github/workflows/relay-cleanroom-qualification-request.yml',
+              event: process.env.REQUEST_EVENT,
+              runId: Number(process.env.REQUEST_RUN_ID),
+              runAttempt: Number(process.env.REQUEST_RUN_ATTEMPT),
+              headBranch: process.env.REQUEST_HEAD_BRANCH,
+              headSha: process.env.REQUEST_HEAD_SHA,
+              actor: process.env.REQUEST_ACTOR,
+              triggeringActor: process.env.REQUEST_TRIGGERING_ACTOR,
+            },
+            qualificationManifest: manifest,
+          };
+          fs.writeFileSync(
+            `${process.env.RUNNER_TEMP}/relay-cleanroom-qualification-request/relay-cleanroom-qualification-request.json`,
+            `${JSON.stringify(request)}\n`,
+            { encoding: 'utf8', mode: 0o600, flag: 'wx' }
+          );
+          NODE
+
+      - name: Upload only the bounded qualification request
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: relay-cleanroom-qualification-request
+          path: ${{ runner.temp }}/relay-cleanroom-qualification-request/relay-cleanroom-qualification-request.json
+          if-no-files-found: error
+          retention-days: 7
+          compression-level: 0

.github/workflows/relay-package-qualification.yml

@@ -1,20 +1,162 @@
 name: Relay package qualification
 
-# GitHub only exposes workflow_dispatch for workflow files present on the
-# default branch. This deliberately inert definition makes the candidate
-# workflow discoverable. A qualification/<nonce> ref must replace this file
-# with the complete, source-bound producer before it can create evidence.
 on:
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
+
+concurrency:
+  group: relay-package-qualification-${{ github.sha }}-${{ github.run_attempt }}
+  cancel-in-progress: false
 
