[echo-fleet-builder]

Objective

Load independently signed production E2E attestations for the subscriber dispatcher, preserving exact target/environment identity, pinned collector trust, and fail-closed NOT_READY behavior.

This branch now incorporates main's PR24 readiness timeout/logging fix and repairs unbounded HTTP probes. Staging, production, and rollback polling share an elapsed deadline; every curl request has finite connection/response limits; invalid timeout settings fail before deployment side effects. Listener ownership and signed readiness gates are preserved.

The release policy required authentic CI and CodeQL checks, but the existing job was named test and no CodeQL workflow existed. The substantive validation job now publishes CI; a real Python CodeQL workflow extracts, analyzes, uploads, and processes results. Both check out and assert the exact candidate SHA, bind evidence to it, and use supported official Actions runtimes on Ubuntu 24.04.

Evidence

• Final head: 710c10fe1333f1be7ce64f0746c24c0ab12da0f5.
• CI run 37128413340: success, exact candidate checkout, 684 tests passed, 80.06% coverage. P1 verification, P6 acceptance (12/12), and P7 acceptance passed.
• CodeQL run 37128413349: success, exact candidate analysis, 43 rules, zero findings. SARIF upload and processing completed; authentic GitHub Actions and GitHub Advanced Security checks both succeeded.
• Verification artifact is named for the full candidate SHA.
• Local focused deployment, readiness, and production-attestation tests: 50 passed. Bash syntax, actionlint, diff validation, changed-file gitleaks, and independent reviews passed.
• Negative cases include malformed/overflowing/zero timeouts, slow cold start, stalled HTTP probes, exhausted deadlines, immediate success, and all three deployment call sites.
• The main conflict is resolved; this PR remains draft. Repair release checks, readiness deadlines, and dependency policy #25 integrates these repairs with the fix(certforge): patched base image + cryptography 50 for P4 sealing (#22) #23 security-release candidate and patched package dependency policy.

Security and release impact

• No secrets, private evidence, customer data, or personal information are included.
• Verdict behavior remains deterministic and fail closed.
• Public contract and documentation changes are included where applicable.
• Staging-first deployment and rollback implications are documented.
• Unrelated repository history and license boundaries are preserved.

The HTTP polling budget excludes existing service-manager/listener subprocesses and the separate bounded diagnostic request. Failure logs and rollback gates remain intact.

The earlier GitHub CLI workflow-scope denial is resolved through explicit owner approval and GitHub's official consent flow. The prepared workflow changes are published and verified. No alternate credential route was used for the denied action.

Remaining gates

Neither new candidate head currently has a Release Sentinel or CertForge check. Passing CI and CodeQL does not establish signed production readiness. New exact-SHA CertForge/GitHub App evidence, current production identity, and independently signed production E2E remain unverified. The Forge connector still requires reauthentication; that boundary was not bypassed.

PR24 reports historical successful staging/production smoke for d8ad9fd; it does not establish this candidate's production identity or readiness. Main's observed branch-protection/ruleset enforcement gap was not changed.

No merge, deployment, production smoke, production rollback, signing, or repository security-setting change was performed.