FC-workflow-control-source-identity.json

{
  "schema_version": 1,
  "id": "FC-workflow-control-source-identity",
  "violated_contract": "A deployment workflow's control-plane scripts must execute from the immutable workflow revision that selected their behavior, while application and image inputs remain pinned to the admitted runtime release revision.",
  "canonical_prevention": "Stage the workflow revision's deployment-control scripts before checking out the admitted runtime source, execute every workflow-owned control-script invocation from that staging directory, and cover the ordering and source boundary with a deployment contract test.",
  "evidence_prs": [
    10254
  ],
  "scope_hints": [
    ".github/workflows/**",
    ".github/actions/**",
    "backend/scripts/**",
    "backend/tests/unit/test_*release_vector.py"
  ],
  "status": "open"
}