fix(conformance): preserve protected matrix failure diagnostics

[BunsDev]

The protected run 34074618490 passed on macOS but reported only generic checkout failure on Windows and evidence-finalization failure on Linux. Split those boundaries into allowlisted substage diagnostics so the next run identifies the failing operation without retaining private output or paths.

Preserve the primary diagnostic when finalization and artifact cleanup both fail, while retaining both underlying errors. Update governed workflow hashes, harness authority metadata, and diagnostic documentation.

Validation on final head 25b3bc6:

• corepack pnpm test: normal 551 passed / 61 skipped; heavy 394 passed / 35 skipped.
• corepack pnpm typecheck, corepack pnpm lint, corepack pnpm build, and git diff --check: pass (build verified on identical production source before the metadata-only pin commit).
• Direct Git-object verification: pinned tree, ancestry, and all 25 governed blobs and SHA-256 values match committed bytes.
• Independent review: no remaining blocking findings. The dual-failure regression failed before the fix and passed afterward.

This is diagnostic instrumentation, not passing release evidence. After merge, rebind the SDK validator to the reachable Chat producer and rerun the protected three-platform matrix. SDK #38 remains open until Linux and Windows pass; SDK #40, #41, and Chat #86 remain downstream.

Merge with an actual merge commit: the lock references a behavior commit on this branch. Squash/rebase would break its required ancestry.

[Copilot]

🟡 Changes recommended

One evidence secret-scan path is wrapped with the report diagnostic instead of the new scan diagnostic, which would misattribute failures to the wrong bounded substage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens Phase 1 conformance failure reporting by introducing finer-grained, allowlisted “substage” diagnostics for checkout and schema-v2 evidence finalization, so protected matrix failures surface the correct failing boundary without exposing private output/paths.

Changes:

• Adds new allowlisted diagnostic IDs for per-checkout and per-finalization boundaries (report/operator-state/isolation/assertions/build/serialize/scan/retain).
• Wraps checkout steps and schema-v2 evidence finalization steps in bounded stage helpers so nested failures preserve the most specific diagnostic.
• Updates governed workflow hashes, lock authority metadata, and conformance documentation to match the new governed bytes.

File summaries

File	Description
src/phase1-conformance.test.ts	Adds tests ensuring substage diagnostics survive nested stage wrappers and dual-failure cleanup scenarios.
src/phase1-conformance-lock.test.ts	Updates expected harness authority revision/tree/blob/sha256 values for the governed files.
scripts/phase1-schema-v2-producer.mjs	Introduces new allowlisted substages and wraps checkout + evidence-finalization boundaries to preserve diagnostics and retain underlying causes.
scripts/phase1-conformance.mjs	Extends the public diagnostic allowlist to include the new bounded stage IDs.
phase1-conformance.lock.json	Re-pins harness authority metadata for the updated governed artifacts.
docs/phase1-conformance.md	Documents the new checkout/evidence-finalization substage diagnostics and updates governed hash listings.
.github/workflows/client-v1-conformance.yml	Updates the pinned size/hash entries for governed script bytes.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.