install: preflight operator-only prerequisites (secrets + bot access) upfront and hard-block until present

.cdd/unreleased/706/CLAIM-REQUEST.yml

@@ -0,0 +1,4 @@
+wake: cds-dispatch
+protocol: cds
+issue: 706
+requested_transition: status:todo -> status:in-progress

.cdd/unreleased/706/REVIEW-REQUEST.yml

@@ -0,0 +1,5 @@
+wake: cds-dispatch
+protocol: cds
+issue: 706
+requested_transition: "status:in-progress -> status:review"
+reason: β's R0 review converged (verdict: converge, beta-review.md) with no fix round required; ready for PR + operator review.

.cdd/unreleased/706/alpha-closeout.md

@@ -0,0 +1,24 @@
+# α closeout — cnos#706
+
+## Summary
+
+Implemented the consolidated final spec's Deliverables 1–7 against Final ACs 1–10: a preflight-first gate for `cn repo install --dispatch cds` (new `install-preflight` package, presence-only GitHub secrets/push-access checks, no secret values ever handled), the `SIGMA_WORKFLOW_PAT` → `CN_DISPATCH_PAT` rename across the renderer/`repoinstall.go`/CLI help/live workflow/both golden fixtures, deletion of the cosmetic default `bot_name`/`bot_id` identity (now strictly opt-in), and an in-place revision of `docs/guides/INSTALL-CDS.md` (term definitions before use, no assumed bot account, `GITHUB_TOKEN`-only claims correctly scoped to the Tier 2 `--engine` path only).
+
+## Deviations from the scaffold's plan
+
+None substantive. Two soft judgment calls the scaffold left to α's discretion were made and disclosed rather than escalated:
+
+1. **Preflight is skipped under `--dry-run`.** Not named explicitly in the scaffold; reasoned from the existing dry-run contract (writes nothing regardless, never reached label-doctor either) rather than introducing a new inconsistency.
+2. **Push-access check uses the single-call `GET /repos/{owner}/{repo}` `permissions.push` field**, per the scaffold's own §Friction 3 recommendation, over the two-call collaborator/permission endpoint — taken as intended, not a deviation.
+
+The scaffold's §Friction 4 warning (two distinct sigma bindings — the cosmetic-identity table and the PAT-secret default — both needing removal, in two different call sites of the same file) was real and both were located and fixed; nothing was missed there.
+
+## Disclosed debt
+
+1. **No fully `err == nil` end-to-end `Run()` test for `--dispatch cds`.** Pre-existing gap, not introduced this cycle: every dispatch-cds fixture (before and after #706) stops short of a true zero-error run because label-doctor's own git-remote resolution isn't reachable from this package's env-var test seam without triggering an uncontrolled live network call. The idempotent-re-run test (`TestRun_DispatchCds_PreflightSatisfied_SecondRunByteIdentical`) and the render-progression tests stand in for the "proceeds" half of AC4.
+2. **`CN_INSTALL_PREFLIGHT_API_BASE_URL` / `CN_INSTALL_PREFLIGHT_REPO` are internal test-only env vars**, not part of the public CLI contract — they exist only to give CLI-level tests an `httptest.Server` seam. A future cycle wanting real GitHub Enterprise Server support could reconsider exposing an equivalent flag; out of this cycle's scope guardrails.
+3. `docs/development/design/cn-repo-install-MOCKS.md` still reflects the pre-#706 design — left untouched per the scaffold's own disposition (reference-only, not user-facing).
+
+## Success claim
+
+All 10 Final ACs (AC1–AC10) implemented with named test/grep evidence in `self-coherence.md` §ACs, and independently re-verified — not merely re-quoted — by β in `beta-review.md` §R0 (verdict: converge). β re-ran every cited test, re-ran the renderer itself and byte-diffed its output against both golden fixtures and the live workflow, and re-derived each AC's oracle from the issue's consolidated-spec text rather than trusting this file's self-report. Scope guardrails held (confirmed independently by β against the full diff). No fix round was required — β's verdict converged on R0.

