feat(ci): audit orphaned workflow registry evidence read-only

CHANGELOG.md

@@ -5,13 +5,17 @@ All notable changes to OriginWeave are documented in this file. The format follo
 ## [Unreleased]
 
 ### Added
+- Hardened the read-only workflow-registry audit against printable Unicode confusables: every audited workflow path is now restricted to a canonical ASCII alphabet, so fullwidth solidus, fraction-slash, homoglyph letter forms, and similar look-alike separators fail closed instead of passing validation while failing exact-match ownership classification.
 
 - Refreshed the product and technical gap baseline with the 2026-08-24 live inventory: 158 open pull requests (44 ready, 114 draft), refreshed exact base/head evidence for the #208–#222 release, enterprise-approval, BAP, and WARC/PROV chains, the governance issue additions #212 and #215, and a required-check provider-failure record for the fail-closed Strix re-dispatches on #208/#218/#220.
 - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work.
 - Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices.
 - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline.
 - Bound explicit extension-to-Agent grants to the exact canonical origin in addition to extension identity, session, and browsing context, so a same-session navigation or port change cannot reuse the grant.
 - Rust workspace for independently reusable core, policy, destination, network, TLS, resource, and evidence modules.
+- Read-only workflow-registry audit evidence that binds complete paginated GitHub Actions inventory to exact protected-main state, rejects Git's all-zero null object identifier anywhere a real protected-main or active-PR commit is required, fails closed on ambiguous scalar types including noncanonical negative-zero integers, workflow identities, paths, timestamps, and ownership, and exposes typed bounded-recollection guidance only for reviewed transient HTTP results (`408`, `429`, `500`, `502`, `503`, and `504`), preserves bounded `Retry-After` seconds when collected, treats `403` as retryable only when that bounded hint is retained, and keeps `404`, `501`, `505`, and every other non-reviewed failure non-retryable and non-passing.
+- Exact active-PR workflow-owner evidence that binds every deferred registry path to one positive PR number and exact contributor-head SHA, rejects path-only or mismatched exemptions, and retains the independently refetchable owner identity on read-only audit output.
+- Disabled active-PR-owned workflow identities remain bound to their exact PR/head owner but are surfaced explicitly as operational drift instead of being mislabeled as active PR ownership.
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.
 - Typed browser actions, capabilities, risk classes, execution modes, robots decisions, secret-delivery contracts, immutable canonical action-intent digests, and intent-bound approval scopes.
 - Active PR #168 adds deterministic MCP `2026-07-28` stateless tool-routing foundations with bounded names, a single reviewed tool-to-action registry shared by routing and discovery metadata, and fail-closed policy binding that grants no ambient authority. This is active-PR evidence only; the complete MCP adapter, transport serialization, discovery response handling, OAuth, browser I/O, and persistence remain planned until separately integrated on protected `main`.