security(ci): separate repo-sentinel gate control plane from PR code

[stacknil]

Problem

The Repo Sentinel consumer gate protects the base baseline and rejects changes to .reposentinel.toml and .reposentinel-baseline.json, but the required pull_request workflow and its orchestration script still come from the pull request merge ref. A pull request can therefore alter the control plane that reports the required check.

This is an ownership boundary, not a scanner finding. The current gate remains useful against accidental policy drift and baseline self-suppression, but it must not be described as resistant to a pull request that rewrites the workflow itself.

GitHub documents that pull_request workflows run from the pull request merge ref, while pull_request_target runs from the base context and becomes dangerous when it checks out or executes untrusted pull request code:

• https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
• https://docs.github.com/en/actions/reference/security/secure-use

Decision-driving hypothesis

A base-owned, read-only, no-secrets control plane can treat the pull request tree as data and preserve the required gate identity without executing pull-request-owned scripts in a privileged context.

Minimum acceptance criteria

• Compare repository ruleset or required-workflow options with a base-owned workflow design.
• Keep the semantic core outside pull-request control for the run that reports the required check.
• Never combine pull_request_target with execution of an untrusted checkout, local action, hook, build script, or dependency definition.
• Keep permissions at contents: read and do not expose repository or organization secrets.
• Define one target tree and verify its commit identity before scanning.
• Add a negative fixture that attempts to replace or bypass the gate implementation.
• Preserve trusted-base baseline selection, protected-policy failure, deterministic redacted reports, and error-only blocking semantics.

Non-goals

• Switching event types merely to make the workflow base-owned.
• Granting write permissions or secrets to a pull request scan.
• Treating CODEOWNERS alone as runtime integrity.
• Expanding scanner heuristics or refreshing the baseline.

Relationship

Issue #9 covers consumer orchestration regressions inside the current trust model. This issue owns the separate control-plane integrity decision.

[stacknil]

Decision update: enforcement and import ownership (2026-09-05)

Repository facts

Read-only API inspection reports owner type User, zero repository rulesets, and main branch protection returning 404 Branch not protected. The existing check is a consumer CI signal, not a currently configured required merge check. Earlier wording calling it a required check should be read as the intended future boundary, not an existing enforcement guarantee. No settings were changed.

Options and constraints

• Organization/enterprise required-workflow rules can select a workflow source outside the PR's control, but that option does not fit this user-owned repository as it stands. Ordinary required status checks can bind an expected GitHub App; that binding alone does not establish which workflow source the GitHub Actions app executed. This is a design inference, not a tested workflow-spoofing result. See ruleset workflow requirements and status-check source rules.
• A base-owned event is not sufficient if any PR-owned program executes. Do not switch to pull_request_target or workflow_run with an untrusted checkout or untrusted code execution. GitHub secure-use guidance.
• A trusted external check provider could make provenance explicit, but installation, credentials, permissions, and repository enforcement are additional decisions. No such provider or settings change is authorized by this experiment.

Bounded hypothesis and result

Hypothesis: holding the orchestration script outside PR control is insufficient if the scanner's Python import path still includes the PR tree.

The local fixture used Python 3.14.3 and the published repo-sentinel-lite==0.8.1, an outside-fixture orchestration script from #11 head 799d4756cbdef59b85a86b30cb0de7948bd8721b, a marker-only repo_sentinel.py, and a deterministic synthetic error input. No secrets or network activity were in the payload.

Case	Exit	Fixture module ran	Error report
Trusted isolated orchestrator, normal scanner child	0	Yes	Missing; gate printed success
Isolated scanner child on the same input	1	No	Present and redacted
Normal child without the shadow module	1	No	Byte-identical to isolated report

This supports a narrow import-isolation fix, not the full control-plane hypothesis. Python -I excludes unsafe default module paths and ignores PYTHON* variables; it is not a sandbox, and the interpreter/installed environment still require trust. Python isolated mode.

Next decision and stop condition

Land the small scanner import-hardening follow-up in #12 after the security delayed-review gate and #11 dependency. Leave this issue open. Before proposing a privileged-event or other control-plane PR, define how a trusted implementation reads the exact head tree only as data, how configuration/symlinks/imports/hooks are bounded, and how the resulting evidence is bound to that head SHA and enforced at merge. A green named check alone is not acceptance evidence.

