Updating an Attested Custom CI Workflow

Use lumenflow:enable --reattest-custom-ci --id WU-XXXX when an already-attested custom .github/workflows/lumenflow-ci.yml needs a reviewed change. For example, you can separate application Node 24 commands from lifecycle Node 26 commands without replacing the custom workflow with a generated template.

Ordinary lumenflow:enable continues to refuse an unmarked custom workflow. Reattestation requires both flags together and derives its authority from the actual same-user origin claim. It accepts no baseline, digest, receipt or protected-path override.

Make the scoped update

1. Declare the fixed workflow and the authoritative configured integrity manifest in the WU’s code_paths, then claim and brief the WU normally.

2. In the generated worktree, edit and format the workflow with the project’s installed formatter. Preserve the existing manifest, enforcement policy, enabled CI, protected path set and both lifecycle hooks. Keep the index empty before running the command.

3. Run the paired command and inspect the result:

   pnpm lumenflow:enable --reattest-custom-ci --id WU-XXXX
   pnpm lumenflow:doctor

4. Continue the ordinary WU lifecycle with wu:prep and its printed completion command from Main.

The command validates the native claim’s immutable Git baseline and every protected artifact. It pins and rereads the current source, identity, scope, roots, HEAD and effective formatter/configuration before issuing authority or writing. Unformatted bytes, a missing origin claim, a foreign worktree, malformed evidence, deleted or renamed artifacts, escaping symlinks and unrelated protected drift cause refusal.

What the result proves

One genuine single-use receipt binds the exact future manifest to the actual enable transaction, actor, WU, repository, worktree, HEAD, phase and policy. The native protected writer consumes it, reserves its sequence, writes once and verifies actual readback. Ordinary worktree publication commits only the workflow and manifest through the installed hooks.

Successful output reports the observed local commit. With --json, it also includes the receipt digest, sequence and manifest payload digest. The result does not finish the WU or publish an application or package.

If storage, readback or publication fails, the command restores its own manifest only while those bytes and HEAD still match. Other workflow or repository edits and consumed receipts and sequences remain intact. A concurrent manifest edit or moved HEAD is preserved and reported as a rollback conflict. Inspect that state and use ordinary native recovery guidance before retrying; do not reset single-use evidence or repair digests by hand.