Fix protected lifecycle PR-target provenance

[Niko4417]

Scope

• Accepted issue: Defect: protected lifecycle rejects PR-target records and ineligible evidence wakes #160
• Accepted planning-contract version: v1
• Automated readiness record: Defect: protected lifecycle rejects PR-target records and ineligible evidence wakes #160 (comment)
• Actual source branch: codex/160-protected-provenance
• Accepted target branch: dev
• Parent epic and Quality Envelope rows: None — standalone defect discovered while requalifying Exact migration inventory, one-time reconciliation, and activation orchestration #52/PR Governance: add exact migration inventory and dry-run orchestration #156.
• Change classification: defect
• Product decision, finding, or incident: protected lifecycle runs 30740121335, 30740137162, and 30740176636 after the human merge of PR Fix active lifecycle generation supersession after fact drift #159.
• In scope: event-aware protected-run provenance for PR-target writer, replay, and orphan recovery; PR-only evidence-wake eligibility; stable source run/attempt/PR association; hostile and mismatch regression coverage.
• Out of scope: activation or lifecycle effects, schemas/ADRs, migration behavior, merge automation, branch protection, and native/product behavior.
• Native targets, contracts, or trust boundaries affected: GitHub Actions lifecycle ingress and the ADR-0011/ADR-0012 protected workflow/run/job/attestation boundary; no native target changed.

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no
  semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality
  Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records
  why Existing Keiko evidence is not applicable.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing
  Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native
  layer.
• Any durable architecture change is recorded in an ADR.

Existing Keiko evidence is not applicable: this restores an existing repository-owned Native
governance protocol accepted by ADR-0011 and ADR-0012. No durable architecture or schema change was
made.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1	PR-target REST fixtures prove the source head_branch is never authority while the exact protected graph, run/job, SHA, reachability, and attestation evidence authenticate writer and replay	cc865cfb8f9fc42671d00a9b51f9915e4b90deed	Passed
AC2	The shared event-aware rule covers writer, historical authentication, and orphan recovery; wrong ID/event/ref/SHA/graph/attempt/job and unstable reads fail closed	cc865cfb8f9fc42671d00a9b51f9915e4b90deed	60/60 focused tests passed
AC3	Ineligible push evidence stops with zero reads/locators; eligible PR evidence binds the stable provider run ID, attempt, and single PR association within four reads	cc865cfb8f9fc42671d00a9b51f9915e4b90deed	Router 13/13 passed
AC4	Full local quality, canonical verify receipt, independent audit, and zero-vulnerability audit are green with activation disabled	cc865cfb8f9fc42671d00a9b51f9915e4b90deed	Passed; protected post-merge replay remains pending

Acceptance journey evidence

• Applicability: Not applicable — accepted Issue #160 is a non-user-facing governance control-plane correction with no product UI or native runtime change.

• Automated checks exercise user-visible outcomes rather than incidental implementation
  details.

• Required failure, recovery, accessibility, visual, and platform observations are settled.

No user-visible journey applies. Failure, recovery, malformed, provenance, duplicate, and inert
outcomes are exercised at the owning control-plane boundary; accessibility and visual evidence are
excluded by the accepted Quality Plan.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is
  covered.
• The actually wired production composition was tested where this change crosses layers.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is
  attached or linked.
• Excluded quality areas retain the rationale accepted in the issue.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source,
  tests, logs, evidence, artifacts, issues, and this pull request.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high
• Every declared native target-specific gate passed on its authoritative platform.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure
  modes.

Additional affected checks and concise results:

Failure-first on exact dev:
  FAIL — writer, provider normalization, replay, orphan recovery, and push evidence routing (0/5)
  FAIL — ordinary-event protected SHA mismatch (0/3)
  FAIL — stable evidence run ID/attempt/PR association mismatch (7 pass / 6 fail)
  FAIL — direct writer returned-run identity mismatch
node --test quality/lifecycle-record-writer.test.mjs quality/lifecycle-github-provider.test.mjs quality/lifecycle-record-auth.test.mjs quality/lifecycle-record-recovery.test.mjs quality/lifecycle-wake.test.mjs quality/lifecycle-wakeup-router.test.mjs quality/workflow-structure.test.mjs
  PASS — 60/60
node --test quality/contract.test.mjs
  PASS
npm run quality
  PASS — exact signed head and canonical SHA-bound verify receipt
  control-plane coverage: 94.75% lines / 87.98% branches / 94.80% functions
  frontend coverage: 95.92% lines / 94.26% branches / 90.24% functions
npm audit --audit-level=high
  PASS — 0 vulnerabilities
git verify-commit cc865cfb8f9fc42671d00a9b51f9915e4b90deed
  PASS — verified ED25519 signature for niko.vasilopoulos96@gmail.com