[stacknil]

Data-plane decision: a matching commit ID does not prove complete scan input

Hypothesis: default git archive <HEAD_SHA> is a byte-exact, complete projection of the target tree suitable for a future trusted scanner that treats PR content only as data.

The bounded local experiment disproved this hypothesis. This is a candidate-design rejection, not a newly discovered defect in #11 or #12: neither PR uses archive materialization.

Evidence

With Git 2.55.0.windows.5, a synthetic bare repository held four regular blobs. The fixture commit was cd56624e16226fa8a8a899a92085efafc4d0dde9, tree 7d096bc94938289455b221702804b0d6eca2b61c.

Property	Default archive	Raw tree/blob read
Commit metadata matches requested SHA	Yes	Commit resolves to the requested tree
File membership	3 of 4; omitted.txt absent	4 of 4
substituted.txt bytes	$Format:%H$ expanded	Original bytes retained
Unmarked control file	Unchanged	Unchanged

All assertions passed. The archive was inspected in memory; no archive paths were extracted, target code was not executed, and the fixture made no network requests. No scanner finding count or sandbox guarantee is claimed.

Git documents that tree-owned export-ignore omits paths and export-subst changes content during archive creation. Archive attributes. The matching tar commit metadata did not detect either projection change.

Consequence for #10

• Reject default archive output plus a SHA check as sufficient input-integrity evidence. A hardened archive design is not ruled out, but it would need its own complete membership and byte-equality proof; this experiment did not test one.
• Prefer evaluating git ls-tree -r -z --full-tree <HEAD_SHA> plus git cat-file blob <OID> as the next data-reader candidate. NUL-delimited paths and raw blob reads preserve the four synthetic inputs here. Do not opt into textconv, worktree filters, or symlink following. Tree output, object-reading options.
• Keep identity checks separate: verify the target commit, selected path membership, object type/mode, and exact content. Resource limits and unsupported entries must yield an explicit incomplete/refused result, never a successful scan with silent omissions.
• Raw object reads alone do not make filesystem materialization safe. Symlinks/gitlinks, path collisions and reserved names, byte/file limits, config ownership, Git configuration/replace objects, scanner imports, and binding results to the required check still need an explicit contract. These are unresolved requirements, not verified capabilities.

Decision value is now obtained: the uncomplicated archive shortcut is rejected. No production implementation, new PR, repository settings change, or extra matrix of archive variants is warranted by this result. #11/#12 remain draft under their September 6 delayed-review gate.

Self-contained local reproduction (Python standard library and Git)

Save as archive_probe.py in a writable temporary directory and run python -I archive_probe.py. It creates and removes only its own temporary fixture beside the script; the reported commit/tree IDs are synthetic.

"""Decision fixture: does an archive preserve a committed tree as raw data?"""

from __future__ import annotations

import io
import json
import os
import subprocess
import tarfile
from pathlib import Path
from tempfile import TemporaryDirectory


def main() -> None:
    environment = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
    environment.update({
        "GIT_CONFIG_NOSYSTEM": "1", "GIT_CONFIG_GLOBAL": os.devnull,
        "GIT_AUTHOR_NAME": "Contract Test", "GIT_AUTHOR_EMAIL": "contract@example.com",
        "GIT_COMMITTER_NAME": "Contract Test", "GIT_COMMITTER_EMAIL": "contract@example.com",
        "GIT_AUTHOR_DATE": "2026-09-05T00:00:00Z",
        "GIT_COMMITTER_DATE": "2026-09-05T00:00:00Z",
    })
    with TemporaryDirectory(prefix="issue10-archive-", dir=Path(__file__).parent) as temporary:
        root = Path(temporary)
        empty_template = root / "empty-template"
        empty_template.mkdir()
        database = root / "objects.git"

        def git(*arguments: str, input_bytes: bytes | None = None) -> bytes:
            result = subprocess.run(
                ["git", "-c", "commit.gpgsign=false", *arguments], cwd=root,
                env=environment, input=input_bytes, capture_output=True, timeout=30,
            )
            if result.returncode:
                raise RuntimeError("synthetic Git operation failed")
            return result.stdout

