[LeiterConsulting]

Scope

Adds an explicit manual bootstrap-only caller to the existing trusted publisher workflow. This mode writes the exact reviewed seed/history to D1, without activation. Default publish and automatic workflow runs remain held before checkout/credentials. The existing publication CLI, runtime authentication, active-delivery flag and production workflow enabled state are unchanged.

The caller binds a clean exact checkout and immutable historical deployment objects, validates full bundle equivalence before credentials, sends one bounded bootstrap request with a stable operation ID, rejects redirects and malformed replies, and never retries. Uncertain POST outcomes require independent readback. A successful response does not establish new history or delivery.

Validation and provenance

• Six files applied to exact base b9077ca64b3a815a626341a7b90a9b80a7a8274d; the CSP content changes are untouched.
• Local maintenance:sync, maintenance:verify, Worker build and 41 focused tests passed on the complete preceding 138e880556714e9b5495360cfd6eb9c36514a79d source tree. Publication/bundle bytes remained unchanged there.
• The newer base changes no caller files. Exact candidate CI and exports on this branch remain pending, not inferred from prior local validation.
• Candidate c93470399536ef916b9a387210bfaecc3b73edbc, tree ff9346d4f6738f5587b87e2154dcafa289cd8eac.

Deployment ordering

This draft does not update the deployed-seed record, merge, enable a workflow, dispatch a production operation or enable active delivery. Current main content differs from the reviewed deployed seed, and bootstrap correctly rejects that mismatch. A reviewed matching-runtime release, exact caller-main CI/export evidence and independently reconciled deployed record must precede any separately approved production bootstrap.

Existing draft #102 is offline historical-seed preparation, not this executable fixed-current-workflow caller; it is not merged or superseded here.

Completed exact-candidate validation

• Fresh-base local reconstruction verified complete base tree a6e90258a69e465dc5b9f323ce121bc9ca879a0b and exact candidate tree ff9346d4f6738f5587b87e2154dcafa289cd8eac. maintenance:sync produced no generated changes; maintenance:verify passed full local tests/build on this tree.
• Branch validation 43224796991 and PR validation 43224857438 both succeeded for head c93470399536ef916b9a387210bfaecc3b73edbc.
• Downloaded branch export artifact 13947633426; original ZIP SHA256 1b75f432348d198c239867d1891d02ea60d7eff79967a912b23eb201c4fe8e67 matched GitHub. The repository export-evidence verifier independently verified all retained artifact hashes and 222 cases against the exact current candidate report inputs; fingerprint 94928c25bb69c22e8fb14a1a60070ddd4c3c91740371e560049a24755c33172c.
• Automated rendering checks are not human visual review, production dispatch, D1 history proof or active-reader qualification. Draft status and production holds remain unchanged.