fix(governance): preserve delegated capability path authority

docs/doctoring/actions-runner-assignment-audit.md

@@ -8,25 +8,25 @@ This control is deliberately narrower than CI or merge readiness. It does not cr
 
 ## Evidence model
 
-The operator supplies an explicit bounded set of GitHub Actions workflow-run IDs plus the exact expected pull-request source-head SHA. The collector retrieves each selected workflow run and **all** job pages for that run, then the evaluator classifies runner assignment separately from the later workflow conclusion.
+The operator supplies an explicit bounded set of GitHub Actions workflow-run IDs plus the exact expected pull-request source-head SHA. For each selected run, the collector first validates the run's exact positive `run_attempt`, then retrieves **all** job pages only from `actions/runs/{run_id}/attempts/{run_attempt}/jobs?per_page=100`. Every retained workflow job must independently carry that same exact positive `run_attempt`. The evaluator then classifies runner assignment separately from the later workflow conclusion.
 
 Required invariants are:
 
 1. the repository is exactly `ContextualWisdomLab/noema`;
 2. the production CLI reads its short-lived GitHub transport authority from an owner-only delegated token capability file named by `NOEMA_MAINTAINER_TOKEN_PATH`; the bearer value is never read from ambient `GH_TOKEN` and is never retained in the report;
 3. the expected source head is one canonical lowercase 40-character commit SHA;
 4. one to twenty unique positive run IDs are selected explicitly;
-5. selected runs must be `pull_request` runs bound to that exact source head;
-6. job pages are fully paginated with `per_page=100` and `filter=all`, bounded to at most 2,000 retained jobs;
-7. runner assignment is observed only from a positive `runner_id` or a non-empty `runner_name`; `started_at` is not runner-assignment authority because GitHub may populate it while a job is still queued without runner identity;
-8. a `waiting`, `pending`, or `requested` job remains non-passing `PENDING` because those states do not by themselves isolate runner allocation;
-9. a queued job in a run where another job has already received a runner remains non-passing `PENDING`, because the queued job may be waiting on an explicit `jobs.<job_id>.needs` dependency rather than runner capacity;
-10. the bounded grace may produce `runner_assignment_stalled` only when the workflow run itself remains `queued`, the job remains `queued`, and no job in that selected run has assignment evidence;
-11. an assigned job may produce runner-assignment `PASS` even if its later workflow/test conclusion is `failure`, because those are separate evidence classes.
+5. selected runs must be `pull_request` runs bound to that exact source head and must carry a positive safe-integer `run_attempt`;
+6. job pages are fully paginated from `actions/runs/{run_id}/attempts/{run_attempt}/jobs?per_page=100`, bounded to at most 2,000 retained jobs, and every retained workflow job must carry the same exact positive `run_attempt` as its selected run; the run-wide `filter=all` endpoint can include predecessor attempts and is therefore non-authoritative for current-attempt runner identity;
+7. runner assignment is observed only from a positive `runner_id` or a non-empty `runner_name` on a job whose `run_attempt` matches its selected run; `started_at` is not runner-assignment authority because GitHub may populate it while a job is still queued without runner identity;
+8. a `waiting`, `pending`, or `requested` current-attempt job remains non-passing `PENDING` because those states do not by themselves isolate runner allocation;
+9. a queued current-attempt job in a run where another **current-attempt** job has already received a runner remains non-passing `PENDING`, because the queued job may be waiting on an explicit `jobs.<job_id>.needs` dependency rather than runner capacity; predecessor-attempt assignment must not suppress current-attempt stall classification;
+10. the bounded grace may produce `runner_assignment_stalled` only when the workflow run itself remains `queued`, the current-attempt job remains `queued`, and no job in that selected **current attempt** has assignment evidence;
+11. an assigned current-attempt job may produce runner-assignment `PASS` even if its later workflow/test conclusion is `failure`, because those are separate evidence classes.
 
 The default runner-allocation grace is five minutes and may be bounded by `NOEMA_ACTIONS_AUDIT_QUEUE_GRACE_MILLISECONDS`; the evaluator rejects values above thirty minutes rather than allowing a true isolated queue condition to remain indefinitely pending.
 
-This classifier is intentionally conservative because the GitHub workflow-job REST representation does not expose a durable repository-consumable timestamp meaning “this job became eligible for runner allocation.” A workflow run's `created_at` is therefore not a trustworthy age for every downstream job, and a job's `started_at` is not runner-assignment authority. The evaluator uses run age only after the selected evidence isolates the top-level queued runner-allocation boundary described above.
+This classifier is intentionally conservative because the GitHub workflow-job REST representation does not expose a durable repository-consumable timestamp meaning “this job became eligible for runner allocation.” A workflow run's `created_at` is therefore not a trustworthy age for every downstream job, and a job's `started_at` is not runner-assignment authority. The evaluator uses run age only after the selected current-attempt evidence isolates the top-level queued runner-allocation boundary described above.
 
