perf(vault): unlock immediately after MEK unwrap, defer identity sync #1194
nathfavourota-governance.yml
on: push
Strict replay-input policy refusal
0s
Contract-to-CI drift gate
verify-container-linux
/
ota.refusal-canary.task.selfhost-up (linux/container)
verify-container-linux
/
ota.refusal-canary.workflow.selfhost (linux/container)
verify-container-linux
/
ota.verify.verify (linux/container)
verify-native-linux
/
ota.refusal-canary.task.selfhost-up (linux/native)
verify-native-linux
/
ota.refusal-canary.workflow.selfhost (linux/native)
verify-native-linux
/
ota.verify.verify (linux/native)