ci: add hash-locked CompanyScope and Sentinel conformance

.github/workflows/companyscope-incident-register-conformance.yml

@@ -3,10 +3,12 @@ on:
   push:
     paths:
       - "integrations/companyscope-incident-register/**"
+      - "requirements/companyscope-incident-register-fixed.*"
       - ".github/workflows/companyscope-incident-register-conformance.yml"
   pull_request:
     paths:
       - "integrations/companyscope-incident-register/**"
+      - "requirements/companyscope-incident-register-fixed.*"
       - ".github/workflows/companyscope-incident-register-conformance.yml"
   schedule:
     - cron: "0 6 * * 1"
@@ -17,6 +19,7 @@ permissions:
 
 jobs:
   conformance:
+    name: floating (latest releases, drift detection)
     strategy:
       fail-fast: false
       matrix:
@@ -33,3 +36,35 @@ jobs:
       # This integration emits a human review pack, not a TRACE record.
       - name: Integration tests against the pinned feed fixture
         run: python -m pytest integrations/companyscope-incident-register/tests -q
+
+  fixed:
+    name: fixed (tested_against versions)
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install hash-locked integration test dependencies
+        run: python -m pip install --require-hashes -r requirements/companyscope-incident-register-fixed.txt
+      - name: Pinned version matches integration.yaml
+        run: |
+          python - <<'PY'
+          import re
+          from importlib.metadata import version
+          from pathlib import Path
+          manifest = Path("integrations/companyscope-incident-register/integration.yaml").read_text()
+          expected = re.search(r'^  agent-manifest: "([^"]+)"$', manifest, re.M)
+          assert expected is not None, "integration.yaml must declare tested_against.agent-manifest"
+          actual = version("agent-manifest")
+          assert actual == expected[1], (expected[1], actual)
+          print(f"agent-manifest {actual} matches integration.yaml")
+          PY
+      # This integration emits a human review pack, not a TRACE record.
+      - name: Integration tests against the pinned feed fixture
+        run: python -m pytest integrations/companyscope-incident-register/tests -q

.github/workflows/sentinel-conformance.yml

@@ -3,10 +3,12 @@ on:
   push:
     paths:
       - "integrations/sentinel/**"
+      - "requirements/sentinel-fixed.*"
       - ".github/workflows/sentinel-conformance.yml"
   pull_request:
     paths:
       - "integrations/sentinel/**"
+      - "requirements/sentinel-fixed.*"
       - ".github/workflows/sentinel-conformance.yml"
   schedule:
     - cron: "0 6 * * 1"
@@ -17,6 +19,7 @@ permissions:
 
 jobs:
   conformance:
+    name: floating (latest releases, drift detection)
     strategy:
       fail-fast: false
       matrix:
@@ -35,3 +38,23 @@ jobs:
       - name: Integration tests
         working-directory: integrations/sentinel
         run: python -m pytest tests -q
+
+  fixed:
+    name: fixed (hash-locked snapshot)
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install hash-locked integration test dependencies
+        run: python -m pip install --require-hashes -r requirements/sentinel-fixed.txt
+      # The suite includes TRACE Level 0 checks and signed-claim round trips.
+      - name: Integration tests
+        working-directory: integrations/sentinel
+        run: python -m pytest tests -q

requirements/companyscope-incident-register-fixed.in

@@ -0,0 +1,7 @@
+# Compile with:
+#   uv pip compile requirements/companyscope-incident-register-fixed.in --generate-hashes --universal \
+#     --python-version 3.11 -o requirements/companyscope-incident-register-fixed.txt
+# Match the published version recorded in integration.yaml; keep the existing
+# floating job as drift detection against current releases.
+agent-manifest==0.12.0
+pytest