 ### Pre-run waits are not runner stalls
 
@@ -36,7 +36,7 @@ Those states remain operationally non-passing, but they are not evidence that Gi
 
 ## Operator contract
 
-The production command consumes an owner-only delegated token capability file. The path itself is non-secret; the token bytes must be materialized by an authorized caller and removed promptly after the audit.
+The production command consumes an owner-only delegated token capability file. The path itself is non-secret; the token bytes must be materialized by an authorized caller and removed promptly after the audit. The configured capability pathname is **byte-canonical** authority: it must already be the exact absolute lexical path accepted by the hardened reader, without trimming, coercion, relative-path resolution, or dot-segment aliasing.
 
 Example:
 
@@ -70,17 +70,17 @@ artifacts/operations/actions-runner-assignment-audit.json
 
 The report records repository, expected head, selected run IDs, observation time, queue grace, deterministic checks/failures, and explicit false authority flags for required-check success, review, merge, release, and deployment. Temporary report bytes are created owner-only and atomically renamed onto the fixed report path.
 
-`PASS` exits zero. `PENDING` and `FAIL` both exit nonzero. A malformed source identity, cross-repository request, missing/unsafe capability file, malformed API JSON, GitHub CLI failure, pagination-shape failure, excessive evidence, or head mismatch fails closed.
+`PASS` exits zero. `PENDING` and `FAIL` both exit nonzero. A malformed source identity, cross-repository request, missing/unsafe capability file, malformed API JSON, GitHub CLI failure, pagination-shape failure, excessive evidence, run-attempt mismatch, or head mismatch fails closed.
 
 ## RCA interpretation
 
-A `runner_assignment_stalled` result supports the narrow hypothesis **“the selected current-head workflow run and job remained at an isolated queued boundary without observable runner assignment beyond the configured grace interval.”** It does not by itself identify why. Possible causes remain materially distinct and require separate evidence, including GitHub-hosted runner capacity, repository/organization Actions policy, runner-group restrictions, billing/spending controls, concurrency saturation, enterprise policy, or a GitHub service incident.
+A `runner_assignment_stalled` result supports the narrow hypothesis **“the selected current-head workflow run and current-attempt job remained at an isolated queued boundary without observable current-attempt runner assignment beyond the configured grace interval.”** It does not by itself identify why. Possible causes remain materially distinct and require separate evidence, including GitHub-hosted runner capacity, repository/organization Actions policy, runner-group restrictions, billing/spending controls, concurrency saturation, enterprise policy, or a GitHub service incident.
 
 A `PENDING` result for environment protection, `needs` dependency waiting, or other pre-run uncertainty means only that runner allocation has **not been isolated as the failing boundary**. It is not a health PASS and cannot satisfy a required Check.
 
-Conversely, an observed runner assignment falsifies the hypothesis that the specific selected job is still blocked at runner allocation. A later failing step must be investigated at that later boundary rather than described as a runner-assignment incident.
+Conversely, an observed current-attempt runner assignment falsifies the hypothesis that the specific selected job is still blocked at runner allocation. A later failing step must be investigated at that later boundary rather than described as a runner-assignment incident. Assignment from a predecessor attempt is not evidence about the current attempt.
 
-This separation matters for issue #30 because historical Noema runs exhibited queued jobs without logs, while later runs demonstrably received GitHub-hosted runners. Repository evidence therefore needs to preserve **assignment state** independently from **job conclusion**, **dependency/protection waiting**, and any organization-level causal claim.
+This separation matters for issue #30 because historical Noema runs exhibited queued jobs without logs, while later runs demonstrably received GitHub-hosted runners. Repository evidence therefore needs to preserve **attempt identity and assignment state** independently from **job conclusion**, **dependency/protection waiting**, and any organization-level causal claim.
 
