security: address /8eyes audit findings

- Fix #1 (HIGH): Checkout base branch SHA, not PR branch, preventing
  self-modification of phase-config.yml or workflow files
- Fix #2 (MEDIUM): Add actor allowlist to bypass — only configured
  users can invoke emergency:bypass
- Fix #3 (LOW): Strip HTML comments before matching bypass reason
  pattern, preventing template placeholder from satisfying check
- Bump min bypass reason length from 10 to 30 chars
- Add CODEOWNERS requiring admin review for .github/** changes
- Update bypass heading to use ⚠️ emoji prefix

/8eyes verdicts: Security 0.92, Skeptic 0.90, Verifier 0.85

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Brian Krafft

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Phase Gate Enforcement — Protected Files
+# ==========================================
+# Changes to enforcement infrastructure require admin review.
+# This mitigates the PR-self-modification attack vector where
+# a PR modifies phase-config.yml or workflow files to weaken gates.
+
+# All GitHub configuration (workflows, config, templates)
+.github/** @Deepfreezechill
+
+# Enforcement documentation
+docs/enforcement/** @Deepfreezechill

.github/phase-config.yml

@@ -74,5 +74,8 @@ phases:
 escape_hatch:
   label: "emergency:bypass"
   require_reason: true
-  reason_pattern: "## Bypass Reason"
-  min_reason_length: 10
+  reason_pattern: "## ⚠️ Bypass Reason"
+  min_reason_length: 30
+  # Only these GitHub usernames can invoke emergency bypass
+  allowed_actors:
+    - "Deepfreezechill"

.github/pull_request_template.md

@@ -24,7 +24,9 @@ Closes #<!-- issue number -->
 - [ ] ADR written: `docs/adr/ADR-XXX.md`
 
 <!--
-## Bypass Reason
-(Delete this section unless using emergency:bypass label)
-(Explain why this PR must skip phase gate enforcement)
+To use emergency bypass: uncomment the section below, fill in the reason,
+and add the `emergency:bypass` label. Reason must be 30+ characters.
+
+## ⚠️ Bypass Reason
+(Explain why this PR must skip phase gate enforcement — minimum 30 characters)
 -->

.github/workflows/bypass-audit.yml

@@ -35,10 +35,10 @@ jobs:
 
             // Extract bypass reason from PR body
             const body = pr.body || '';
-            const reasonIdx = body.indexOf('## Bypass Reason');
+            const reasonIdx = body.indexOf('## ⚠️ Bypass Reason');
             let reason = '(No reason provided)';
             if (reasonIdx !== -1) {
-              reason = body.slice(reasonIdx + '## Bypass Reason'.length).trim().split('\n')[0];
+              reason = body.slice(reasonIdx + '## ⚠️ Bypass Reason'.length).trim().split('\n')[0];
             }
 
             // Create audit issue

.github/workflows/phase-enforce.yml

@@ -36,8 +36,10 @@ jobs:
     name: "Phase Gate Enforcement"
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout (for phase-config.yml)
+      - name: Checkout BASE branch (not PR — prevents self-modification attack)
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Install js-yaml
         run: npm install js-yaml@4 --no-save --silent 2>/dev/null
@@ -165,26 +167,39 @@ jobs:
             const hasBypassLabel = prLabels.includes(bypassLabel);
 
             if (hasBypassLabel) {
-              const reasonPattern = escapeHatch.reason_pattern || '## Bypass Reason';
-              const reasonIdx = (pr.body || '').indexOf(reasonPattern);
-              if (reasonIdx === -1) {
-                addCheck('Emergency bypass', false, `Label \`${bypassLabel}\` present but no "${reasonPattern}" section in PR body. Both keys required.`);
-                // Don't short-circuit — fall through to fail
+              // KEY 1: Actor must be in allowlist
+              const allowedActors = escapeHatch.allowed_actors || [];
+              const actor = context.actor;
+              if (allowedActors.length > 0 && !allowedActors.includes(actor)) {
+                addCheck('Emergency bypass', false, `Actor @${actor} is not authorized to invoke bypass. Allowed: ${allowedActors.join(', ')}`);
+                // Fall through to normal enforcement (deny)
               } else {
-                const reasonText = (pr.body || '').slice(reasonIdx + reasonPattern.length).trim().split('\n')[0];
-                if (!reasonText || reasonText.length < 10) {
-                  addCheck('Emergency bypass', false, 'Bypass reason too short (min 10 chars). Explain WHY this bypass is necessary.');
+                // KEY 2: Reason pattern must be present (not inside HTML comments)
+                const reasonPattern = escapeHatch.reason_pattern || '## ⚠️ Bypass Reason';
+                const minLength = escapeHatch.min_reason_length || 30;
+                // Strip HTML comments before searching to prevent template placeholder match
+                const bodyNoComments = (pr.body || '').replace(/<!--[\s\S]*?-->/g, '');
+                const reasonIdx = bodyNoComments.indexOf(reasonPattern);
+                if (reasonIdx === -1) {
+                  addCheck('Emergency bypass', false, `Label \`${bypassLabel}\` present but no "${reasonPattern}" section in PR body (outside HTML comments). Both keys required.`);
+                  // Don't short-circuit — fall through to fail
                 } else {
-                  addCheck('Emergency bypass', true, `OVERRIDE ACTIVE: "${reasonText.slice(0, 100)}"`);
-
-                  // Short-circuit: bypass granted
-                  audit.verdict = 'BYPASS';
-                  audit.bypass_reason = reasonText;
-
-                  const auditComment = formatAuditComment(audit);
-                  await postAuditComment(auditComment);
-                  core.warning(`⚠️ EMERGENCY BYPASS: ${reasonText.slice(0, 100)}`);
-                  return; // Exit with success
+                  const reasonText = bodyNoComments.slice(reasonIdx + reasonPattern.length).trim().split('\n')[0];
+                  if (!reasonText || reasonText.length < minLength) {
+                    addCheck('Emergency bypass', false, `Bypass reason too short (${(reasonText || '').length}/${minLength} chars). Explain WHY this bypass is necessary.`);
+                  } else {
+                    addCheck('Emergency bypass', true, `OVERRIDE by @${actor}: "${reasonText.slice(0, 100)}"`);
+
+                    // Short-circuit: bypass granted
+                    audit.verdict = 'BYPASS';
+                    audit.bypass_reason = reasonText;
+                    audit.bypass_actor = actor;
+
+                    const auditComment = formatAuditComment(audit);
+                    await postAuditComment(auditComment);
+                    core.warning(`⚠️ EMERGENCY BYPASS by @${actor}: ${reasonText.slice(0, 100)}`);
+                    return; // Exit with success
+                  }
                 }
               }
             }