        git("init", "--bare", "--quiet", f"--template={empty_template}", str(database))
        environment["GIT_DIR"] = str(database)
        contents = {
            ".gitattributes": b"omitted.txt export-ignore\nsubstituted.txt export-subst\n",
            "omitted.txt": b"SYNTHETIC_EVIDENCE_MUST_REMAIN_VISIBLE\n",
            "substituted.txt": b"commit: $Format:%H$\n",
            "visible.txt": b"Unchanged control.\n",
        }
        object_ids = {
            name: git("hash-object", "-w", "--stdin", input_bytes=body).strip()
            for name, body in contents.items()
        }
        tree_input = b"".join(
            b"100644 blob " + object_id + b"\t" + name.encode("ascii") + b"\n"
            for name, object_id in sorted(object_ids.items())
        )
        tree = git("mktree", input_bytes=tree_input).decode("ascii").strip()
        commit = git("commit-tree", tree, input_bytes=b"test: archive projection\n").decode("ascii").strip()
        entries = git("ls-tree", "-r", "-z", "--full-tree", commit).split(b"\0")
        raw = {}
        for entry in filter(None, entries):
            metadata, path = entry.split(b"\t", 1)
            mode, kind, object_id = metadata.split(b" ")
            assert (mode, kind) == (b"100644", b"blob")
            raw[path.decode("ascii")] = git("cat-file", "blob", object_id.decode("ascii"))
        assert raw == contents, "raw object reading lost or transformed committed evidence"

        payload = git("archive", "--format=tar", commit)
        with tarfile.open(fileobj=io.BytesIO(payload), mode="r:") as archive:
            # Read our four known fixture names in memory. Never extract archive paths.
            assert archive.pax_headers.get("comment") == commit
            archived = {}
            for member in archive.getmembers():
                assert member.name in contents and member.isfile()
                source = archive.extractfile(member)
                assert source is not None
                with source:
                    archived[member.name] = source.read()
        assert sorted(set(raw) - set(archived)) == ["omitted.txt"]
        changed = sorted(name for name in archived if archived[name] != raw[name])
        assert changed == ["substituted.txt"]
        assert archived["substituted.txt"] == f"commit: {commit}\n".encode("ascii")
        assert archived["visible.txt"] == raw["visible.txt"]
        print(json.dumps({
            "git_version": git("--version").decode("ascii").strip(),
            "fixture_commit": commit, "fixture_tree": tree,
            "archive_commit_metadata_matches": True,
            "committed_files": len(raw), "archived_files": len(archived),
            "omitted_paths": ["omitted.txt"], "transformed_paths": changed,
            "raw_blob_roundtrip": "4 of 4 byte-exact", "control_unchanged": True,
        }, indent=2))


if __name__ == "__main__":
    main()

[stacknil]

September 6: raw object lookup also needs an explicit trust contract

Delivery status: #11 and #12 merged in order; main is 60cf6f8dff08c33838da3f6584672e815c7e14f9, and #9 is closed. This issue remains open. A fresh read-only API check still reports a User-owned repository, zero rulesets, and unprotected main. No settings were changed.

Hypothesis and decision value

Hypothesis: replacing archive projection with ls-tree plus cat-file blob <full-OID> automatically makes the selected bytes exact.

One local counterexample disproves the unrestricted claim. A deliberately contaminated temporary bare database held two paths and one additional replacement blob. Installing a blob replacement left tree membership and listed OIDs unchanged, but a default read using the original full OID returned replacement bytes. Explicit git --no-replace-objects returned the original; recomputing the Git-framed blob ID independently rejected the mismatched default read. The untouched control remained identical.

Git documents default replacement lookup and its opt-out: git-replace. This is expected Git behavior, not a new Git vulnerability.

