fix(secrets): centralize governed name audit

[Lutar, Stephen P. (stephenlutar2-hash)]

Rollback: Revert through a protected pull request. Do not restore the expired PAT lane.
Labels: PROVED signed no-value audit contract; MEASURED all four required names present through governed machine identity; NOT CLAIMED credential validity from name presence.

Satisfies

Satisfies: C-158.

Measured root cause

The former szl-doctrine secret-health lane depended on an expired long-lived SECRET_HEALTH_TOKEN PAT. qillqaq has not yet been approved for repository and organization Secrets: read, while the explicitly governed organization token remains available read-only in the control-plane repository.

Permanent replacement

• centralize the organization-wide audit in .github;
• version the exact repository/name policy;
• request only metadata plus repository and organization secret-name read from qillqaq;
• use the existing governed organization token read-only until the App permission upgrade is approved;
• distinguish PRESENT, MISSING, and UNAVAILABLE without conflating authorization failure with a missing secret;
• persist only repository/name states and a machine-identity source label;
• prohibit secret values, token values, token metadata, prefixes, lengths, hashes, or expiration data from the receipt;
• add network-free adversarial tests and a 90-day immutable Actions receipt.

Clean signed lineage

This is the exact-tree signed replacement for #342. Bounded materializer run 30255431491 copied all four permanent files byte-for-byte from head 942c4318c8717bb44708dd6eab9fae1030746811 and created one GitHub-verified signed commit on current protected main:

3e36676ef820c1f6fb9837ec5d00725305ce4abb

The four-commit unsigned predecessor remains preserved; no force push or history rewrite was used.

Exact verification

The predecessor tree passed Governed Secret Health, CI, Tests, CodeQL, Trivy, Gitleaks, DCO, pinning, doctrine, staging, bootstrap invariants, all eight FORGE-9 gates, and qillqaq attestation. Its immutable receipt reported:

• authentication source: governed-fallback;
• required names present: 4;
• missing: 0;
• unavailable: 0;
• secret values requested or recorded: false;
• token values or metadata recorded: false.

Protected checks on this signed one-commit replacement are authoritative for merge.

Labels

Labels: PROVED signed no-value audit contract; MEASURED all four required names present through governed machine identity; NOT CLAIMED credential validity from name presence.

Rollback

Revert through a protected pull request. Do not restore the expired PAT lane.

Risk class

Risk: C — organization-wide read-only secret-name health control and machine-identity migration.

Solo-Operator-Authorization: confirmed

Signed-off-by: Stephen Lutar stephenlutar2@gmail.com

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[qillqaq-attestor]

ATTESTED. All Section 18 gates green. Merge BAP sha256: d34b64e1e47a8a6222e9426eabfcc84afb4246edc88777eb3a304f9cd7262926