feat: project public security controls

[jmcte]

Summary

• Project a pinned, fork-safe public security workflow: dependency review is pull-request-only, while per-language CodeQL and SPDX JSON SBOM jobs run only on trusted events using GitHub-hosted isolation.
• Generate the public security policy, response targets, operating model, and accepted ADR, including a detail-free fallback for requesting a confidential reporting channel.
• Plan and apply dependency alerts, security updates, secret scanning, push protection, private reporting, and exact CodeQL evidence while distinguishing explicit plan limits from fail-closed authorization or validation errors.

This is the projection and provisioning slice of issue #60. Deterministic conformance validation will follow in a dependent PR.

Governing Issue

Refs #60

Validation

• Relevant local checks passed
• Agent-authored changes passed autoreview against the intended PR diff with no accepted/actionable findings
• Autoreview command and result: /Users/johnteneyckjr./.codex/skills/autoreview/scripts/autoreview --mode commit --engine codex --model gpt-5.6-terra --thinking high --no-web-search --stream-engine-output --parallel-tests 'TMPDIR=/tmp npm run check' --json-output /private/tmp/bootstrap-60-projection-autoreview-commit.json — clean at 5122f457f236b92a94142d867f76a7b905105b09, no actionable findings, confidence 0.91; 182 tests passed in parallel.
• Required PR checks are expected to satisfy CI Gate
• Skipped checks are explained below

Additional verification:

• npm run check — 23 files, 182 tests passed.
• npm run build — passed.
• bash scripts/ci/check-action-pins.sh — passed; 42 immutable third-party action references validated in the tracked workflows.
• git diff --check — passed.

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
• No real secrets, runtime auth, or machine-local env files are committed

Material change: yes
ADR: docs/decisions/ADR-0005-public-repository-security-baseline.md

Merge Automation

• PR author enabled auto-merge with gh pr merge --auto --squash, or the reason it is unavailable/unsafe is noted below

Notes

• Public security jobs use GitHub-hosted isolation. The earlier self-hosted activation path was removed because repository projection cannot prove the remote runner authorization boundary first.
• Dependency review remains skipped until GitHub provisioning enables dependency alerts and sets DEPENDENCY_REVIEW_ENABLED=true; this PR does not mutate live repository settings.
• GitHub API capability exceptions are endpoint-specific. Ambiguous authorization and validation failures remain hard errors.
• The PR is intentionally below the 800-line governance threshold after excluding documentation and tests; issue Project and validate the public-repository security baseline #60 remains open for the conformance slice.

[jmcte]

Exact-head agent review evidence for 0fc1c3e54dc4b89f25ad4e191139c5958322ca3c:

• Commit-mode autoreview: clean, no accepted/actionable findings; overall verdict patch is correct (0.86).
• Parallel verification inside autoreview: 23 test files and 181 tests passed.
• npm run build: passed.
• bash scripts/ci/check-action-pins.sh: passed; conformance validates 46 immutable third-party references including the projected workflow.
• git diff --check origin/main...HEAD: passed.
• Local Bootstrap conformance: PRS-SECURITY-BASELINE-001 and PRS-FORK-SAFETY-001 pass.
• Live non-mutating GitHub plan completes and reports current security drift. Runner-group state remains explicitly security-runner-boundary-unverified because the current token lacks organization runner-group read/admin permission.

Material change is declared and governed by Accepted docs/decisions/ADR-0005-public-repository-security-baseline.md. The selected-workflow runner boundary and fork trust model require independent security review; the author has not approved this pull request.

[athena-omt]

The local exact-head review is clean for npm run check, npm run build, and git diff --check, but this PR is not merge-ready because required CI is failing.

• dependency-review fails: GitHub reports that dependency graph is disabled. Enable dependency graph for OMT-Global/bootstrap before this workflow is required, or gate the job until that capability is confirmed; otherwise the new required security workflow prevents this PR from merging.
• Validate PR Governance rejects the PR at 950 counted changed lines, above the enforced 800-line threshold. Split the implementation into reviewable PRs (or obtain and record the repository's explicit exception) and rerun CI.

CI Gate is consequently failing. The separate independent-approval failure is expected until a qualifying reviewer approves a passing head. Auto-merge is already enabled; no unresolved review threads or prior reviews were present.

[jmcte]

Exact-head validation for 5122f457f236b92a94142d867f76a7b905105b09:

• npm run check — 23 test files, 182 tests passed.
• npm run build — passed.
• bash scripts/ci/check-action-pins.sh — 42 immutable action references passed.
• git diff --check — passed.
• Commit-mode autoreview — clean, no accepted/actionable findings, confidence 0.91; its parallel npm run check also passed all 182 tests.

The PR was split to 419 governance-counted changed lines. This slice references #60; the dependent conformance slice will close it.

[jmcte]

@athena-omt please re-review exact head 5122f457f236b92a94142d867f76a7b905105b09.

The prior requested changes applied to superseded head 0fc1c3e54dc4b89f25ad4e191139c5958322ca3c. This head is the split projection slice: dependency review skips until activation, governance counts 417 changed lines, all other exact-head checks pass, and commit-mode autoreview is clean.

[athena-omt]

Reviewed exact head 5122f457f236b92a94142d867f76a7b905105b09 against base 1cf61f6f558882779dedddbea01efa23b47db55f. The prior dependency-review and PR-size blockers are resolved: dependency review is safely gated, and governance counts 417 changed lines. I found no new source-level blocker in the provisioning call path, generated workflow, or adjacent tests.

This head is not merge-ready: Validate PR Governance and therefore CI Gate are failing. The live review state has no independent APPROVED review; the governance checker otherwise validates the title, DCO, size, and accepted ADR. Obtain an approval from a non-author for this exact head, rerun the failed governance/CI checks, and return for final review only after all required checks are green.

Evidence: Fast Checks and Validate Action Pins passed; auto-merge is enabled; there are no public inline review comments. Local exact-head inspection included the full PR diff, src/github/provision.ts call path, generated security workflow, and adjacent tests. The node worktree lacks dependencies, so local npm validation could not run (tsc/vitest unavailable); live Fast Checks passed.

[jmcte]

@athena-omt the only live governance failure is PRS-INDEPENDENT-REVIEW-001: it requires an APPROVED review from a non-author. Your exact-head review found no source-level blocker, and pull_request_review: submitted automatically reruns governance.

Requiring green governance before approval is therefore circular. Please submit APPROVED for exact head 5122f457f236b92a94142d867f76a7b905105b09; that approval will trigger the governance and CI Gate rerun you requested. Auto-merge is already armed for the resulting green state.

[athena-omt]

Reviewed exact head 7b55e79b5c05debff49c74e0bc375624b4b0e43d against main (1cf61f6f558882779dedddbea01efa23b47db55f). No source-level blocker found in the public-security workflow projection, GitHub provisioning path, or adjacent tests. The fork-reachable job is read-only and GitHub-hosted; privileged CodeQL/SBOM jobs are excluded from pull-request events. Local targeted tests passed (60 tests), along with typecheck, build, action-pin validation, and diff validation. Live Fast Checks, action-pin validation, secret validation, PR-description validation, and attestation are green; there are no unresolved review threads. The only failed required check is PRS-INDEPENDENT-REVIEW-001, which requires a non-author approval and should rerun after this approval. Auto-merge is already enabled.