fix(security): reject dot segments and hide raw dependency-review identity

[cursor]

Purpose

Continue #1045. That head rejects empty and non-hex revisions and owner/../path, but ContextualWisdomLab/.. still matches owner/name, identity-rejection logs echo the raw revision and repository, and curl 000 is recorded as a numeric status.

This is the single integration vehicle for the remaining identity boundary. Prefer this branch over #897, #1033, #1041, #1042, #1044, #1045, and #1048. Keep #821 draft. Do not close #810 until a protected-main public consumer run proves a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate.

Canary (do not treat as fixed until a post-merge consumer run)

ContextualWisdomLab/EgressWeave#66, Security Scan run 31108241013, job 92638903658 compared 10d0c51d...c038a950, received HTTP 403, skipped the pinned action, and still concluded success. Downstream: ContextualWisdomLab/EgressWeave#76.

What changed

• Reject a complete owner or name segment that is . or .. before any compare request, while keeping the special .github repository name legal.
• Identity-rejection diagnostics name the failure class and the operator next step. They do not echo the raw invalid revision or repository.
• Curl %{http_code} 000 with any transport exit is unavailable evidence.
• Doctoring cites RFC 3986, CWE-20, CWE-22, Git object IDs (Chacon & Straub, 2014), and FIPS 180-4 so operators resupply exact event SHAs instead of retrying a named ref or a traversed path.

Tests

Local pytest tests/test_required_workflow_queue_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py tests/test_pr_governance_audit_contract.py tests/test_codeql_pr_workflow_contract.py tests/test_central_required_workflow_ruleset_audit.py tests/test_opencode_workflow_shell_syntax.py: 124 passed.

Acceptance

Merge only after exact-current-head deterministic, security, dependency, and required workflows are terminal and clean, current automated review has no valid unresolved finding, and a qualifying counted non-author formal approval exists.

Automated review is not qualifying approval or merge authority.

Operator next step

1. Wait for exact-current-head required checks on this head.
2. Leave a counted non-author formal approval on this head only.
3. After merge, run a public consumer proof on security: fail closed when dependency review is unavailable EgressWeave#76 before closing security: make central dependency-review unavailability fail closed #810.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Verdict

COMMENT on exact head e4a7dffa4c4ee8cceb423504d0f01d8a803f7ddb.

This is the integration vehicle for #810. It keeps the #1041/#1045 fail-closed probe, then rejects ./.. repository segments that still match owner/name, refuses named refs before curl, classifies curl 000 as unavailable, and stops echoing raw invalid identity. The .github repository name remains legal.

Do not merge #897, #1033, #1041, #1042, #1044, #1045, or #1048. Keep #810 open until a protected-main public consumer run proves a non-200 cannot go green. Merge only after exact-current-head checks are terminal and clean and a qualifying counted non-author formal approval exists. Do not self-approve.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict

COMMENT on exact head e4a7dffa4c4ee8cceb423504d0f01d8a803f7ddb.

This is the integration vehicle for #810. Automated review is not qualifying approval or merge authority. Do not treat this COMMENT as a counted approval, and do not self-approve.

What this head does

It keeps the #1041/#1045 fail-closed probe, then closes the remaining identity boundary:

• Rejects a complete owner or name segment that is . or .. before any compare request.
• Keeps ContextualWisdomLab/.github legal.
• Refuses named refs and other non-hex revisions before curl.
• Classifies curl %{http_code} 000 as unavailable evidence.
• Names the failure class and the operator next step on identity rejection; it does not echo the raw invalid revision or repository.
• Leaves the pinned action ungated after a successful probe. supported=false and the EgressWeave#66 skip warning are gone.

The dependency-review job stays contents: read and pull-requests: read. Local pytest tests/test_required_workflow_queue_contract.py tests/test_pr_governance_audit_contract.py recorded 78 passed.

Operator next step

1. Wait until exact-current-head deterministic, security, dependency, and required workflows are terminal and clean on this SHA. Cancelled checks from the ready-for-review retrigger are not current-head evidence.
2. Leave a counted non-author formal approval on this head only. seonghobae is already requested.
3. After merge, run the public consumer proof on ContextualWisdomLab/EgressWeave#76 before closing #810.

Do not merge #897, #1033, #1041, #1044, #1045, #1048, or draft #1050. Keep #821 draft.

Residual successor work

Do not rewrite this probe. After this head is on protected main:

• Pin = "." segment equalities and the probe step's lack of continue-on-error in the YAML contract.
• Pin the doctoring fail-closed sentences the same way other doctoring records are pinned.
• Move the Bearer token off curl argv.
• Do not widen this job token to write to make comment-summary-in-pr prettier.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Successor contract, not a merge blocker: pin [ "${repository_owner}" = "." ] and [ "${repository_name}" = "." ] here as well. Executable tests already reject ContextualWisdomLab/. and ./.github, but a later YAML edit can drop the . equalities and still satisfy these .. string pins. After this head is on main, add those two asserts in the same function before opening another probe rewrite.

[cursor]

Successor contract, not a merge blocker: this pins continue-on-error: true off the job header, not off the Check dependency review support step. A later continue-on-error: true on that probe would let the ungated action run after a failed identity or HTTP probe. After this head is on main, assert the extracted support-probe step text does not contain continue-on-error.