Evidence and scope

• Git 2.55.0.windows.5, synthetic SHA-1 commit 8106b78bf92d605ab193c64d23b9b63d53e75a4e, tree 2b73371e0a42518097c96b88f745dc78cae6075e.
• Default-read bytes and rehashed ID differ from the requested blob; no-replace bytes and rehashed ID match.
• Repeated result objects are equal. An in-memory mutation removing only the no-replace flag fails with isolated read lost original evidence; the original passes again.
• The probe uses an empty template, disables system/global config, clears inherited GIT_* inputs, and creates/removes only its own synthetic bare repository. It makes no network requests and executes no target code. A trusted Git/runtime and scratch directory are preconditions.
• This does not demonstrate that an ordinary PR can install replace refs, that checkout imports them, or that test(ci): lock repo-sentinel orchestration boundaries #11/fix(ci): isolate scanner imports from pull request content #12 has a remotely exploitable replace-ref bug. It tests a local contaminated-database assumption for the future reader.
• SHA-1 is explicitly selected for this fixture. It does not validate a general SHA-256 reader, collision resistance, hostile tree parsing, resource budgets, filesystem materialization, or trusted check enforcement.

Proposed contract, not implemented behavior

The future reader should own its object database and execution context; explicitly disable replacement lookup for commit/tree/blob reads; establish object format/type and verify returned raw object identity; and complete bounded path/mode/object selection before returning a successful analysis. Unsupported entries, missing objects, malformed data, or budget exhaustion must refuse the operation, not silently reduce its input. Do not opt into textconv, filters, mailmap rewriting, or symlink following. cat-file option distinctions.

Keep consumer policy separate: accepted-base suppression/config, protected-policy rejection, changed-file errors, and non-blocking baseline audit retain their meanings. A reader result is not a merge authorization; implementation identity and exact head binding remain separate deployment requirements.

Stop this experiment here: the lookup-policy requirement is established. There is no new runtime PR, workflow-event switch, provider installation, credential change, baseline refresh, or release. The next implementation still needs a chosen caller/control-plane boundary.

Self-contained reproduction (Python standard library and Git)

Save this as git_object_replacement_probe.py outside any target checkout. Run python -I git_object_replacement_probe.py --scratch-root <existing-temporary-directory>. It creates and removes its own fixture below that directory. The synthetic objects contain no credentials or personal data.

"""Decision fixture for Git object identity; not a scanner or safe materializer.

Run with: python -I git_object_replacement_probe.py --scratch-root <temporary-root>
Creates only its own temporary bare repository; never changes the caller's repo.
See the sibling sec-writeups-public architecture note for scope and interpretation.
"""

from __future__ import annotations

import argparse
import hashlib
import json
import os
import subprocess
from pathlib import Path
from tempfile import TemporaryDirectory


class ObjectIdentityMismatch(ValueError):
    """Returned bytes do not have the requested synthetic Git blob identity."""


def blob_oid(body: bytes) -> str:
    """Compute Git's SHA-1 blob framing, not a generic file-content digest."""
    framed = b"blob " + str(len(body)).encode("ascii") + b"\0" + body
    return hashlib.sha1(framed, usedforsecurity=False).hexdigest()


def require(condition: bool, message: str) -> None:
    if not condition:
        raise AssertionError(message)


def run_probe(scratch_root: Path) -> dict[str, object]:
    scratch_root = scratch_root.resolve(strict=True)
    if not scratch_root.is_dir():
        raise ValueError("scratch root must be an existing directory")
    environment = {
        key: value for key, value in os.environ.items()
        if not key.upper().startswith("GIT_")
    }
    environment.update({
        "GIT_CONFIG_NOSYSTEM": "1",
        "GIT_CONFIG_GLOBAL": os.devnull,
        "GIT_TERMINAL_PROMPT": "0",
        "GIT_AUTHOR_NAME": "Contract Test",
        "GIT_AUTHOR_EMAIL": "contract@example.com",
        "GIT_COMMITTER_NAME": "Contract Test",
        "GIT_COMMITTER_EMAIL": "contract@example.com",
        "GIT_AUTHOR_DATE": "2026-09-06T00:00:00Z",
        "GIT_COMMITTER_DATE": "2026-09-06T00:00:00Z",
    })
    with TemporaryDirectory(prefix="git-replace-probe-", dir=scratch_root) as name:
        root = Path(name).resolve(strict=True)
        require(root.parent == scratch_root, "fixture escaped its scratch root")
        template = root / "empty-template"
        template.mkdir()