.cdd/unreleased/706/beta-closeout.md

@@ -0,0 +1,23 @@
+# β closeout — cnos#706
+
+## Review process summary
+
+R0 was a single-round independent review; no fix round was requested. Every AC's oracle was re-derived from the issue's own last comment ("CONSOLIDATED FINAL SPEC (for dispatch, 2026-08-05)") rather than taken from γ's scaffold paraphrase or α's `self-coherence.md` restatement, and every claim in `beta-review.md` §R0 traces to a command β actually ran, not a re-quote of α's report:
+
+- `go build`/`go vet`/`go test ./...` executed directly across `src/go` (15 packages) and the new `install-preflight` module (15 test functions) — all green, confirmed by direct execution.
+- The `cn-install-wake` renderer was re-run by β itself for both `cds-dispatch` and `agent-admin`, and the output byte-diffed against both golden fixtures and the live `.github/workflows/cnos-cds-dispatch.yml` — confirming the goldens and live workflow are genuinely renderer-regenerated, not hand-edited to merely look right (AC6/AC9).
+- The preflight wire type (`ghSecret`) was read end-to-end for a `Value`/`value` field, not just spot-checked against α's claim (AC3).
+- The doc revision (`docs/guides/INSTALL-CDS.md`) was read in full for term-definition ordering and stale-identity leakage, not grepped for the presence of a `## Terms` heading alone (AC8).
+- The one test assertion the scaffold flagged as needing deliberate handling (`TestRun_DispatchCds_RendererNotVendored_FailsWithNoPartialWrite`, unchanged in favor of a distinct later-failure-mode reading) was traced through its actual fixture setup, not accepted on α's comment alone (AC2).
+
+## Verdict: converge, despite Finding F1
+
+All 10 ACs passed against independently re-derived oracles; all cited tests were independently executed and passed; the renderer was independently re-run and produced byte-identical output; scope guardrails held under a full-diff walk against all six guardrail clauses; git history was clean. Finding F1 (HIGH) — the live workflow and `agent-admin` golden now bind every runtime token to `secrets.CN_DISPATCH_PAT`, and β could not confirm via `gh api repos/usurobor/cnos/actions/secrets` (403, insufficient permission) whether that secret is actually provisioned on `usurobor/cnos` — does not change this verdict, because it is not a defect in the diff. There is no code-level fix α could make: the scope guardrails correctly forbid this cycle from ever touching a secret's value, and the rename itself is complete and correct on every surface β checked (live workflow, both goldens, renderer, `repoinstall.go`, CLI help). Iterating the cycle back to α over F1 would not change the diff; it would only delay a merge decision that depends on GitHub-side state outside version control.
+
+## F1 framing: pre-merge operator/δ coordination gate, not a code defect
+
+F1 is explicitly **not** an implementation-contract finding, not a scope-guardrail violation, and not a test gap. It is a self-referential infrastructure risk: GitHub evaluates a reference to a nonexistent secret as an empty string rather than a parse error, so if `CN_DISPATCH_PAT` is not provisioned as a repo secret on `usurobor/cnos` before or at merge, the next scheduled firing of the live `cnos-cds-dispatch.yml` and `cnos-agent-admin.yml` wakes will degrade or fail. β verified the baseline: the current `main`-branch workflow (still on `SIGMA_WORKFLOW_PAT`) is firing normally today, which is exactly the healthy state that would go dark post-merge if the new secret name isn't backed by a real secret. This is a merge-sequencing/provisioning action for δ and the operator to close out-of-band — not something for β to iterate against α, and not something this review can resolve by re-reading code. It is carried forward verbatim into `gamma-closeout.md`'s dedicated pre-merge operator-action section so it cannot be missed at PR time.
+
+## Release note
+
+Merge has not yet been executed as of this closeout — β's `verdict: converge` in `beta-review.md` is the review-side authorization to proceed, contingent on F1's out-of-band resolution per the note above. No fix round was required; R0 stands as the terminal review round for this cycle.