feat: stage security merge protection and audit effective policy

.github/workflows/audit.yml

@@ -23,6 +23,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Install workflow verification dependencies
+        run: python3 -m pip install --requirement requirements-validation.txt
+
       - name: Compare desired state with GitHub
         env:
           GH_TOKEN: ${{ secrets.ATRINIK_SETTINGS_TOKEN }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,27 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited]
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime,development,unknown
+          warn-only: false
+          comment-summary-in-pr: never
+          show-openssf-scorecard: false
+          retry-on-snapshot-warnings: true
+          retry-on-snapshot-warnings-timeout: 120

.github/workflows/publish-planning.yml

@@ -18,6 +18,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Install workflow verification dependencies
+        run: python3 -m pip install --requirement requirements-validation.txt
+
       - name: Verify settings credential inventory
         env:
           GH_TOKEN: ${{ secrets.ATRINIK_SETTINGS_TOKEN }}

AGENTS.md

@@ -225,3 +225,68 @@
   `release_policy: none` and are omitted from `release_tags`.
 - Update this `AGENTS.md` in the same change when major rework alters governance
   ownership, policy scope, publisher behavior, required checks, or validation.
+
+- `config/security-merge-protection.json` owns the dependency-review and CodeQL
+  target sets, per-gate `pending`/`enforced` activation intent, and default-setup
+  required language minima. Keep both sets and activation keys equal to the
+  required-CI inventory. Union required languages with live default-setup
+  languages, fail on unreadable language state, and patch only real drift.
+- Keep `06 - CodeQL security` and `07 - Dependency review` repository-owned in
+  both policy scopes; Team has no organization code-scanning rule support.
+  Pending gates only probe readiness. Promote intent through source review after
+  read-only `bin/security-readiness` proves landed successful producers, before
+  the first authorized live installation. Enforced gates remain required when
+  deleted or producers fail; audit fails on absence and publication restores
+  protection without fresh initial qualification. Keep
+  aggregate checks, zero approvals, and owner pull-request-only bypass intact.
+- Advanced CodeQL readiness parses executable YAML with the declared validation
+  dependency: bind classification outputs, matrix, scoped config, official
+  full-SHA init/analyze actions, and the always-running aggregate. Reject
+  duplicate keys, disconnected or disabled steps, and failure suppression.
+  Require ordinary pull-request triggers covering the live default branch and
+  opened/synchronize/reopened events without path filters.
+  Producer helpers remain trusted; preserve owner-controlled action updates,
+  category names and paths without a duplicate version/path catalog.
+- `config/actions-sha-pinning.json` persists SHA rollout as `pending` with no
+  canary or `enforced` with an accepted PR coordinate. Promote it through normal
+  source review only after ordinary PR-bound action-update evidence passes.
+  Pending command-line canaries only probe readiness; they never enable SHA
+  enforcement. Enforced policy uses its stored proof to restore drift and fails
+  if proof cannot be revalidated; audit reports disabled enforced policy as
+  drift. Preserve existing true settings. Allow action names with `@*`; keep
+  full SHAs in producer workflows instead of duplicate pin catalogs. Canary
+  legacy-check absence requires verified protection evidence; a bare or
+  ambiguous 404 is unreadable. Enumerate and validate every ruleset page before
+  publisher identity, absence, update or retirement decisions.
+- Adoption of existing security gates into enforced source intent requires the
+  effective default-branch API to prove the repository-owned ruleset and desired
+  tool/context. Never infer activation from target membership or silently change
+  source intent. Retire target and activation entries together. Retired targets
+  lose only exact repository-owned managed security rules;
+  preserve archived, foreign, and modified same-name rules. Re-read and validate
+  the exact rule payload after the repository metadata fence immediately before
+  deletion. Audit retained named security rules on non-target repositories as
+  drift even when disabled, modified or scoped to another ref. Keep repository
+  workflow overrides read-only and unable to approve PRs, with delta-aware writes.
+- Repository-scope `03 - Required CI` retirement requires reviewed exact prior
+  repository/ruleset IDs and contexts in `config/retired-required-ci.json`.
+  Delete only the unchanged Actions-bound template after fresh identity/archive
+  and payload checks. Preserve modified/foreign rules and missing-provenance
+  rules with actionable `SKIP`; retain records for idempotent reruns.
+
+- Before updating an existing security gate, re-read and revalidate its identity
+  and recognized payload, retaining concurrent modifications. Bind the final
+  metadata default branch to the branch used for pending-gate qualification
+  or existing effective-gate proof; changed branches must not activate a gate.
+  Pending existing-gate proof also requires unchanged enforcement and ref
+  applicability in the final rule read. Enforced intent retains recognized
+  restoration. Audit full legacy
+  protection on active default and declared maintenance branches; any presence
+  is drift under the canonical ruleset contract. Only verified unprotected
+  responses count as absent; unreadable evidence fails closed and audit never
+  removes protections. Compare the complete effective default and maintenance branch policy with
+  declared allowed rule types and parameters; undeclared integrity or restriction types are drift,
+  even when every desired rule is present. Only the exact repository-disabled REST response may
+  fall back to a fixed read-only GraphQL query with matching repository/branch
+  identity, active state and explicit null legacy-rule association. Missing or
+  conflicting evidence fails closed; preserve historical rules on other refs.