        def git(
            *arguments: str,
            raw: bool = False,
            input_bytes: bytes | None = None,
        ) -> bytes:
            flags = ["--no-replace-objects"] if raw else []
            result = subprocess.run(
                ["git", *flags, "-c", "commit.gpgsign=false", *arguments],
                cwd=root, env=environment, input=input_bytes,
                capture_output=True, timeout=10, check=False,
            )
            if result.returncode:
                raise RuntimeError(f"synthetic Git operation failed: {result.returncode}")
            return result.stdout

        database = root / "objects.git"
        git("init", "--bare", "--quiet", "--object-format=sha1",
            f"--template={template}", str(database))
        environment["GIT_DIR"] = str(database)

        def write_blob(body: bytes) -> str:
            oid = git("hash-object", "-w", "--stdin", input_bytes=body).decode().strip()
            require(oid == blob_oid(body), "fixture blob framing differs from Git")
            return oid

        original = b"SYNTHETIC_EVIDENCE_MUST_REMAIN_VISIBLE\n"
        replacement = b"BENIGN_REPLACEMENT_CONTROL\n"
        control = b"Unchanged control.\n"
        original_oid = write_blob(original)
        replacement_oid = write_blob(replacement)
        control_oid = write_blob(control)
        tree_input = (
            f"100644 blob {control_oid}\tcontrol.txt\n"
            f"100644 blob {original_oid}\tevidence.txt\n"
        ).encode("ascii")
        tree = git("mktree", input_bytes=tree_input).decode().strip()
        commit = git("commit-tree", tree, input_bytes=b"test: raw object identity\n").decode().strip()
        listing = git("ls-tree", "-r", "-z", "--full-tree", commit)
        require(git("cat-file", "blob", original_oid) == original, "baseline differs")

        # Install a replacement only in this deliberately contaminated fixture DB.
        git("replace", original_oid, replacement_oid)
        default_bytes = git("cat-file", "blob", original_oid)
        isolated_bytes = git("cat-file", "blob", original_oid, raw=True)
        require(default_bytes == replacement, "default read did not honor fixture replace ref")
        require(isolated_bytes == original, "isolated read lost original evidence")
        require(git("ls-tree", "-r", "-z", "--full-tree", commit) == listing,
                "blob replacement unexpectedly changed listing")
        require(git("ls-tree", "-r", "-z", "--full-tree", commit, raw=True) == listing,
                "isolated listing differs")
        require(original_oid.encode() in listing, "listing did not retain original OID")
        require(git("cat-file", "blob", control_oid) == control
                and git("cat-file", "blob", control_oid, raw=True) == control,
                "untouched control changed")

        def verified_read(*, raw: bool) -> bytes:
            body = git("cat-file", "blob", original_oid, raw=raw)
            if blob_oid(body) != original_oid:
                raise ObjectIdentityMismatch("requested OID does not identify returned bytes")
            return body

        try:
            verified_read(raw=False)
        except ObjectIdentityMismatch:
            mismatch_rejected = True
        else:
            raise AssertionError("independent identity check accepted replacement bytes")
        require(verified_read(raw=True) == original, "guarded verified read failed")
        result = {
            "git_version": git("--version").decode("ascii").strip(),
            "object_format": "sha1 (fixture only)",
            "fixture_commit": commit,
            "fixture_tree": tree,
            "requested_blob": original_oid,
            "replacement_blob": replacement_oid,
            "listed_membership_and_oids_unchanged": True,
            "default_read_returns_original": default_bytes == original,
            "default_read_rehash_matches_requested": blob_oid(default_bytes) == original_oid,
            "isolated_read_returns_original": isolated_bytes == original,
            "isolated_read_rehash_matches_requested": blob_oid(isolated_bytes) == original_oid,
            "independent_mismatch_rejected": mismatch_rejected,
            "untouched_control_preserved": True,
        }
    require(not root.exists(), "temporary fixture cleanup did not complete")
    return {**result, "temporary_fixture_removed": True}


def main() -> None:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--scratch-root", type=Path, required=True)
    args = parser.parse_args()
    print(json.dumps(run_probe(args.scratch_root), indent=2, sort_keys=True))


if __name__ == "__main__":
    main()

[stacknil]

Control-plane option decision: base-owned advisory candidate first

Decision: use pull_request_target only as the in-repository candidate for a base-owned, advisory proof. Do not use workflow_run as the primary gate, and do not describe either event as merge enforcement until a live canary proves exact-head association and a separate repository policy actually requires the result.

