Add TLC 4.6 public audit telemetry control plane

[MichaelSaucier]

Purpose

Prepare the public-visibility-safe TLC 4.6 audit evaluator and reusable workflow authorized by GCE-TLC46-EVIDENCE-TELEMETRY-001@0.3.0, exact blob 8bb8b611a57517866e499969dee3490becac8e49.

This is the public control-plane implementation subject for FO-R4 and FO-R5. It remains an unpublished candidate draft.

What changed

• Added a minimal public composite action that resolves exact public repository and pull-request metadata through https://api.github.com only.
• Added a public reusable workflow pinned to immutable action commit bce8f2a6a14c6faa8a4a01279c092b5b892e4bdc.
• Bound the projection to canonical, installed, non-enforcing package 0.19.0 and its exact external lifecycle receipt digests.
• Removed private .github dependencies, caller checkout, status writes, secrets, OIDC, attestations, and runtime/deployment permissions.
• Bound repository name and immutable repository id directly from the reusable-workflow caller context.
• Added an exact disclosure manifest, source/package/policy identity record, CODEOWNERS, documentation, offline verifier, and public/fork/negative tests.
• Added denial logic for private targets, mutable refs, missing commits, zero-job observations, incomplete file enumeration, identity drift, path escape, extra disclosure files/endpoints, and secrets in both the final tree and branch history.

Exact candidate identity

• Exact head: 8cae071bed7c6ad204fe94ea1a9ecd6283e27844
• Base: 4b5be2389ad79380fc158698c7d97b1ec859d328
• Public action commit: bce8f2a6a14c6faa8a4a01279c092b5b892e4bdc
• Reusable workflow blob: c923c1b1eee90f8c474f198177904536f035423b
• Reusable workflow SHA-256: 446c76a959d741225444b231de84f2365b498061f687fcea001a009d52210c01
• Release manifest blob: c2c3f7d0574212c5ed603997a1b83c2940ad78ea
• Release manifest SHA-256: c7dfdfe0d25af2aef10846f66c054777a120b464193d39d972d1cf740de1df22
• Source identity blob: 87acd945fb0aba740ceb905d3c6a82042f722f0d
• Source identity SHA-256: 1cbf8a773b1c2b3a3218a4692e90febd828927facf1a602c6318dbbb6b950b1b
• Package reviewed head: 907b1377c2ddf93053d896c99d7899d864f365c2
• Package source commit: 5722077d2653d2f439602ec8a8cb7ac2458fb32f
• Package manifest blob: 50ee9f1c776c8b23dfac88b9239f4e12337e3bf3
• Package provenance SHA-256: c91e3a68efd2a62f1029a7aebd868f9554512d12660fdbc4e3acf3e0ca5986d9
• Complete binary patch SHA-256: e7e469df7effb689554836578392926241017aa0c5e9508b0d23bc81df790821

Validation

• make verify: pass.
• Seven public-control-plane tests: pass.
• Exact changed-path allowlist equals the disclosure manifest; every non-self file digest passes.
• Immutable action/source bytes after the action pin: pass.
• Secret/private-evidence/inventory scan of the final files and branch patch history: pass.
• Runtime endpoint set equals only https://api.github.com.
• Public/fork fixture: pass without caller checkout or execution.
• Private target, mutable ref, missing commit, live identity drift, incomplete enumeration, path escape, extra disclosure file/endpoint, and zero-job observations: fail closed.
• Exact-head live read-only API probe against this PR: pass; telemetry SHA-256 4aefb5b16bb69fb9a08b6f9724fbe9acb1f15dbf9f64ce14c21ab35182d78194.
• git diff --check origin/main...HEAD: pass.

Boundary and gate state

The output is explicitly non-credit telemetry: authority_granted=false, lifecycle_credit=false, and signed_receipt=false. It does not implement or claim the trusted signed publisher, ledger activation, attestation, central activation, repository enforcement, or wiki proof.

Independent CFAR is not satisfied, and the current single-family outage waiver does not name transpara-ai/workflows#3. No substitute-review credit is claimed. Fresh exact-head IAR is being recorded; a separate exact-subject reviewer decision, Tier 3 Human Review, and a distinct public publication approval remain required.

No ready/merge/public publication, organization permission, OIDC/attestation permission, secret, status/comment/issue/settings mutation, central activation, canary or broader enforcement, runtime/deployment, EventGraph/Hive write, protected action, or TLC 4.7 work is authorized.

