Restore scoped OpenSecret EIF caches

.agents/skills/review-opensecret-security/SKILL.md

@@ -133,11 +133,15 @@ database, provider, client, build/artifact, and live evidence separately.
 
 Local artifact builds and read-only PCR comparison are validation when in
 scope. Root backend CI validates Rust, Nix checks/default binary, and SDK
-compatibility. A separate read-only ARM64 workflow compares dev/prod EIF
+compatibility. A separate ARM64 workflow compares dev/prod EIF
 measurements on explicit approved-PCR JSON edits in PRs, relevant master
 changes, and manual runs. Do not require ordinary backend PRs to update
-approvals, and do not suppress meaningful master mismatches. CI never signs,
-publishes EIFs, or deploys the TEE service. A passing comparison is not live
+approvals, and do not suppress meaningful master mismatches. Only its trusted
+master push/manual job receives OIDC for FlakeHub caching; PRs and non-master
+manual refs use GitHub's branch-scoped cache without OIDC. Review both event
+and ref guards, cache provenance, and default-branch versus PR cache scope.
+Cache writes never authorize approval changes, signing, EIF releases, or
+deployment. A passing comparison is not live
 deployment evidence or proof that both public PCR locations are synchronized.
 Use `docs/pcr-compatibility.md` for manual signed-PCR validation and legacy
 publication. Require explicit authorization for PCR

.agents/skills/validate-opensecret/SKILL.md

@@ -178,12 +178,19 @@ and compares generated measurements on PRs that explicitly edit the four
 approved PCR JSON files, relevant backend/TEE or approval changes to master,
 and manual runs. Ordinary backend PRs do not require new PCR approvals; master
 mismatches intentionally signal that the revision does not match its current
-approvals. CI does not sign, publish EIFs, or deploy the TEE service.
+approvals. CI does not sign, create EIF releases, or deploy the TEE service.
 Ordinary pull-request completion does not update PCR references.
 Do not copy or sign values just to clear a validation failure; distinguish an
 EIF build failure from a PCR mismatch. Use `docs/pcr-compatibility.md` for the
 offline signed-history validation and manual legacy-publication procedure.
 
+For EIF cache/workflow changes, follow
+`docs/nitro-deploy.md#binary-caches-and-cold-run-validation`: preserve
+master-only FlakeHub OIDC and the unprivileged GitHub cache path. Verify actual
+custom-kernel substitution and timing on a fresh hosted ARM64 runner, then
+unprivileged reuse of the warmed GitHub cache. Local store hits and skipped
+PR jobs cannot establish hosted cache performance or cross-organization access.
+
 Immediately before an authorized dev or prod publish/deployment, use the
 supported Linux/ARM64 release builder and the operator runbook in
 `docs/nitro-deploy.md` to build the exact target, review its measurements, and

.github/workflows/opensecret-eif.yml

@@ -7,7 +7,8 @@ on:
     branches: [master]
   workflow_dispatch:
 
-# This is measurement verification, never signing, publication, or deployment.
+# Cache writes are not PCR approval, release publication, or deployment.
+# OIDC is granted only to the separate trusted-master job below.
 permissions:
   contents: read
 
@@ -28,12 +29,10 @@ jobs:
       ${{
         always() && !cancelled() &&
         (
-          github.event_name == 'workflow_dispatch' ||
+          (github.event_name == 'workflow_dispatch' && github.ref != 'refs/heads/master') ||
           (github.event_name == 'pull_request' &&
             needs.changes.result == 'success' &&
-            needs.changes.outputs.pcr_approvals == 'true') ||
-          (github.event_name == 'push' && github.ref == 'refs/heads/master' &&
-            (needs.changes.result != 'success' || needs.changes.outputs.eif != 'false'))
+            needs.changes.outputs.pcr_approvals == 'true')
         )
       }}
     runs-on: ubuntu-24.04-arm
@@ -57,8 +56,72 @@ jobs:
       - name: Install pinned Nix
         uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
         with:
+          determinate: false
           github-token: ""
 
