fix(secrets): centralize governed name audit

[Lutar, Stephen P. (stephenlutar2-hash)]

Satisfies

Satisfies: C-158.

Measured root cause

The former szl-doctrine secret-health lane depended on a long-lived SECRET_HEALTH_TOKEN PAT that expired. qillqaq's installation has not yet been approved for repository and organization Secrets: read, while the governed SZL_GITHUB_TOKEN fallback is intentionally available in this organization control-plane repository.

Permanent replacement

• centralize the organization-wide audit in .github;
• version the exact repository/name policy;
• request only metadata plus repository and organization secret-name read from qillqaq;
• use the existing governed organization token read-only until the App permission upgrade is approved;
• distinguish PRESENT, MISSING, and UNAVAILABLE without conflating authorization failure with a missing secret;
• persist only repository/name states and a machine-identity source label;
• prohibit secret values, token values, token metadata, prefixes, lengths, hashes, or expiration data from the receipt;
• add network-free adversarial tests and a 90-day immutable Actions receipt.

Exact verification

Head 942c4318c8717bb44708dd6eab9fae1030746811 passed Governed Secret Health, CI, Tests, CodeQL, Trivy, Gitleaks, DCO, pinning, doctrine, FORGE-9 staging, bootstrap invariants, and all eight FORGE-9 gates.

The immutable receipt reports:

• authentication source: governed-fallback;
• required names present: 4;
• missing: 0;
• unavailable: 0;
• secret values requested or recorded: false;
• token values or metadata recorded: false.

Labels

Labels: PROVED no-value audit and fail-closed state contract; MEASURED all four current required names present through the governed control-plane identity; NOT CLAIMED credential validity from name presence.

Rollback

Rollback: revert through a protected pull request. Do not restore the expired PAT lane; any replacement must remain short-lived App-first or use an explicitly governed machine identity.

Risk class

Risk: C — organization-wide read-only secret-name health control and machine-identity migration.

Solo-Operator-Authorization: confirmed

Queue reevaluation

The protected native enqueue controller merged at 5aa61bb92ba4a1cd1b59c09c4f82b902d1bf7917. Re-evaluate this unchanged, already-attested exact head through the merge queue; no direct merge or bypass is authorized.

Signed-off-by: Stephen Lutar stephenlutar2@gmail.com

[qillqaq-attestor]

ATTESTED. All Section 18 gates green. Merge BAP sha256: dc459560a99e6953c426bbd0797da1db6d47a4852fcf35b2dc0ea113faa5acd4

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[qillqaq-attestor]

ATTESTED. All Section 18 gates green. Merge BAP sha256: ee3cdd02ace2674bb4ed5a0288385d2dfa460230d25e7302ec482b745980852f

[Lutar, Stephen P. (stephenlutar2-hash)]

Superseded by clean signed replacement #349. Bounded run 30255431491 copied all four permanent files byte-for-byte into one GitHub-verified signed commit (3e36676ef820c1f6fb9837ec5d00725305ce4abb) on current protected main. The unsigned predecessor remains preserved; no force push or history rewrite was used.