v1: the dispatch-only v1-staging job (registry_base made real)

[EricAndrechek]

Makes the registry_base input of v1.yml's workflow_dispatch real: a dispatch with a staging base runs each enrolled binding's own conformance runner against that host. Needs the lead's clearance (.github, scripts). Not dispatched here.

Design

• Job. v1-staging (matrix, one leg per binding) plus v1-staging-verdict. Both are workflow_dispatch only and run only when registry_base is non-empty. Neither is a required context, neither is in v1-parity's needs, and reports upload as staging-report-*, which v1-parity's report-* download does not match. A binding with no enrollment marker or no runner file skips loudly.
• No runner change needed for the case selection. scripts/fetch-v1/staging.py emit writes a fixtures directory (symlinks to the real one, plus a derived cases.json holding only the applicable cases, with transports: ["registry"], and a sidecar the runners never read). The runner is pointed at it with the existing CHTYPES_V1_CONFORMANCE. The derived table is schema-checked.
• Which cases apply. Nine named rules; a case runs only if the real host can answer it with nothing scripted: tree basic (the only staged tree), no http script, empty cache, no lock or hook or env, one {base}, plain online resolve, test-key trust, no request-log assertion. Today that is 7 of 81: line-ok, patch-float-ok, exact-ok, exact-older-version, two-builds-newest, unpublished-line, missing-platform. The other 74 are listed with their rule in the summary. Of the five cases that already list registry, three run over trees the host does not hold and are excluded.
• 26.6. missing-platform asks for darwin-arm64 on 26.6; the host answers a 404 where the fixture tree serves a partial 200 index. A tag 404 on the only base is CHTYPES_ARTIFACT_UNPUBLISHED (guide §7), so the expected code is unchanged (inferred; the host's 404 is measured 2026-10-03). It is recorded as a note next to the verdict. OVERRIDES in staging.py is the mechanism for a case whose expected outcome does differ; it is empty and a change there is visible in the summary.
• Trust. The test key is never default. emit refuses unless given the test key's own public hex (--trust-test-key, checked against tests/fixtures/fetch-v1/test-key/public.hex); only the staging job passes it. Selftested: a wrong or missing key writes nothing.
• Verdict. Job summary only, exit 0. Per-case, per-binding table, the notes, and the excluded cases.
• Measured on the host (2026-10-03, read-only curl): 11 tags (26.7, 26.7.10, 26.7.10.3, 26.7.15, 26.7.15.5, 26.8, 26.8.15, 26.8.15.10, 26.9, 26.9.3, 26.9.3.38); 26.8/26.8.15.10 index digest differs from the fixture's, but its linux-arm64 platform manifest digest equals line-ok's expected manifest. 26.6 is a 404 MANIFEST_UNKNOWN. The other tags' platform digests are unverified until a run.

Runner changes per binding (not in this PR)

The contract is three env vars: CHTYPES_V1_CONFORMANCE, CHTYPES_V1_REGISTRY_BASE, CHTYPES_V1_REPORT.

• Go (v1 fetch layer, Go lane: resolve, trust, bytes, cache, lock #396): none. Its runner already substitutes CHTYPES_V1_REGISTRY_BASE for {base} on the registry transport and skips registry pairs when it is unset.
• Python (v1 fetch layer, Python lane: the OCI + zstd fetch module #399), TypeScript (v1 fetch layer, TypeScript lane: resolve, trust, bytes, cache and lock #400), Rust (v1 fetch layer, lane Rust: the ocifetch module (OCI + zstd), MSRV 1.87 #397): read CHTYPES_V1_REGISTRY_BASE; on the registry transport expand {base} to it; skip registry pairs when it is unset (so the ordinary matrix is unchanged). Grep of the three heads: none mentions it today.

Local checks

scripts/fetch-v1/staging.py --selftest, emit against the real fixtures (7 cases, schema-valid), lint-actions.sh (actionlint and shellcheck), check-selftests-wired.py, lint-public.sh, lint-spelling.sh, lint-cited-paths.sh, policy-merge-check.py --check-carve-out, gen-constants.py --check, markdownlint-cli2 on the guide. Only CI proves the job's YAML on a hosted runner, and only a dispatch (the PM's) proves it against the host.

🤖 Generated with Claude Code

https://claude.ai/code/session_012NdkF6p8Q3qkdxKCgbdjgb