Why:
Formal root tests cannot read ignored migration clones, so provider CI regressions failed despite the product and source gates passing.
Evidence:
SELF receipts record 18 missing-source errors, then all 29 credential cases passing from a real source archive without .migration and with exact host Git-source validation.
Impact:
Use committed test-only workflow snapshots with full source commits and SHA256 provenance. Real acquisition still executes trusted inline workflows and never reads these fixtures.
Refs:
Dependency-workspace U5/U7; archive receipt66f01970885b34bbb0f9a2dfb244e4a58618b725e600f85fe765099cf2f3bd36.
weichen
88b918132f