 ## Security and privacy
 
@@ -94,12 +94,14 @@ The audit is diagnostic evidence. A passing assignment audit cannot satisfy bran
 
 The repository-owned slice is acceptable when:
 
-- realistic tests reproduce an isolated runner stall, a fresh queue, deployment/environment waiting, downstream dependency waiting, assigned-but-failed jobs, head mismatch, malformed evidence, pagination, and bounded selection;
-- queued `started_at` timestamps without runner identity remain unassigned, while a positive `runner_id` or a non-empty `runner_name` is assignment evidence;
+- realistic tests reproduce an isolated current-attempt runner stall, a fresh queue, deployment/environment waiting, downstream dependency waiting, assigned-but-failed jobs, predecessor-attempt contamination, head mismatch, malformed evidence, pagination, and bounded selection;
+- every selected run and retained workflow job carries the same exact positive `run_attempt`, and predecessor-attempt jobs cannot contribute runner identity or suppress current-attempt stall classification;
+- queued `started_at` timestamps without runner identity remain unassigned, while a positive `runner_id` or a non-empty `runner_name` on a matching current-attempt job is assignment evidence;
 - the production entrypoint succeeds with an owner-only delegated token capability file and fails closed when only ambient `GH_TOKEN` is present;
 - environment-protected and dependency-blocked jobs remain nonzero `PENDING` and are not mislabeled as runner-allocation stalls;
 - the pure evaluator and bounded source collector are GREEN;
-- the operator adapter performs only the two documented read families and fully paginates jobs;
+- the operator adapter performs only the two documented read families, binds job reads to the exact `run_attempt`, and fully paginates jobs;
+- the run-wide `filter=all` endpoint is treated as non-authoritative because it can include predecessor attempts;
 - the `gh` subprocess inherits only the minimal read-authority environment documented above;
 - `PENDING` remains nonzero;
 - report output is credential-free and authority-separated;

reviewer/tests/test_codegraph_sandbox_image_contract.py

@@ -10,6 +10,30 @@
 CENTRAL_WORKFLOW = REPOSITORY_ROOT / ".github" / "workflows" / "central-review.yml"
 
 
+def _yaml_run_blocks(workflow: str) -> list[str]:
+    """Return literal YAML run-block bodies without matching neighboring steps."""
+    lines = workflow.splitlines()
+    blocks: list[str] = []
+    index = 0
+    while index < len(lines):
+        line = lines[index]
+        if line.lstrip() != "run: |":
+            index += 1
+            continue
+        run_indent = len(line) - len(line.lstrip())
+        body: list[str] = []
+        index += 1
+        while index < len(lines):
+            candidate = lines[index]
+            candidate_indent = len(candidate) - len(candidate.lstrip())
+            if candidate.strip() and candidate_indent <= run_indent:
+                break
+            body.append(candidate)
+            index += 1
+        blocks.append("\n".join(body))
+    return blocks
+
+
 def test_codegraph_sandbox_uses_scanned_non_openssl_runtime_substrate() -> None:
     """Reviewer workflows must scan java-base and invoke the bundled Node explicitly."""
     expected_source = "gcr.io/distroless/java-base-debian13:nonroot"
@@ -20,8 +44,14 @@ def test_codegraph_sandbox_uses_scanned_non_openssl_runtime_substrate() -> None:
         assert f"NOEMA_CODEGRAPH_SANDBOX_SOURCE_IMAGE: {expected_source}" in workflow
         assert f"{expected_repository}@sha256:" in workflow
         assert "gcr.io/distroless/nodejs24-debian13" not in workflow
-        assert "trivy image" in workflow
-        assert "--severity MEDIUM,HIGH,CRITICAL" in workflow
+        trivy_run_blocks = [
+            block for block in _yaml_run_blocks(workflow) if "trivy image" in block
+        ]
+        assert len(trivy_run_blocks) == 1
+        trivy_run_block = trivy_run_blocks[0]
+        assert "--exit-code 1" in trivy_run_block
+        assert "--ignore-unfixed" in trivy_run_block
+        assert "--severity MEDIUM,HIGH,CRITICAL" in trivy_run_block
 
     assert sandbox.TRUSTED_CODEGRAPH_IMAGE_REPOSITORY == expected_repository
     source = (REPOSITORY_ROOT / "reviewer" / "noema_reviewer" / "sandbox.py").read_text(

scripts/actions-runner-assignment-audit.mjs

@@ -2,6 +2,10 @@
 
 import {
   closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  ftruncateSync,
   lstatSync,
   mkdirSync,
   openSync,
@@ -11,7 +15,6 @@ import {
 } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import {
   DEFAULT_RUNNER_QUEUE_GRACE_MILLISECONDS,
@@ -23,7 +26,10 @@ import {
   parseSelectedRunIds,
 } from "./lib/actions-runner-assignment-source.mjs";
 import { readDelegatedGithubToken } from "./lib/delegated-github-token.mjs";
-import { assertAcquisitionPrivatePathParents } from "./lib/acquisition-private-output.mjs";
+import {
+  assertAcquisitionPrivatePathParents,
+  writeAcquisitionPrivateFile,
+} from "./lib/acquisition-private-output.mjs";
 import { hasDuplicateJsonObjectKeys } from "./normalize-commercial-readiness-evidence.mjs";
 