This is an architecture decision, not implemented behavior. No workflow, permission, secret, rule, branch protection setting, baseline, or release changed in this step.

Why this option survives

GitHub documents that a pull_request_target workflow and its default checkout come from the base repository's default branch. It also documents that this event has elevated trust and becomes unsafe when pull-request code is fetched and then executed. The future design therefore has one narrow acceptable shape: trusted code inspects the pull-request tree only as data, without executing target-owned actions, hooks, imports, builds, dependencies, or configuration.

GITHUB_SHA and GITHUB_REF for this event identify the default branch, not the pull-request head. The reader must take the target identity from the event payload, fetch a fixed refs/pull/<number>/head into a fresh verifier-owned object database, and refuse unless the fetched tip equals github.event.pull_request.head.sha. The workflow source SHA, accepted base SHA, target head SHA, and target tree ID must be recorded separately.

• pull_request_target security model
• event SHA/ref semantics

Why workflow_run is not the primary candidate

GitHub documents that workflow_run also runs from the default branch and can access secrets and write tokens even when the upstream workflow could not. Its default SHA/ref are again the default branch, and artifacts produced by the upstream workflow must be treated as untrusted data.

Using it here would add another identity and completeness boundary: the trusted stage would have to prove which upstream run produced the data, which exact PR head that run represents, that a missing or renamed upstream workflow fails closed, and that no untrusted artifact or cache becomes executable. There is no required privileged post-processing step in the current design that justifies this extra chain.

• workflow_run event and privilege warning
• secure-use guidance for untrusted checkout and artifacts

Candidate runtime contract

1. Use explicit permissions: contents: read; reference no repository or organization secrets; restore no PR-influenced cache.
2. Run only the base-owned workflow, base-owned verifier, a trusted interpreter/Git executable, and the pinned scanner package. Pin third-party actions by immutable commit.
3. Obtain the PR ref in a new bare object database without checking it out. Verify the fetched head and resolved tree before reading entries.
4. Apply the proposed reader contract already recorded above: no-replace reads for commit/tree/blob, independent object identity checks, NUL-safe path parsing, regular-file-only admission initially, and explicit entry/byte/time budgets.
5. Materialize only admitted regular blobs into a verifier-owned scratch tree. Never use target content as the working directory or as an action, hook, import path, dependency definition, build script, or scanner configuration.
6. Keep accepted-base suppression/config authority and the existing protected-policy rejection. incomplete or refused input is distinct from a clean scan and cannot authorize a merge or baseline update.
7. Emit a stable evidence tuple containing workflow source SHA, base SHA, head SHA, tree ID, reader outcome, and scanner outcome. A target edit to the workflow or helper must not change the implementation used for that target's run.

Acceptance sequence before any enforcement claim

1. Open a draft security-boundary PR with semantic commits for behavior, negative tests, and documentation. The new event remains advisory. Because a pull_request_target workflow must exist on the default branch, this PR cannot prove its own event semantics and must receive delayed review under the repository's current process.
2. After that advisory workflow reaches main, open a canary PR that changes its own copy of the workflow/helper and includes a harmless target-owned execution trap. The base implementation must run; the trap must remain data; the evidence tuple must name the canary head exactly.
3. Inspect the resulting check suite through the API. Verify which SHA owns the check and whether GitHub can recognize that result as a required check for the PR head. The documentation's default-branch GITHUB_SHA means this cannot be assumed in advance.
4. Only after that observation choose enforcement. If the result is not head-bound, reject pull_request_target alone as the final gate and evaluate a separately authorized GitHub App/check publisher or another policy mechanism. Do not grant checks: write, install an app, or change branch protection as part of the advisory proof.

Current repository boundary

The 2026-09-06 read-only API refresh still reports a public repository owned by a User, zero rulesets, main.protected=false, and main 60cf6f8dff08c33838da3f6584672e815c7e14f9. Organization/enterprise required-workflow rules are therefore not the current deployment path. An external check provider would add installation, credentials, permissions, and repository-setting decisions that are outside this experiment.

Design decision: one base-owned advisory event, one data-only reader, and one explicit head-evidence tuple before enforcement.