 jobs:
-  dispatch-bootstrap-only:
+  attest:
     runs-on: ubuntu-24.04
-    timeout-minutes: 1
+    timeout-minutes: 45
     steps:
-      - name: Refuse to claim package qualification from the bootstrap
+      - name: Check out the exact producer source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Require exact canonical prerelease source
         run: |
-          echo "::error title=Dispatch bootstrap only::Select a qualification/<nonce> ref containing the complete candidate producer."
-          exit 1
+          set -euo pipefail
+          test "${GITHUB_REPOSITORY}" = "AgentWorkforce/relay"
+          case "${GITHUB_REF}" in
+            refs/heads/qualification/*) ;;
+            *) echo "qualification must run from refs/heads/qualification/*" >&2; exit 1 ;;
+          esac
+          test -n "${GITHUB_SHA}"
+          test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
+
+      - name: Set up exact Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.22.0
+
+      - name: Require prerelease package version
+        run: |
+          node --input-type=module -e "import { assertPrereleaseVersion } from './scripts/verify-features/relay-package-qualification.mjs'; import packageJson from './package.json' with { type: 'json' }; assertPrereleaseVersion(packageJson.version);"
+
+      - name: Install pinned Rust toolchain
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          targets: x86_64-unknown-linux-musl
+
+      - name: Build and stage the exact Linux broker candidate
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+          relay_version="$(node -p "require('./package.json').version")"
+          AGENT_RELAY_VERSION="${relay_version}" RUSTFLAGS="-C target-feature=+crt-static" \
+            cargo build --locked --release --bin agent-relay-broker --target x86_64-unknown-linux-musl
+          install -m 0755 target/x86_64-unknown-linux-musl/release/agent-relay-broker \
+            packages/broker-linux-x64/bin/agent-relay-broker
+          test "$(packages/broker-linux-x64/bin/agent-relay-broker --version)" = \
+            "agent-relay-broker ${relay_version}"
+
+      - name: Install and build the exact producer source
+        run: |
+          npm install --global npm@10.9.7
+          npm ci --ignore-scripts
+          npm run build:core
+
+      - name: Pack and clean-install the complete Linux candidate closure
+        run: |
+          chmod 700 "$RUNNER_TEMP"
+          node scripts/verify-features/relay-candidate-install.mjs prepare \
+            --output "${RUNNER_TEMP}/relay-candidate-install"
+          node scripts/verify-features/relay-candidate-install.mjs verify \
+            --attestation "${RUNNER_TEMP}/relay-candidate-install/candidate-install-attestation.json"
+
+      - name: Require a unique unpublished candidate package version
+        run: |
+          node scripts/verify-features/relay-package-qualification.mjs verify-candidate-unpublished \
+            --candidate-attestation "${RUNNER_TEMP}/relay-candidate-install/candidate-install-attestation.json"
+
+      - name: Create source-bound package payload
+        run: |
+          node scripts/verify-features/relay-package-qualification.mjs create-payload \
+            --source-sha "${GITHUB_SHA}" \
+            --source-ref "${GITHUB_REF}" \
+            --run-id "${GITHUB_RUN_ID}" \
+            --run-attempt "${GITHUB_RUN_ATTEMPT}" \
+            --candidate-attestation "${RUNNER_TEMP}/relay-candidate-install/candidate-install-attestation.json" \
+            --candidate-tarballs "${RUNNER_TEMP}/relay-candidate-install/tarballs" \
+            --output .qualification/payload/relay-package-attestation.json
+          node scripts/verify-features/relay-package-qualification.mjs validate \
+            --kind payload \
+            --file .qualification/payload/relay-package-attestation.json
+
+      - name: Verify every attested package version exists
+        run: |
+          node scripts/verify-features/relay-package-qualification.mjs verify-files \
+            --file .qualification/payload/relay-package-attestation.json \
+            --directory .qualification/payload
+          node <<'NODE'
+          const { execFileSync } = require('node:child_process');
+          const payload = require('./.qualification/payload/relay-package-attestation.json');
+          for (const [name, { version }] of Object.entries(payload.registry)) {
+            const raw = execFileSync('npm', ['view', `${name}@${version}`, 'version', '--json'], {
+              encoding: 'utf8',
+              stdio: ['ignore', 'pipe', 'inherit'],
+            });
+            const resolved = JSON.parse(raw);
+            if (resolved !== version) throw new Error(`${name}@${version} is not an exact published package`);
+          }
+          NODE
+
+      - name: Upload immutable package payload
+        id: payload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: relay-package-qualification
+          path: .qualification/payload/
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Seal payload artifact identity
+        env:
+          PAYLOAD_ARTIFACT_DIGEST: ${{ steps.payload.outputs.artifact-digest }}
+        run: |
+          node scripts/verify-features/relay-package-qualification.mjs create-envelope \
+            --payload .qualification/payload/relay-package-attestation.json \
+            --artifact-digest "sha256:${PAYLOAD_ARTIFACT_DIGEST}" \
+            --output .qualification/attestation/relay-package-qualification-attestation.json
+          node scripts/verify-features/relay-package-qualification.mjs validate \
+            --kind envelope \
+            --file .qualification/attestation/relay-package-qualification-attestation.json
+
+      - name: Upload immutable package attestation
+        id: attestation
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: relay-package-qualification-attestation
+          path: .qualification/attestation/relay-package-qualification-attestation.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Create the bounded Cloud qualification request
+        env:
+          ATTESTATION_ARTIFACT_DIGEST: ${{ steps.attestation.outputs.artifact-digest }}
+        run: |
+          set -euo pipefail
+          node scripts/verify-features/relay-package-qualification.mjs create-cloud-dispatch \
+            --source-sha "${GITHUB_SHA}" \
+            --run-id "${GITHUB_RUN_ID}" \
+            --run-attempt "${GITHUB_RUN_ATTEMPT}" \
+            --attestation-artifact-digest "sha256:${ATTESTATION_ARTIFACT_DIGEST}" \
+            --output .qualification/cloud-request/relay-package-cloud-request.json
+
+      - name: Upload the bounded Cloud qualification request
+        id: cloud-request
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: relay-package-cloud-request
+          path: .qualification/cloud-request/relay-package-cloud-request.json
+          if-no-files-found: error
+          retention-days: 30