+      # Fork PRs cannot authenticate to FlakeHub. GitHub scopes cache writes
+      # to the PR merge ref; those entries cannot populate master's cache.
+      - name: Reuse branch-scoped Nix cache without FlakeHub credentials
+        uses: DeterminateSystems/magic-nix-cache-action@3c034b51a9deec0a09ef1df8b436ac5db50fae94
+        with:
+          source-revision: 4cc363589df8090801c098cdcde1bdd42562318a
+          use-flakehub: disabled
+          use-gha-cache: enabled
+
+      - name: Build EIF and compare approved measurements
+        shell: bash
+        run: bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE"
+
+  eif-trusted:
+    name: EIF/PCR approval match (master, ${{ matrix.mode }})
+    needs: changes
+    # Never issue an OIDC token to PR code or a dispatch on another ref.
+    if: >-
+      ${{
+        always() && !cancelled() &&
+        github.ref == 'refs/heads/master' &&
+        (
+          github.event_name == 'workflow_dispatch' ||
+          (github.event_name == 'push' &&
+            (needs.changes.result != 'success' || needs.changes.outputs.eif != 'false'))
+        )
+      }}
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: [dev, prod]
+    env:
+      EIF_MODE: ${{ matrix.mode }}
+      OPENSECRET_DEV_POSTGRES: "0"
+      OPENSECRET_DEV_ENV: "0"
+      OPENSECRET_DEV_CONTAINERS: "0"
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Install pinned Determinate Nix for FlakeHub authentication
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        with:
+          determinate: true
+          github-token: ""
+
+      - name: Reuse FlakeHub and warm the master GitHub cache
+        uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3
+        with:
+          # Enable both, not the default fallback-only GitHub cache.
+          use-gha-cache: enabled
+          # Also cache substituted paths, such as the FlakeHub kernel hit,
+          # for later PRs that have no FlakeHub access.
+          diff-store: true
+
       - name: Build EIF and compare approved measurements
         shell: bash
         run: bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE"

AGENTS.md

@@ -104,7 +104,11 @@ same checkout. Backend changes do not imply Research or Agent packaging.
 The separate `opensecret-eif.yml` compares dev/prod EIF measurements only on PRs
 editing approved PCR JSON, relevant master changes, and manual runs. Preserve
 ordinary backend PRs without fresh approvals and meaningful master mismatches;
-these read-only checks never sign, publish, or authorize deployment.
+these checks never change approvals, sign, release, or authorize deployment.
+Only the master EIF job receives OIDC permission for FlakeHub caching. PRs and
+non-master manual runs use GitHub's branch-scoped cache without OIDC. Preserve
+that separation and verify cache changes on fresh hosted runners, not just a
+warm local Nix store. See the [cache policy](services/opensecret/docs/nitro-deploy.md#binary-caches-and-cold-run-validation).
 
 For Pages, read [the deployment guide](docs/pages-deployments.md). Preserve
 unprivileged preview builds and separate development/production profiles.

docs/opensecret-import.md

@@ -47,13 +47,18 @@ checkout against a disposable database; it no longer fetches an external
 backend revision. This advances that lane from the former pinned commit
 `d26eb6bd54d50cc8e6b2967f647a94c61da913da` to the imported source.
 
-PR jobs have read-only credentials and use hosted runners. Backend CI has no
-EIF publisher, signing credentials, OIDC permission, or deployment step. PCR
+PR jobs have read-only repository permission and use hosted runners, without
+OIDC or signing/deployment credentials. Ordinary backend CI has no EIF
+publisher or deployment step. PCR
 file changes retain their signature-validation lane. A separate ARM64 EIF
 workflow compares dev/prod measurements on PRs explicitly editing approved PCR
 JSON, relevant backend/TEE or approval changes to master, and manual runs.
 Ordinary backend PRs do not fail merely because approvals have not been
 updated; master mismatches are an intentional deployment-approval signal.
+Only the master EIF job receives OIDC for FlakeHub Cache and also warms
+GitHub's branch-scoped Nix cache for unprivileged PR/manual runs. Legacy
+cross-organization cache access does not transfer automatically; follow the
+[cache validation policy](../services/opensecret/docs/nitro-deploy.md#binary-caches-and-cold-run-validation).
 Backend-only changes do not select Research or Agent application packaging.
 
 The companion OpenSecret Workspaces change supports Maple-only compositions
@@ -91,6 +96,6 @@ policy. Operator builds run from `services/opensecret/`; verify the selected
 checkout and commit on each deployment host rather than assuming a merged
 source change migrated that host.
 
-GitHub does not sign PCR entries, publish EIFs, or deploy OpenSecret here. The
+GitHub does not sign PCR entries, create EIF releases, or deploy OpenSecret here. The
 copy helper does not commit or push. Sigstore and the legacy compatibility
 sunset remain separate decisions. There is no automatic expiry of the legacy files.