fix(ci): require Codex credential before investigator activation

[Copilot]

Purpose

Require the dedicated CODEX_API_KEY before the EventRelay CI Investigator reaches gh-aw activation or agent startup.

Closes #949
Progresses #898

Corrected implementation

• Moves the dedicated-credential guard from pre-agent-steps into on.steps, which gh-aw compiles into the pre_activation job.
• Retains gh-aw's normal activation credential validation after the pre-activation gate.
• Regenerates the lock file with repository-pinned gh-aw v0.82.14.
• Tests both the source declaration and compiled job ordering, preventing a source-only test from masking a nonfunctional lock file.

Exact-head verification

Exact head: 5ab39e2e9d8567233bac388964080dff50edb300

• Pinned compile: 1 workflow, 0 errors, 0 warnings.
• Focused governance suite: 9 passed.
• CI, Coverage, gh-aw Validation, CodeQL, Security Scan, Secret Scan, and Dependency Review: passed.
• Review findings: 2 proven fixed and resolved; 0 unresolved threads.
• Current-head independent review: pending.
• E2E: skipped; no deployment-path proof claimed.

Protected boundary

The repository secret itself is not added, displayed, or mutated by this PR. A repository owner must configure/authorize CODEX_API_KEY before the workflow can execute successfully.

Execution disposition

This was a direct controller repair on the existing canonical branch after the original pre-agent implementation was proven too late. No delegated agent execution is claimed, so no agent run receipt is fabricated.

No artifact_ready event is asserted without a provider run ID.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled		Jul 22, 2026 7:16pm

[github-actions]

🔍 PR Validation

✅ Current validation passed.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 5ab39e2.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "invalid_fields": [
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[groupthinking]

@claude Can you find out why these are falling

[Copilot]

Pull request overview

Adds a dedicated Codex credential guard for the CI investigator workflow.

Changes:

• Adds a CODEX_API_KEY pre-agent guard.
• Adds governance assertions and regenerates the lock workflow.
• Records the change in the workflow audit.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/eventrelay-ci-investigator.md	Defines the credential guard.
.github/workflows/eventrelay-ci-investigator.lock.yml	Regenerates the compiled workflow.
tests/unit/test_gh_aw_workflow_governance.py	Tests credential-gate configuration.
.github/workflows/AUDIT.md	Documents the workflow fix.

[groupthinking]

@groupthinking Here's why the checks are red on this PR — two distinct gates, both by design, plus one cosmetic warning:

1. agent-completion/truth-gate/pr-948 → invalid_payload (fields issue.number, policy.agent_login, policy.run_id)

The truth gate reads agent provenance from a linked agent-task issue, not from the PR. This PR has:

• No linked issue — "Linked issue" says Managed by automation, with no Fixes #NNN, so issue.number is null → incomplete_linked_issue_contract.
• The unfilled placeholder in the Agent-provenance section (agent-lock-example, agent_login: "agent-name", issue_number: 0) instead of a real agent-lock-manifest, so agent_login/run_id resolve to null.

Legitimate fix (human-initiated by design): open an [Agent] task issue (.github/ISSUE_TEMPLATE/agent-task.yml) filling Agent login + Agent run ID, then on this PR set Fixes #<that-issue> and replace agent-lock-example with a filled agent-lock-manifest whose issue_number/agent_login/run_id match. I have not done this myself: fabricating the intent issue after the fact to force the gate green is exactly the provenance-bypass this gate exists to prevent (cf. the flagged #934/#938 evidence PRs), so it needs your sign-off.

2. Agent completion enforcement check → failing (missing_trusted_publication / trust_policy_unprovisioned)

.github/agent-lock/trusted-publishers.json has all three allowlists empty (trusted_check_app_slugs, trusted_label_actors, trusted_human_exemption_actors), with custom_role_policy: fail_closed. Per its own notes this intentionally blocks rather than downgrading to not_applicable. No agent action can satisfy it — it requires a protected default-branch change to provision the trusted GitHub App and its verified identity. Human/infra action only.

3. PR-validation warning: the title Require dedicated CODEX_API_KEY… isn't conventional-commits format (e.g. ci: require dedicated CODEX_API_KEY for CI investigator). This is a warning, not the blocker.

Bottom line: Vercel + dependency-review are green; the two red gates are governance controls working as designed and both terminate at a human action (create/link the agent-task issue; provision the trusted publisher). The code change itself (the CODEX_API_KEY guard) is sound. I'm holding at the publish gate — not merging to main and not bypassing the provenance controls.

---

Generated by Claude Code