CONTRIBUTING.md

@@ -129,6 +129,68 @@ after apply and again before separately authorized exact branch deletion;
 never combine either operation with tag, release, asset, default-branch, or
 unrelated policy changes.
 
+Security merge controls use repository-level rules in both publisher scopes.
+Keep `config/security-merge-protection.json` aligned with `required_ci` and
+preserve ordinary aggregates. New dependency gates require the reviewed
+workflow on the default branch and a successful corresponding PR run; CodeQL
+gates require successful current-head analyses, including required languages.
+Record successful initial qualification in the policy PR and promote the gate's
+`activation` entry from `pending` to `enforced` through source review before its
+first live installation. Pending publication only probes readiness. Enforced
+intent survives missing rules and later producer failures, allowing restoration
+without fresh initial proof; it does not claim live installation success. Remove
+activation entries with retired targets, preserving exact owned-rule rollback.
+Re-read the exact security-rule payload after the repository metadata fence
+immediately before deletion, retaining concurrent modifications. Audit retained
+named security rules on non-target repositories as drift regardless of their
+enforcement or ref applicability.
+For an existing repository-owned `03 - Required CI` rule, also record exact repository
+and ruleset IDs and its prior contexts in `config/retired-required-ci.json`.
+Validate retained/modified/foreign rules and fresh identity checks; keep records
+for idempotent retirement. Missing provenance must retain the rule.
+Tests must cover missing/failed producers, unreadable evidence, archived targets, language unions, both scopes,
+and zero security mutations on a converged rerun. SHA enforcement must remain
+pending until an ordinary action-update canary proves successful PR-bound
+current-head CI without an allowlist edit and the persistent rollout source is
+promoted to `enforced` with that accepted PR. Later disabled enforcement is drift,
+not pending rollout; ordinary publication revalidates the recorded proof before
+restoring it. Test rule retirement, effective default-branch applicability, and
+repository workflow permission overrides. Action allowances use owner/action wildcards;
+full commit pins belong in workflows, not redundant version assertions.
+Canary legacy-check absence requires verified protection evidence; bare or
+ambiguous 404 responses fail closed. Publisher identity and absence decisions
+require a complete validated ruleset inventory across all pages, including
+retirement and ordinary repository/organization rules.
+
+Advanced CodeQL readiness must validate executable YAML wiring from classifier
+invocation and outputs through the dynamic analysis matrix, scoped generated
+configuration, official full-SHA CodeQL actions, and the unconditional aggregate.
+Require the live default branch's ordinary pull-request trigger without path
+filters, including opened, synchronize and reopened events. Use the existing
+validation dependency with duplicate-key rejection. Test
+comments-only markers, disconnected inputs, disabled or failure-suppressed steps,
+checkout revision drift, and ambiguous YAML; preserve full-SHA updates, formatting
+changes, additional partitions, and category renames. Classification path
+semantics remain in trusted producer helpers; do not add a central source-path or
+action-version catalog or claim resistance to malicious repository writers.
+
+Security gate updates must re-read and validate ownership and the recognized
+payload immediately before PUT, preserving concurrent modifications. Bind the
+final metadata default branch to the branch used for pending-gate qualification
+or existing effective-gate proof; a changed branch must not activate a gate.
+Pending existing-gate proof requires unchanged enforcement and ref applicability
+in the final rule read; enforced intent retains recognized restoration. Audit
+legacy protection on active default and maintenance branches as drift under the
+canonical ruleset contract; distinguish verified unprotected responses from
+unreadable evidence, and never remove protection during audit. Compare the
+complete effective default and maintenance branch policy with declared allowed
+rule types and parameters; additional
+undeclared integrity or restriction types are drift. The exact
+repository-disabled REST response may use the fixed read-only GraphQL fallback;
+require matching repository identity and branch, active state and an explicit
+null legacy-rule association. Errors and missing or conflicting fields fail
+closed; preserve unrelated historical rules.
+
 Crates.io publication contracts bind exact repository/workflow/environment and
 official auth-action identities with full immutable workflow SHA references;
 preserve the reviewed `rust-lang/crates-io-auth-action@*` allowance for normal