TLC: adopt organization protocol 4.5 (audit only)

[MichaelSaucier]

TLC 4.5 audit adoption

• repository id: 1196154071
• reviewed mode: governance_control
• workflow commit: d1545dd154728e22edb21396c52ce5282870ab2d
• activation commit binding: 0057171a729566fd5d42a8147e8258d0928eb593
• execution mode: audit
• authority granted: false

This draft installs exact organization protocol bytes but grants no ready, merge, settings, required contexts, enforcement, deployment, runtime, or protected-action authority. Exact-head IAR, independent CFAR, and Tier 3 Human Review remain required.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[MichaelSaucier]

Exact-head IAR — PASS

• Repository/PR: transpara-ai/agent#31
• Exact reviewed head: 6cdeb4e262c8ca48b384f78bb07e92d60a113d15
• Author family: Codex/OpenAI
• Result: pass; blockers: 0
• Structured artifact SHA-256: 32a05865766e02b9b0a4f4fca734c40f5f14851d04b5c210dc0d60095b15c9eb
• 106-head IAR index SHA-256: e55b17e951d20b8c1ccfca54c8aaf194ae1fd9e98a12345b05b51b6484eb8881

Batch validation retained distinct credit for this repository/head and verified all
106 live drafts against rollout receipt SHA-256
571c97f0b092050b637b52a76704ffc3cce54ef0d3da782b47fba1470570f166:
exact draft/head/base/assignment/audit boundaries; exact five-file surface; immutable
workflow/GCE/README blobs; repository-specific profile identity; and monotonic exact
CODEOWNERS merge all passed.

Findings carried for this exact head:

• IAR-ADOPTION-01 major accepted_pending: the bootstrap caller workflow cannot
  run from PR-head bytes before reaching the default branch.
• IAR-ADOPTION-02 major accepted_pending: runtime parent/GCE lifecycle
  re-resolution remains frozen rather than live.
• IAR-ADOPTION-03 minor accepted_pending: jsonschema is version-pinned but not
  hash-locked.
• IAR-ADOPTION-04 note rejected_with_evidence: conservative
  governance_control mode is the explicit MichaelSaucier decision and accepted
  fail-upward behavior.

These dispositions are non-blocking only for audit-only adoption while repository
settings/enforcement remain separately gated. IAR is author-family self-review and
does not satisfy independent CFAR or Tier 3 Human Review. No ready, merge, setting,
required context, enforcement, deploy, runtime, EventGraph, Hive, or protected action
is authorized by this evidence.

[MichaelSaucier]

Independent Cross-Family Adversarial Review (CFAR)

• Subject: transpara-ai/agent#31
• Exact reviewed head: 6cdeb4e262c8ca48b384f78bb07e92d60a113d15
• Review state: draft
• Author family: Codex/OpenAI
• Independent reviewer: Claude/Anthropic via claude-cli 2.1.220
• Result: PASS
• Blockers: 0
• Batch: TLC45-ADOPTION-106-CFAR-20260807
• Batch result SHA-256: aa639418acaf20e8d73cc71a4f6c4f72623d53c5e54a0086dfdc3f1710835921
• Exact reviewer result SHA-256: 34db0bab2b1f7aa4668d890eb80adf221052a40dbaca6fc0bb9a13c4b93bee38
• Exact prompt SHA-256: 1ce63cb050f7cc629484334c2ce7d7141481d556368d979f031f8ab17db01cf0

