[G01] Strengthen broker process fixture oracles

docs/evidence/g01-live-canary.md

@@ -958,3 +958,74 @@ These checks use synthetic HTTP/subprocess fixtures only. They do not prove live
 - The selected path remains Go `1.27.3`, `github.com/actions/scaleset v0.5.0`, the high-level listener and independent reconciliation. The current upstream latest release remains [v0.5.0](https://github.com/actions/scaleset/releases/tag/v0.5.0).
 - Independent review rejected removing `github.ref_protected`: pinning the reusable callee does not bind or authorize the mutable caller. The guard remains. Private branch protection is unavailable under the current repository plan; no workflow or repository policy was changed. See the [caller-protection review record](https://github.com/1XP-AI/gh-runnerd/issues/1#issuecomment-6616630311).
 - The live canary remains unrun. Issue #1 remains OPEN and Project #2 remains In progress. Outstanding gates include a supported caller-protection path, production provenance and trust-root authority, broker-only execution, conditional Scale Set cleanup, trusted runtime/isolation/resource qualification, and separate concrete authorization plus evidence for the Linux ARM64/JIT canary. No live provider, credential, runner, Scale Set, Docker or host operation was performed for this update.
+
+### Exact-main offline and release recheck — 2026-11-13
+
+Read-only GitHub and local repository checks confirmed both `main` refs at
+`2a71461447bfea7acd61b5c82a38c9f380fb19b9`. The only change since source CI
+commit `853d176766db50c55bbf84575c429ed4924db835` is documentation; the G01
+experiment source is unchanged. The pinned path remains Go `1.27.3` and
+`github.com/actions/scaleset v0.5.0`, using the high-level listener with
+independent reconciliation. The official releases endpoint still reports
+`v0.5.0` as latest (published 2026-10-23).
+
+Offline verification on the exact current checkout used the local Go `1.27.3`
+toolchain, disabled module downloads, read-only module manifests, and external
+volume `GOCACHE`, `GOMODCACHE` and `GOTMPDIR`. The tagged fixture checks also
+set `TMPDIR` to the external volume.
+
+| Check | Result |
+|---|---|
+| G01 module: `go test -race -p=1 -count=1 -timeout=300s ./...` | PASS: root, `livecanary` and `liveworker` packages |
+| G01 module: `go vet -p=1 ./...` | PASS |
+| G01 tagged gate: `go test -race -p=1 -count=1 -timeout=180s -tags='g01_live g01_pair_fixture' -run '^TestTaggedControllerExecutionRequiresBrokerProvenanceBeforeInput$' ./cmd/g01-live` | PASS: refused before controller input was read |
+| G02 module: `go test -race -p=1 -count=1 -timeout=180s -tags=g01_pair_fixture ./cmd/g01-broker` | PASS: loopback broker fixture |
+| Public CI run [41720512574](https://github.com/1XP-AI/gh-runnerd/actions/runs/41720512574) | PASS on unchanged source SHA `853d176766db50c55bbf84575c429ed4924db835` |
+
+This recheck found no additional failure in the exercised offline boundaries.
+It does not establish atomic workflow handoff, production provenance or
+trust-root custody, broker-only authority, server-side conditional deletion,
+trusted runtime/isolation/resource qualification, or live canary behavior.
+The v0.5.0 adapter still lacks conditional Scale Set deletion, so cleanup
+remains quarantined. Issue #1 remains OPEN and Project #2 remains In progress
+until the external acceptance gates and separately authorized Linux ARM64/JIT
+canary are satisfied. No live GitHub write, provider request, credential,
+runner, Scale Set, Docker or host operation was performed for this recheck.
+
+### Process-fixture oracle strengthening — 2026-11-13
+
+Starting from local branch head `6341ad223da4f8d240445a4a891f123e2fea0153`,
+the tagged separate-process fixtures had four oracle gaps: they accepted any
+nonempty App JWT signature, recorded only request method and path, rewrote
+workflow identity from mutable approval state on each GET, and checked attempt
+and account-admission journals only after the process had finished. Four new
+regressions reproduced these gaps before the fixture changes: a forged RS256
+signature was accepted, query parameters were omitted, changing run identity
+made a second GET route unexpectedly, and a token POST was counted with no
+account-ledger intent.
+
+The offline fixture now verifies RS256 using the public key paired with the
+synthetic broker key; snapshots run ID, SHA and reusable-workflow pin on first
+observation; and checks the exact attempt and journal inode identities plus
+the matching read/management lifecycle-start event inside the HTTP dispatch
+before counting a token POST. Its safe request trace now captures full request
+URI, selected non-secret headers, authorization class, and body length/SHA-256.
+It does not retain authorization values or request bodies. The two expected
+HTTP client header profiles are asserted separately.
+
+| Check | Result |
+|---|---|
+| Forged-signature, stable-workflow, query-capture and missing-ledger RED regressions | FAIL as expected before fixture fixes |
+| Admission-intent guard regression: missing record, wrong lifecycle, mismatched attempt inode and mismatched journal inode (`go test -race -p=1 -count=1 -tags=g01_pair_fixture -run '^TestProcessBrokerHTTPRequiresAdmissionIntentBeforeMint$' ./livecanary`) | PASS: all four returned errors before fake route handling; mint, call and trace counts remained zero |
+| Focused G01 process-broker and v3 child tests with `-race` | PASS |
+| Current-source controller/broker TEST helper preparation | PASS; helper artifacts were placed on `/Volumes/worktree` |
+| Actual command group-policy success, organization-only and both rejection cases with `-race` | PASS |
+| Actual acquire-loss command qualification with `-race` | PASS |
+| G02 broker command: `go test -race -p=1 -count=1 -timeout=180s -tags=g01_pair_fixture ./cmd/g01-broker` | PASS |
+| G01 tagged fixture: `go vet -p=1 -tags='g01_live g01_pair_fixture' ./livecanary` | PASS |
+| `git diff --check` | PASS |
+
+These remain synthetic offline proofs. They do not establish live GitHub
+workflow stability, Scale Set cleanup, or runner execution. Issue #1 remains
+OPEN and Project #2 remains In progress; no live provider, runner, credential,
+Docker or host operation was performed.

experiments/g01-scaleset/livecanary/acquire_loss_command_fixture_test.go

@@ -466,7 +466,7 @@ func newCommandQualificationFixture(t *testing.T, controller, broker, variant, p
 	}
 	verificationAuthorization := "Bearer " + f.base.api.credentials.VerificationToken
 	f.transport = &processBrokerHTTP{
-		t: t, attempt: f.attempt, approval: &f.base.a,
+		t: t, attempt: f.attempt, admissionDirectory: f.admission, approval: &f.base.a,
 		expectedWorkflowAuthorizations: []string{"Bearer synthetic-observation-credential", verificationAuthorization, verificationAuthorization},
 	}
 	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -494,7 +494,7 @@ func newCommandQualificationFixture(t *testing.T, controller, broker, variant, p
 	}
 	f.workflowSeed, _ = hex.DecodeString("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f")
 	f.issuerSeed = bytes.Repeat([]byte{71}, ed25519.SeedSize)
-	f.management = experimentalManagement(t, f.base.api.credentials.VerificationToken)
+	f.management, f.transport.appPublicKey = experimentalManagement(t, f.base.api.credentials.VerificationToken)
 	t.Cleanup(func() { clear(f.management); clear(f.workflowSeed); clear(f.issuerSeed) })
 	return f
 }