From e29c174f2f1f16625e7b6d117ca51d7778c07481 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 20 Jul 2026 02:07:37 +0200
Subject: [PATCH] =?UTF-8?q?work-records=20CI=20gate=20=E2=80=94=20CUST-WP-?=
 =?UTF-8?q?0060-T06=20pilot?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wires the canon work-record validation workflow (repo-seed template).
Local proof: 45 records checked, 0 errors, 0 warnings — AWQ/DEC/OH ids
pass grandfathered, zero renames (the acceptance test for the
grandfathering design).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .forgejo/workflows/work-records.yaml | 39 ++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .forgejo/workflows/work-records.yaml

diff --git a/.forgejo/workflows/work-records.yaml b/.forgejo/workflows/work-records.yaml
new file mode 100644
index 0000000..9eae785
--- /dev/null
+++ b/.forgejo/workflows/work-records.yaml
@@ -0,0 +1,39 @@
+# Work-record validation gate (canon: work-record-types_v0.1.md, CUST-WP-0060-T04).
+# Copy to: .forgejo/workflows/work-records.yaml in consumer repos.
+# Validates all work-record YAML blocks (intake/decision/engagement + task ids)
+# against the canon kind registry and JSON schemas before they reach the hub.
+# Zero-config: repos without work records pass in seconds.
+# Uses archive checkout (no actions/checkout; non-root runner has no git).
+name: Work Records
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.md"
+      - ".forgejo/workflows/work-records.yaml"
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: self-hosted
+    steps:
+      - name: Fetch repo + canon, validate work records
+        run: |
+          set -eu
+          WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+          REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
+          BASE="https://forgejo.coulomb.social"
+          mkdir -p "$WORK/repo" "$WORK/canon"
+          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
+          wget -qO "$WORK/repo.tar.gz" \
+            "${BASE}/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf "$WORK/repo.tar.gz" -C "$WORK/repo" --strip-components=1
+          wget -qO "$WORK/canon.tar.gz" \
+            "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
+          tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
+          python3 -m pip install --user --quiet pyyaml jsonschema
+          python3 "$WORK/canon/tools/validate_work_records.py" \
+            --repo "$WORK/repo" --canon "$WORK/canon"