Knowledge Registrar (knowledge-registrar.yaml)

Knowledge Registrar (knowledge-registrar.yaml)

.github/workflows/knowledge-registrar.yaml is the workflow named “Knowledge Registrar”. A header comment says that it keeps the knowledge bundle’s records well formed, with their provenance recorded, and never judges whether their content is true, which is the curator’s job.¹ NOTICE says that it is a copy of a ktl-sidecar template from the Knowledge Trust Ladder (KTL) repository.² It runs on a pull request that touches .lokf/, knowledge_bundle/ or the workflow itself, every Monday at 06:00 UTC, and by hand.

None of its three jobs can write to the repository: each runs with a read-only token, keeps no credential on disk, and runs no LLM or agent.

• validate, named “Validate the LOKF bundle”, runs every time, with contents: read. It runs just lokf-check-refs, which is lokf validate --check-refs with the domain schema, and then the conventions script, .lokf/scripts/knowledge-conventions.sh.
• provenance, named “Check new human confirmations”, runs on pull requests, with contents: read and pull-requests: read. For each new confirmation by a person in the diff, it passes when that person approved the pull request or signed the commit, as GitHub reports it, and otherwise calls the confirmation unbacked. With curators’ keys in .lokf/curators/, a second check verifies the same signatures with plain git.
• attestation, named “Attest to an unbacked confirmation”, runs only for an unbacked confirmation, with no token scope. It waits until a reviewer of the Environment that the repository variable KNOWLEDGE_CURATION_ENVIRONMENT names approves the run, and the approval is logged with the run.

The header comment adds that the evidence is GitHub’s own record of approvals and signature checks, never the pull request’s text, and that the workflow does not prove that the named person read the source. CONTRIBUTING.md says that it runs on any .lokf/** change.

Footnotes

1. .github/workflows/knowledge-registrar.yaml, the header comment, the on key and the three jobs ↩

2. NOTICE, the Knowledge bundle section ↩