Cleanroom qualification executes secret-bearing verifier from an arbitrary dispatch ref

[khaliqgant]

Problem

PR #1665 activates workflow_dispatch on a full qualification workflow that checks out github.sha and executes its verifier, workflow, install, and cleanup code while the snapshot-qualification environment exposes Daytona, model-provider, Cloud, and cross-repository credentials. GitHub lets a caller select the workflow dispatch ref, so a qualification/* branch can replace the in-branch validation before any actor/ref guard runs.

An actor allowlist inside that same candidate-controlled workflow is not a trust boundary: the selected ref can remove it. The candidate ref must be immutable input data/package artifacts, never the source of the secret-bearing runner.

Exact evidence

• Relay PR test(cleanroom): add exhaustive Relay and Fleet qualification #1665 exact head before the split: 63f635ac9e2b8a16cfcf51aead6aa46d03972d33
• Workflow: .github/workflows/relay-cleanroom-qualification.yml
• Qualification job uses environment: snapshot-qualification and secret env/step values.
• Check out qualification verifier uses ref: ${{ github.sha }} and later runs scripts and workflows/verify-fleet-daytona.ts from that checkout.
• The environment currently has no protection rule that can make candidate-controlled code safe.
• Live Fleet credit remains 0/376 operations and 0/20 lifecycle assertions.

Required behavior

• A no-secret request workflow may run on a qualification ref and upload only a bounded manifest request artifact.
• A default-branch workflow_run consumer must always fire, validate exact workflow path/name/event/repository/conclusion, approved actor and rerun actor, source ref/SHA, complete bounded artifact inventory/digest/archive, and exact payload.
• Every secret-bearing validation, Fleet orchestration, and cleanup instruction must be loaded from the trusted default branch.
• Candidate Relay source may enter only through an immutable, attested package pointer; it must never supply executable workflow/harness code.
• Credential permissions must be least privilege, and exact create-step-owned workspace IDs must be independently reconciled and deleted.
• Add malicious-ref and payload-substitution regressions plus a live post-merge workflow_run proof.

Related: #1665, #1666, #1676.

[khaliqgant]

Trusted-default prerequisite is now PR #1683 at exact head fb288b3. It does not claim Fleet qualification; #1665 must consume the merged trusted path before the two live boards run.