Finding dispositions

• SF-01 — note / accepted_fixed: Rollout path API surface is read-only observation plus additive Git object and draft-PR creation only: GET, then POST /git/blobs, /git/trees, /git/commits, /git/refs, /pulls with draft:true, /issues/{n}/assignees. No merge, ready-for-review, branch-protection, ruleset, required-status-context, settings, environment, deployment, runtime, EventGraph, Hive or protected-action API is reachable; no PATCH/PUT/DELETE exists in the path.
• SF-02 — note / accepted_fixed: A pull_request_target workflow introduced only on a PR head cannot execute on that same bootstrap PR: GitHub resolves pull_request_target definitions from the base ref and .github/workflows/tlc-4.5.yml is absent at base on all 106. These PRs therefore do not evaluate themselves, which is the safe bootstrap behaviour - untrusted head content cannot inject workflow code into the privileged context. Audit-merge effect: TLC evaluation begins only on PRs opened after the adoption commit lands on the default branch. Settings-Activation effect: the four operative contexts cannot exist before enforce mode is separately authorized, so required contexts must not be installed until an enforce-mode caller has produced live green results.
• SF-03 — note / accepted_fixed: Audit execution mode is structurally non-operative: the trusted runner rewrites the four context names to tlc-audit/* in audit mode and returns success unconditionally, so no audit adoption can manufacture a tlc/classification, tlc/design-credit, tlc/exact-head or tlc/authority success. No claimed four-context success exists anywhere today.
• SF-04 — major / accepted_pending: Runtime parent/GCE lifecycle is not live re-resolved. validate_activation trusts the activation artifact's frozen gce.lifecycle_state and gce.default_branch_reachable, and activation_evidence() emits lifecycle_evidence_authenticated:true unconditionally without contacting transpara-ai/docs. Live re-resolution exists only in the one-shot rollout preflight, not in the runtime control plane. GCE AC-03 requires lifecycle authentication against Docs default-branch truth and AC-08 requires that freshness at classification and at ready/merge, so GCE retirement or supersession would not be detected by enforce-time gates.
• SF-05 — major / accepted_pending: The jsonschema dependency closure is not hash-locked. The trusted action installs jsonschema==4.25.1 from live PyPI with --only-binary=:all: but without --require-hashes and without any pinned or hashed transitive closure (attrs, jsonschema-specifications, referencing, rpds-py, typing-extensions), and the vendored package declares only the open range jsonschema>=4.10,<5. Every enforce-mode run resolves an unhashed dependency graph at execution time inside the privileged pull_request_target context.
• SF-06 — minor / accepted_pending: 27 of the 106 exact heads carry a pre-existing non-TLC condition: 17 FAILURE and 10 PENDING rollups from repository and upstream-fork CI policies (ruff, build/test matrices, DCO, PR-title and PR-description validators, spell-check, gitleaks, dependency-review, first-time-author bots), plus 9 default branches whose pre-existing required contexts leave the PR BLOCKED. None is a tlc/* or tlc-audit/* context and none was introduced by the adoption diff (0 deletions, 5 governance paths only, actionlint green wherever it runs). These are inputs the Human must weigh per repository at Tier 3 merge time, not adoption-byte defects.
• SF-07 — note / accepted_fixed: CODEOWNERS change is strictly monotonic batch-wide. merge_codeowners only appends, and live results confirm it: total deletions across all 106 PRs is exactly 0, the effective candidate re-read at each recorded base is the first present of .github/CODEOWNERS, CODEOWNERS, docs/CODEOWNERS, and each head equals merge_codeowners(that exact base value) byte for byte.
• SF-08 — note / accepted_fixed: No unsafe adoption merge path is armed on any subject. Every PR is draft with a single commit whose only parent is the recorded base, no auto-merge request exists, no approval or review decision exists, and no PR has ever been readied, merged, rebased onto a new base, or force-pushed.
• SF-09 — note / accepted_fixed: Exact-head semantics: each conclusion binds only the exact live head and base named in its own row. For all 106 the live baseRefOid equals the recorded base_sha and the live headRefOid equals the recorded head_sha, and all 106 are MERGEABLE. If a base advances, a head changes, or a PR becomes conflicted, that row is void: exact-head credit does not transfer to a new head or merge result, CODEOWNERS monotonicity must be re-derived against the new base bytes, and a fresh exact-head IAR, independent CFAR and Tier 3 Human Review are required at the new exact head before any merge consideration.
• SF-10 — note / accepted_fixed: Central parent, GCE, package, install, provenance, workflow and activation identities are all live-reachable on their default branches and reproduce their required digests exactly.
• SF-11 — note / accepted_fixed: Receipt and live organization sets are exactly equal and the archived repository was never written.

Boundary

This exact-head CFAR does not replace Tier 3 Human Review. It does not authorize ready, merge, repository settings, required contexts, branch protection, rulesets, enforce mode, repository enforcement, deployment, runtime, EventGraph, Hive, or any protected action. Any head/base advance or conflict voids this row's gate credit and requires fresh exact-head review.