fix(directory): trust reviewed materialization evidence

[777genius]

Summary

• align upstream materialization eligibility with the signed Directory publisher's reviewed-external trust lane
• keep schema evidence restricted to reproducible GitHub Actions provenance
• reject malformed reviewed-external provenance

Verification

• go test ./install/integrationctl/agentplugins/domain ./install/integrationctl/agentplugins/adapters/directoryv1 ./install/integrationctl/agentplugins/planner
• go test ./install/integrationctl/agentplugins/... (all relevant packages passed; existing macOS case-collision fixture in adapters/packagedigest remains platform-limited and is covered by Linux CI)

Summary by CodeRabbit

• Bug Fixes
  • Materialization-based eligibility evidence is now accepted through the standard trusted-provenance path.
  • Eligibility checks continue to require workflow provenance for schema-level evidence.
  • Reviewed materialization evidence without workflow details is now accepted, while malformed reviewed provenance remains rejected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 35588301-445e-46d0-9487-800e90092b57

📥 Commits

Reviewing files that changed from the base of the PR and between b2237ad and 2751f36.

📒 Files selected for processing (2)

• install/integrationctl/agentplugins/domain/directory.go
• install/integrationctl/agentplugins/domain/directory_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Materialization evidence no longer requires github_actions provenance. Schema evidence keeps that restriction. Tests now accept workflow-less reviewed materialization trust and reject reviewed trust with a workflow.

Changes

Eligibility provenance

Layer / File(s)	Summary
Trusted materialization provenance install/integrationctl/agentplugins/domain/directory.go, install/integrationctl/agentplugins/domain/directory_test.go	Both eligibility methods restrict github_actions provenance to schema evidence. Tests cover accepted publisher-reviewed materialization and rejected malformed reviewed trust.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2751f

Materialization now accepts reviewed external publisher trust without a workflow while schema evidence remains GitHub Actions-only; malformed reviewed trust is still rejected. The intended behavior is covered with no remaining merge-blocking risk.

Poem

A rabbit checks the trust trail bright
Materialization hops in sight
Schema keeps its workflow guard
Forged review cards meet the yard
The tests now thump their feet
And eligibility stands complete

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: trusting reviewed materialization evidence in directory eligibility.
Description check	✅ Passed	The description explains what changed, why it changed, and the verification performed. It omits the required Release Impact section and does not use the verification checklist format, but the content …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/reviewed-external-materialization

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}