Main risk: a future implementation accidentally executes target-controlled content, or a successful run is attached to the default-branch SHA rather than the PR head and is mistaken for a merge gate.

Compatibility impact: none yet. The existing pull_request checks continue to detect accidental drift under their current trust model; baseline and scanner semantics are unchanged.

Rollback path: remove the advisory workflow/helper and retain the existing checks. No corpus, schema, baseline, credential, or repository-setting migration is required.

Stop condition: the option comparison and pre-enforcement acceptance gates are now explicit. Do not add more archive, ratio, or object-lookup variants before the advisory implementation is reviewed; do not change repository enforcement without explicit authorization.

[stacknil]

Foundation delivery: draft PR #13

Draft PR #13 implements the first independently reviewable prerequisite for the selected advisory design. It does not add pull_request_target or claim enforcement.

Delivered scope at head 15b21fe24e276917c851f3f2d99e7c3977950dd0:

• build_gate_plan_from_graph() derives the existing protected-policy, changed/deleted-path, and accepted-base baseline decisions without requiring a target checkout;
• all Git reads in the orchestration module use --no-replace-objects;
• the scanner can execute from a separate trusted directory while receiving the target as an absolute data path;
• real Git regressions cover checkout-independent planning and replacement-ref isolation.

All seven remote checks passed. Local validation also passed 19 unit/contract tests, all selected pre-commit hooks, Ruff, actionlint, the published v0.8.1 PASS/FAIL/redaction/import-isolation fixture, and the real changed-file gate over the three changed paths. Removing only the no-replace guard made the replacement-ref test fail with replacement baseline bytes, then restoring it returned the targeted suite to green.

The PR is still draft under the security-boundary policy. Its initial post-CI review records design decision, main risk, compatibility impact, and rollback path; delayed unchanged-head review remains due on or after 2026-09-08.

Next dependency after #13 is reviewed and merged: implement the bounded regular-file reader and refusal evidence as a separate draft PR. Only the following PR should add the advisory event, followed by a main-resident canary and Check API head-binding observation. No repository settings, permissions, credentials, baseline, or release changed here.

[stacknil]

Foundation PR #13 completed its delayed review and merged as 91050690fe737a891b60978239b780f083426025.

The reviewed head remained 15b21fe24e276917c851f3f2d99e7c3977950dd0 for more than 22 hours; the base remained 60cf6f8dff08c33838da3f6584672e815c7e14f9. Final review found no blocking issue. Nineteen unit tests, Ruff, actionlint, tag rendering, 157-file Markdown validation, pre-commit hooks, the published-package synthetic PASS/FAIL/redaction/import-isolation contract, and git diff --check passed. All seven PR checks remained successful with no review comments or external reviews. The push workflow on merge commit 9105069 also passed.

This closes only the graph-planning foundation: no PR-ref acquisition, tree reader, materializer, privileged event, Check API binding, or enforcement setting was added. The next bounded hypothesis is whether a regular-file-only reader can preserve path/mode/type/blob identity, reject replacement or transformed reads, and produce explicit refusal evidence under file/byte/time limits without executing target content. That reader should be a separate draft PR before any advisory workflow is introduced.

[stacknil]

Draft PR #14 adds the bounded raw snapshot reader above merged foundation 9105069. Head d136d47f5e4ee990fbb3ab7505d62e5590171740 is 3 files / 387 additions, split into behavior, tests and documentation commits.

The decision-driving hypothesis now has implementation evidence: complete SHA-1/SHA-256 snapshots preserve raw commit/tree/blob identity and regular-file path/mode/content, while unsupported inputs or resource exhaustion return explicit refusal. Eleven reader tests cover actual bare objects, replace refs, archive attributes, types/paths and budgets; all 30 repository tests and seven PR checks pass. Guard-removal experiments verify both replacement lookup and independent rehash controls.

The reader returns bytes in memory and is not yet connected to a workflow or materializer. It deliberately admits only an ASCII portable path subset. The next review is on or after 2026-09-09; after merge, acquisition/materialization needs its own authority and refusal contract before advisory workflow activation and the head-binding canary.