 const AUDITED_REPOSITORY = "ContextualWisdomLab/noema";
@@ -41,14 +47,17 @@ const defaultGhRuntime = {
 };
 
 const defaultWriteIo = {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  ftruncateSync,
   lstatSync,
   mkdirSync,
   openSync,
-  writeFileSync,
-  closeSync,
   renameSync,
   unlinkSync,
-  randomUUID,
+  writeFileSync,
 };
 
 function boundedErrorText(value) {
@@ -211,6 +220,10 @@ export function ghApi(path, options = {}, runtime = defaultGhRuntime) {
 /**
  * Create read-only GitHub Actions REST adapters for the operator audit.
  *
+ * Job reads are bound to the exact positive workflow attempt returned by the
+ * selected run resource. GitHub's run-wide `filter=all` endpoint can include
+ * predecessor attempts and is therefore not authoritative for runner identity.
+ *
  * @param {{repository: string, gh_api: Function}} input Repository and API reader.
  * @returns {{fetch_run: Function, fetch_job_pages: Function}} Bounded read adapters.
  */
@@ -227,11 +240,15 @@ export function createGhReadAdapters(input) {
       input.gh_api(`repos/${AUDITED_REPOSITORY}/actions/runs/${runId}`, {
         paginate: false,
       }),
-    fetch_job_pages: async (runId) =>
-      input.gh_api(
-        `repos/${AUDITED_REPOSITORY}/actions/runs/${runId}/jobs?filter=all&per_page=100`,
+    fetch_job_pages: async (runId, runAttempt) => {
+      if (!Number.isSafeInteger(runAttempt) || runAttempt <= 0) {
+        throw new Error("Workflow run_attempt must be a positive integer before reading jobs.");
+      }
+      return input.gh_api(
+        `repos/${AUDITED_REPOSITORY}/actions/runs/${runId}/attempts/${runAttempt}/jobs?per_page=100`,
         { paginate: true },
-      ),
+      );
+    },
   };
 }
 
@@ -255,13 +272,15 @@ function parseQueueGrace(value) {
 }
 
 /**
- * Write the fixed audit report atomically with owner-only temporary permissions.
+ * Write the fixed audit report through Noema's canonical private-output boundary.
  *
- * The optional I/O seam permits deterministic failure testing without changing
- * the production report path, file mode, atomic rename, or cleanup semantics.
+ * The optional I/O seam permits deterministic failure testing while preserving
+ * parent-directory validation, owner-only permissions, no-follow leaf opens,
+ * single-link regular-file authority, descriptor/path identity checks, complete
+ * staged writes, identity-bounded cleanup, and atomic replacement.
  *
  * @param {unknown} report Bounded report value.
- * @param {object} io File-system and UUID operations.
+ * @param {object} io File-system operations used by the private-output boundary.
  * @returns {string} Absolute report path.
  */
 export function writeReportAtomically(report, io = defaultWriteIo) {
@@ -270,28 +289,11 @@ export function writeReportAtomically(report, io = defaultWriteIo) {
   assertAcquisitionPrivatePathParents(reportPath, io);
   io.mkdirSync(reportDirectory, { recursive: true, mode: 0o700 });
   assertAcquisitionPrivatePathParents(reportPath, io);
-  const temporaryPath = `${reportPath}.tmp-${process.pid}-${io.randomUUID()}`;
-  let descriptor;
-  try {
-    descriptor = io.openSync(temporaryPath, "wx", 0o600);
-    io.writeFileSync(descriptor, `${JSON.stringify(report, null, 2)}\n`, "utf8");
-    io.closeSync(descriptor);
-    descriptor = undefined;
-    io.renameSync(temporaryPath, reportPath);
-  } finally {
-    if (descriptor !== undefined) {
-      try {
-        io.closeSync(descriptor);
-      } catch {
-        // Cleanup failures must not replace the original report-write failure.
-      }
-    }
-    try {
-      io.unlinkSync(temporaryPath);
-    } catch {
-      // Cleanup failures must not replace the original report-write result.
-    }
-  }
+  writeAcquisitionPrivateFile(
+    reportPath,
+    `${JSON.stringify(report, null, 2)}\n`,
+    io,
+  );
   return reportPath;
 }
 
@@ -396,7 +398,7 @@ export async function main(options = {}) {
   let githubApi = options.gh_api;
 
   if (githubApi === undefined) {
-    const tokenPath = String(sourceEnvironment.NOEMA_MAINTAINER_TOKEN_PATH ?? "").trim();
+    const tokenPath = sourceEnvironment.NOEMA_MAINTAINER_TOKEN_PATH;
     const delegatedToken = readDelegatedGithubToken(tokenPath);
     const subprocessEnvironment = {
       PATH: sourceEnvironment.PATH,