PRVSR Phase 1: repair Release Trust credential split (#471)

[fyremael]

Refs #471, #462, #459.

Trigger

Manual Advisory PR visual status dispatch failed in run 31599387292, job 94122702489, before collection at Mint bounded PRVSR publisher token with GitHub 422 The permissions requested are not granted to this installation.

The failed workflow requested one Release Trust installation token containing source-read, live-ruleset, and publisher permissions, including actions: read and checks: read.

Repair

This candidate preserves the established Release Trust credential separation while narrowing ordinary source-read authority:

• GitHub Actions GITHUB_TOKEN is job-scoped with only contents: read; ordinary governed reads use it when authorized and otherwise may fall back only to unauthenticated public GETs against this public repository;
• a distinct Release Trust token requests only administration: read for live rulesets;
• a distinct Release Trust publisher token requests only contents: write and issues: write for durable archive and advisory comment publication;
• ci/pr_visual_status_operational_split.py routes ruleset GETs only to the administration token, ordinary source reads first to GITHUB_TOKEN and then, only on source 403/404, to a zero-credential public-read client, and all mutations to the publisher token;
• publisher comments are updated only when both the governed PRVSR marker and the expected Release Trust bot login match;
• regression tests reject credential collapse and the failed combined App permission request.

The public-read fallback carries no mutation authority and does not widen GitHub App or installation permissions.

Authority boundary

No GitHub App permission expansion is requested. No target PR code is executed. PRVSR remains derived/advisory, MATH-PROGRAMME-only, non-authoritative, and non-blocking. No required check, merge gate, cross-repository propagation, or human-performance claim is created.

Admission

This PR is review-ready. Fresh exact-head validation and independent exact-head review are required before any Human Steward merge disposition.

The failed run 31599387292 remains retained evidence and is not rewritten as successful.

[fyremael]

Exact-head independent review packet — PRVSR credential repair

Review target is frozen at exact head:

6269d20b01eb964549f72046068ea264137bc755

tree:

1345700c4aaea947ddebe9d70c6a52dddae7cf6a

base recorded by PR:

1aa19271245d979d026785973137a531cf5975e0

The PR is review-ready and mergeable. The active Programme profile - main ruleset requires six status contexts: validate-json, Replay LOG-GCD-001 in Lean, Replay PC-WP04 bounded certificate, Replay pinned Union-Closed MATHCERT evidence, policy / policy, and security / action-policy. All are successful at this exact head. The exact-head check corpus contains no failure, queued, or in-progress check. A superseded/cancelled advisory-report is retained but is not a required merge context.

Independent technical review of the three-file patch finds no blocking code or authority defect:

• workflow authority is split: job token is limited to contents: read; live rulesets use a distinct administration: read token; publication uses a distinct contents: write + issues: write token;
• ordinary reads attempt the job token and may fall back only on source 403/404 to an unauthenticated GET-only public-read client;
• ruleset reads cannot route through source/public-read credentials, and mutations cannot route through source/admin credentials;
• credential collapse is rejected;
• publisher-comment replacement requires both the governed PRVSR marker and the expected Release Trust bot login;
• publication performs exact-head checks around archive publication and invalidates the receipt if the PR head moves;
• the governed collector remains MATH-PROGRAMME-only and target-PR code execution remains excluded;
• the PR and issue documentary boundary has been corrected, without head movement, to describe the actual zero-credential public-read fallback.

No unresolved review threads are present.

Operational limitation is explicit rather than waived: because the trusted pull_request_target workflow executes from protected main, the repaired Release Trust token mint and bounded PRVSR runtime cannot be proven by this candidate before merge. Protected-main readback and a successful post-merge bounded PRVSR replay therefore remain mandatory before issue #471 can close.

Review recommendation: ADMIT exact head 6269d20b01eb964549f72046068ea264137bc755 for Human Steward consideration, subject to a distinct non-author exact-head review and the required Human Steward exact-head disposition.

Any head movement invalidates this packet and requires fresh exact-head CI and review.

[fyremael]

HUMAN_STEWARD_DISPOSITION — PRVSR-PHASE1-CREDENTIAL-REPAIR-001

I, Human Steward, approve protected admission and merge of PR #473 at exact head:

6269d20

tree:

1345700c4aaea947ddebe9d70c6a52dddae7cf6a

against protected base:

1aa1927

I find the exact-head validation complete and the independent exact-head review approved.

This disposition admits only the bounded PRVSR Phase 1 credential repair represented by this exact head: separation of ordinary source reads, live-ruleset administration authority, and publication authority; the zero-credential public-read fallback; and the accompanying regression protections.

No GitHub App permission expansion, new required check, new merge gate, cross-repository propagation, target-PR code execution, authoritative visual status, or human-performance claim is authorized.

The failed pre-repair run 31599387292 remains retained historical evidence and is not reclassified as successful.

This disposition authorizes an expected-head protected merge of PR #473 only.

Protected-main readback, terminal post-merge census, and a successful repaired bounded PRVSR replay on PR #465 remain mandatory before issue #471 may be closed.

Any movement from exact head 6269d20 voids this disposition and requires fresh exact-head validation and review.

PRVSR_PHASE1_CREDENTIAL_REPAIR_ADMITTED__POST_MERGE_REPLAY_REQUIRED