Independent audit and findings

• Audit scope and dimensions: protected-ref/source-event authentication; writer/replay/recovery
  consistency; hostile metadata; stable run/attempt/PR association; OIDC/static graph preservation;
  zero-effect semantics; exact scope, signature, and head.
• Audited commit: cc865cfb8f9fc42671d00a9b51f9915e4b90deed

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
Non-PR runs accepted any valid 40-hex event SHA instead of the exact authenticated protected SHA	Failure-first writer, replay, and orphan tests	Resolved by shared expected-protected-SHA enforcement; only PR-target permits a distinct event SHA	Focused 60/60 and exact-commit re-audit green
Evidence routing trusted payload run identity/PR association instead of the twice-read stable provider run	Failure-first wrong ID/attempt and provider PR cardinality tests	Resolved by exact stable ID/attempt binding and one provider-owned PR association	Router 13/13, four-read budget, and exact-commit re-audit green

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to
  a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Not applicable — standalone defect #160 unblocks but does not deliver or change epic #49's integrated acceptance surface.
• Production-composition result: complete local protected-workflow/authentication composition green.
• Machine-enforced acceptance result: focused 60/60, router 13/13, full repository quality, and canonical verify receipt green.
• macOS evidence: every declared local gate and the authoritative macOS 14 and macOS 26 native, package, platform, security, signing, test, and acceptance jobs passed.
• Windows evidence: exact-head Windows cross-platform smoke passed; no platform or product code changed.
• Manual usability, accessibility, visual, signing, or packaging evidence: usability/accessibility/visual not applicable; signing and packaging gates passed.

Delivery

• Target path: epic/standalone -> dev
• The target branch matches the delivery path accepted in the issue; no direct push, force
  push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected
  producer.
• Advisory tools are not treated as required merge authority under the current quality-gate
  policy.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current.
• A draft pull request was not promoted to Ready for Human Review before every required
  Acceptance Journey result and exact-head gate was complete.

For an epic or standalone pull request targeting dev, complete only by Niko or Oscharko. Agents
must leave this subsection untouched, stop at Ready for Human Review, and must not enable
auto-merge.

• I reviewed the linked issue and pull request, including scope, acceptance criteria, Quality
  Plan, evidence, checks, findings, conversations, and residual risks on the commit above.
• I am manually initiating the merge into dev; no automated actor is performing it.

Residual risks and follow-ups

• The protected post-human-merge replay of the stranded Defect: active lifecycle generation cannot be superseded after fact drift #158 tuple and Exact migration inventory, one-time reconciliation, and activation orchestration #52 / PR Governance: add exact migration inventory and dry-run orchestration #156 evaluation is
  intentionally pending because it must execute from the new protected dev commit after a
  maintainer manually merges this PR. It must produce zero lifecycle effects while activation
  remains disabled.

Closes #160

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Niko4417]

Ready for Human Review evidence for exact head cc865cf:\n\n- GitHub commit verification: verified, reason valid.\n- Complete local quality and zero-vulnerability audit passed.\n- Exact-head CI run 30743902543 passed, including authoritative macOS 14 and macOS 26 native and acceptance jobs.\n- Every required branch-protection context is green.\n- Sonar reports 96.0% new-code coverage, 0 new or accepted issues, 0 security hotspots, and 0.0% duplication.\n- Independent exact-head audit has zero unresolved findings.\n- GitHub review audit has zero unresolved threads and zero change requests.\n- Target remains dev and auto-merge remains disabled.\n\nThe non-required Lifecycle wake failures are the accepted pre-merge defect: pull_request_target executes the current protected dev implementation, not this PR head. After a maintainer manually merges this PR, protected replay of the stranded #158 record and #52 / PR #156 must pass with zero lifecycle effects while activation remains disabled.\n\nThis is the automation stop state. Only Niko or Oscharko may manually initiate the merge into dev.

[Niko4417]

Ready for Human Review evidence for exact head cc865cf:

• GitHub commit verification: verified, reason valid.
• Complete local quality and zero-vulnerability audit passed.
• Exact-head CI run 30743902543 passed, including authoritative macOS 14 and macOS 26 native and acceptance jobs.
• Every required branch-protection context is green.
• Sonar reports 96.0% new-code coverage, 0 new or accepted issues, 0 security hotspots, and 0.0% duplication.
• Independent exact-head audit has zero unresolved findings.
• GitHub review audit has zero unresolved threads and zero change requests.
• Target remains dev and auto-merge remains disabled.

The non-required Lifecycle wake failures are the accepted pre-merge defect: pull_request_target executes the current protected dev implementation, not this PR head. After a maintainer manually merges this PR, protected replay of the stranded #158 record and #52 / PR #156 must pass with zero lifecycle effects while activation remains disabled.

This is the automation stop state. Only Niko or Oscharko may manually initiate the merge into dev.