[stacknil]

The next materialization step is draft PR #15, head 2f7b7a9, based on reader #14 at 0f10194. It adds a context manager that completes raw reading before allocation, creates a private temporary data directory, uses exclusive file creation plus exact readback, yields only after complete setup, and cleans output on context exit. Twelve new tests and all seven remote PR checks pass; the child delta is 3 files / 351 additions, split into behavior, tests and docs.

This filesystem review also found and fixed a parent admission defect: NUL .txt and COM1 .log were accepted despite Windows device-name alias handling. Two raw-tree tests reproduced missing refusal before the correction at 0f10194; no device path was opened. The parent PR now has renewed successful CI and needs delayed review against its new head.

Both PRs remain draft. On or after 2026-09-09, review/merge #14 first, then retarget #15 with an explicit parent-tree and reviewed-delta equivalence check and a new-base gate run. Scratch ownership, concurrent mutation exclusion, cleanup-failure handling and filesystem I/O limits are documented. PR-ref acquisition and scanner/workflow wiring remain pending; no event, permissions, credentials or enforcement settings changed.

[stacknil]

Reader and materializer delivery completed

PR #14 merged as d46e5e507eedb7c5b76e4b648d91f70d3ffc9adc; PR #15 then retargeted to main and merged as 56fdb32012f287c8fc615df711c02d41a9919052.

Both security-boundary PRs completed delayed unchanged-head review after more than 26 hours. The reader merge tree exactly matched reviewed head 0f10194, and the materializer's binary patch SHA-256 was identical before and after retargeting. Remote blobs matched local review. PR checks were 7/7 successful, and the push workflow passed on both merge commits.

Fresh local validation on the final materializer stack passed 42 repository tests, applicable pre-commit hooks, Ruff, tag rendering, 157-file Markdown validation, git diff --check, and the real changed-file gate. No workflow event, permissions, credentials, secrets, repository settings, baseline, scanner policy or report schema changed.

The delivered boundary now establishes:

• complete raw commit/tree/blob identity and regular-file admission before success;
• explicit refusal for unsupported modes, unsafe/ambiguous portable paths and resource exhaustion;
• complete read before filesystem allocation;
• caller-owned temporary lifetime, exclusive creation, exact readback and explicit cleanup failure.

This still does not establish where the PR objects came from or bind a result to the event's exact head. The next independently reviewable hypothesis is: a verifier-owned fresh bare repository can acquire exactly refs/pull/<number>/head, prove that its fetched tip equals the expected full head OID, and pass only that verified commit into the existing reader without checkout or target execution.

The acquisition step must fail closed on ref movement, missing or unexpected objects, object-format mismatch, fetch failure, budget/timeout exhaustion, or an expected/fetched head mismatch. It must not add pull_request_target, consume target configuration, restore target caches, expose secrets, or claim Check API head binding. Advisory workflow activation and the main-resident canary remain later gates.

[stacknil]

Exact PR-head acquisition: draft PR #16

Draft PR #16, head cc99fa2, implements the next checkout-free identity edge: fresh bare database, fixed refs/pull/<number>/head refspec, exact expected/fetched full-OID equality, and delegation to the merged bounded reader before any result is yielded.

The PR is three files and remains draft. Twelve acquisition tests cover both Git object formats, exact bytes, target non-execution, unrequested refs/objects, moved and missing refs, timeout, post-fetch repository budget, reader refusal, scratch symlinks and cleanup. The full 54-test suite, applicable pre-commit hooks, Ruff, Markdown validation, the actual changed-file gate and all seven remote checks pass. Remote blobs match the reviewed local files.

The live HTTPS probe produced a decision-relevant negative result: PR #15 head 2f7b7a9 was acquired with exact identity, then the merged reader returned unsupported_path. Eight of 242 public paths contain characters outside the initial ASCII subset, including ampersands, apostrophes, exclamation marks, an en dash and a curly apostrophe. No partial snapshot or database survived.

Therefore #16 establishes fail-closed acquisition but does not make the repository workflow-ready. Keep it draft for delayed review on or after 2026-09-10. Before any advisory workflow activation, define a separate path-admission hypothesis covering Unicode normalization, Windows reserved/forbidden names, case-fold collisions and stable report/baseline identity. Do not solve this by path rewriting or by dropping unsupported findings.

No event, permission, credential, secret, cache, Check API write, repository setting, baseline, report schema or release changed.