[Cylop]

Adds an unattended review run that small IT teams can schedule in CI.

• permesh check (experimental) collects a snapshot, evaluates review rules and writes snapshot.json, check.json and a counts-only summary.md. Exit codes: 0 clean, 6 needs review, 4 incomplete, 3 failed.
  • Departures are inactive or suspended authoritative identities that still have access. They are computed independently of the policy file, and reported as "not assessed" when there is no authoritative source.
• Baseline comparison (--previous): new and removed admins come from the core admin query, so admin access gained through a team or group is caught. Identities that vanished are listed as "needs review", never as departed. A comparison that isn't comparable is inconclusive (exit 4). Without a comparison, change counts read "not compared", never zero.
• Notifications (ADR 0032): optional check.notifications in permesh.yaml for Slack, Teams, a generic webhook, or email over SMTP (lettre with rustls/aws-lc-rs).
  • Messages carry counts only by default; names appear only with detail: true.
  • Webhook URLs and passwords must be env:///keychain:// references. Webhooks require https (plain http only on loopback); SMTP always uses TLS.
  • Each channel gets one attempt with a 10 s timeout. Delivery failures are reported with fixed redacted reasons and never change the exit code.
• permesh init --starter writes examples/starter: workspace template, ci/bootstrap.sh, a review policy, and SHA-pinned GitHub Actions plus GitLab CI workflows.
  • The bootstrap trusts catalog-verified packages; approval succeeds only when the committed permesh.yaml pin matches.
  • The baseline is taken only from this workflow on the default branch in the same repository. The Permesh binary is pinned by a committed archive SHA-256, and GitHub additionally runs gh attestation verify.
  • The issue update uses summary.md only. Docs require a private repository.

Validation: fmt, clippy -D warnings, cargo test --all --locked, Python script tests, check_docs.py, cargo deny and cargo audit --deny warnings all pass, and actionlint is clean on the starter workflow. ci/bootstrap.sh was run against the real GitLab/Entra/Identity Center 0.2.0 packages, and a mismatched pin fails as intended. A fresh whole-branch review found one critical and six important issues, all fixed with tests.

Not yet verified:

• The workflows on real runners. They need a release that contains check; the workflows reference 0.1.0-alpha.4, which doesn't exist yet.
• The GitLab pipeline with GitLab CI Lint.
• The Teams Workflows webhook format.