[MichaelSaucier]

Fresh exact-head IAR — public TLC 4.6 control plane

• Exact reviewed head: 8cae071bed7c6ad204fe94ea1a9ecd6283e27844
• Base: 4b5be2389ad79380fc158698c7d97b1ec859d328
• Immutable public action commit: bce8f2a6a14c6faa8a4a01279c092b5b892e4bdc
• Reusable workflow blob: c923c1b1eee90f8c474f198177904536f035423b
• Release-manifest SHA-256: c7dfdfe0d25af2aef10846f66c054777a120b464193d39d972d1cf740de1df22
• Source-record SHA-256: 1cbf8a773b1c2b3a3218a4692e90febd828927facf1a602c6318dbbb6b950b1b
• Complete binary patch SHA-256: e7e469df7effb689554836578392926241017aa0c5e9508b0d23bc81df790821
• IAR artifact SHA-256: 02a53cdae9a7d9b0a7c8f69ecf3ab3c0087e97a73a4a5693174886854d875566
• Result: pass, zero implementation blockers

Validation passes: exact disclosure allowlist/digest set; final-tree and branch-history secret scan; immutable action/source pin; only https://api.github.com; no caller checkout or execution; read-only public/fork permissions; private/mutable/missing/zero-job/path/identity/extra-file/extra-endpoint negatives; seven tests; and git diff --check. A live read-only probe against this exact PR emitted non-credit telemetry SHA-256 4aefb5b16bb69fb9a08b6f9724fbe9acb1f15dbf9f64ce14c21ab35182d78194.

Findings:

• IAR-W3-R2-01 — accepted-fixed: rebound from pre-repair bytes to canonical installed non-enforcing package 0.19.0 and exact external lifecycle digests.
• IAR-W3-R2-02 — accepted-fixed: manifest file-set equality, source identity equality, exact runtime endpoint set, and branch-history secret scanning now fail closed with direct negatives.
• IAR-W3-R2-03 — accepted-fixed: only the public repository and immutable 40-hex action commit are accepted; private/mutable/zero-job paths fail.
• IAR-W3-R2-04 — accepted-fixed: public/fork telemetry never checks out or executes caller bytes and has no write/OIDC/attestation/secret permission.
• IAR-W3-R2-05 — accepted-pending: TC-PUB-01 needs a separately approved post-publication wiki run with at least one started job.
• IAR-W3-R2-06 — accepted-pending and gate-blocking: independent CFAR is not satisfied and the current outage waiver does not name workflows PR 3. No substitute credit is claimed.
• IAR-W3-R2-07 — accepted-pending: trusted signed publication remains the separate PR 19 subject; this output is intentionally non-credit.
• IAR-W3-R2-08 — rejected-with-evidence: visibility-safe duplication is not a second authority; policy/package identities are identical and authority remains false.
• IAR-W3-R2-09 — rejected-with-evidence: external canonical disposition is bound without mutating immutable package provenance.

No ready/merge/public publication, wiki consumer/run, secret/OIDC/attestation permission, status/comment/issue/settings mutation, activation, canary/broader enforcement, runtime/deployment, EventGraph/Hive write, protected action, or TLC 4.7 program is authorized.

[MichaelSaucier]

Fresh exact-head same-family outage substitute — pass

• Exact head: 8cae071bed7c6ad204fe94ea1a9ecd6283e27844
• Exact base: 4b5be2389ad79380fc158698c7d97b1ec859d328
• Binary patch SHA-256: e7e469df7effb689554836578392926241017aa0c5e9508b0d23bc81df790821
• Human waiver extension: docs issue 291 comment 5332802453, body SHA-256 df5a5c5c54417cc0601b367f470a586b415c2a0d500cfeb03519a374d70b0de2
• Reviewer family: Codex/OpenAI, same as author family
• Result: pass, BLOCKER_COUNT: 0
• Independent CFAR: waived, not satisfied
• Structured artifact SHA-256: ad338d1c0004f755901cf5391eedd9583345b21897bc3eb3a5699da6c24c6110

Fresh public-control-plane verification and all 7 public/fork/fail-closed tests pass. Review covers the immutable public action pin, public accessibility, exact disclosure allowlist, final-tree/history secret checks, https://api.github.com-only network boundary, caller-code isolation, and fail-closed private, mutable, incomplete, drifted, path-escape, extra-file/endpoint, and zero-job cases.

Findings:

• SFOS-W3-EXT-01 — accepted-fixed: the public subject removes the inaccessible private .github dependency and tests the zero-job failure.
• SFOS-W3-EXT-02 — accepted-pending: public default-branch publication and a wiki caller/proof remain separate.
• SFOS-W3-EXT-03 — accepted-pending: bounded public repository/workflow metadata disclosure remains.
• SFOS-W3-EXT-04 — accepted-pending: same-family blind-spot risk remains.
• SFOS-W3-EXT-05 — rejected-with-evidence: telemetry explicitly grants no credit, signature, or authority.

No ready/merge/public publication, wiki consumer/run, signing/OIDC/Rekor, settings, activation, enforcement, runtime, deployment, protected action, or TLC 4.7 work is authorized by this review.