[hyperpolymath]

Summary

Step 3 of the governance-gate stack, after #966, #967, #968 and #973.

Under RE001 as #964 (standards ADR-009) now ships it, every job that reads a real secret is in scope. On main that is 9 :warn findings. Once #973 makes hypatia's gate run main's rules, they hold it red at the info threshold. This PR clears them by the safety-triangle order: eliminate the credential where we can, then control what remains.

job	secret	action
security-policy / secret-gitleaks	GITLEAKS_LICENSE	Eliminated. gitleaks-action needs a licence only for an organization owner. Run 40442141312 logs [hyperpolymath] is an individual user. No license key is required. and shows the secret empty, so it was never set.
inbox-steward-intake / analyze-patterns	FARM_PAT	Its read-only checkout no longer takes the PAT and keeps no credential (persist-credentials: false). The gh api read still uses the PAT, so the job is hardened with GitHub + API.
inbox-steward-intake / dispatch-to-farm	FARM_PAT	Dropped a checkout nothing read. Hardened, API only.
inbox-steward-intake / record-report, update-ruleset	FARM_PAT	Hardened, GitHub + API (push, gh pr create).
ci-health-sweep / sweep	HYPATIA_DISPATCH_PAT	Hardened, GitHub + API. Every call in scripts/ci-health/*.sh is gh.
hypatia-remediation-sweep / sweep	HYPATIA_DISPATCH_PAT	Hardened, API plus the artifact service and its blob storage.
roadmap-sync / sync	App private key	Hardened, API only. It already used an App token (substitution done before this PR).
push-email-notify / notify	SMTP_*	Hardened: the action's release download, plus ${{ secrets.SMTP_HOST }}:${{ secrets.SMTP_PORT || '465' }}. The mail host is itself a secret, so it stays masked.

All hardening is step-security/harden-runner@v2.22.2 with egress-policy: block, the same pin #968 introduced. actions.lock holds the tool's bytes from run 40443523409 (sha256 74ebf8be…, GATE_RC=0); it was not hand-written.

How has this been verified?

• RE001, RE001: accept a deed egress declaration; stop counting secrets.GITHUB_TOKEN (standards ADR-009) #964's version (653d09c) on this tree: 9 → 0. Main's version: 0 → 0.
• Differential self-scan, all 15 rule modules over origin/main and this branch, keeping findings on the six touched workflows:
  • with RE001: accept a deed egress declaration; stop counting secrets.GITHUB_TOKEN (standards ADR-009) #964's rules, only those 9 RE001 findings go and nothing is added;
  • with main's rules, there is no change;
  • WH004 is 0 once the lock is in.
• actionlint 1.7.7: the same 85 issues as main, none new.
• Not verified, and the real risk: a block allow-list that misses a host breaks its job at run time. These jobs run on schedule, dispatch or push, so PR CI can't exercise them. I worked out each list from the job's code (every gh/git/action call), not by observation. I propose one workflow_dispatch per job with its own dry_run, before or just after merge, and reading harden-runner's egress report.

Not done here (needs the owner or another repo)

• Substitution: the four FARM_PAT jobs and the two HYPATIA_DISPATCH_PAT sweeps could each move to a GitHub App installation token scoped to the repos they touch, as roadmap-sync already does. That means creating Apps, which this session can't do.
• Attestation: a hypatia_chora.deed with (egress …) entries (:enforcement harden-runner-block), once RE001: accept a deed egress declaration; stop counting secrets.GITHUB_TOKEN (standards ADR-009) #964 lands, agreed with the RE001: accept a deed egress declaration; stop counting secrets.GITHUB_TOKEN (standards ADR-009) #964 session.
• Org move: if the repo moves to an organization (as standards did), gitleaks will need GITLEAKS_LICENSE again.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a5e768a0-d7c3-4e99-861d-eef9abfb9e04

Commits

Reviewing files that changed from the base of the PR and between 52c8ff3 and 52b32f9.

Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

Files selected for processing: 6

• .github/workflows/ci-health-sweep.yml
• .github/workflows/hypatia-remediation-sweep.yml
• .github/workflows/inbox-steward-intake.yml
• .github/workflows/push-email-notify.yml
• .github/workflows/roadmap-sync.yml
• .github/workflows/security-policy.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

The two red checks, Sweep fleet for vulnerable repos (run 40443859596) and Detect + remediate estate CI health (run 40443861997), are the dry_run=true dispatches I ran on this branch to test the new egress allow-lists. They didn't run because of anything in this PR.

• Why they failed: both stop at the first API call with HTTP 401: Bad credentials (https://api.github.com/graphql). HYPATIA_DISPATCH_PAT is invalid. Every scheduled run of both workflows on main has failed the same way since at least 2026-10-23 (for example 40265013226 and 40266651942).
• What they did show: harden-runner block engaged, the checkout reached github.com, and api.github.com was reachable. The 401 is the API's reply, not a blocked connection.
• What they couldn't show: whether the rest of each allow-list is complete. The jobs stop before reaching anything else.
• Fix: none is possible from this PR. The PAT has to be rotated, or replaced with a GitHub App token, and either is an owner action. After that I'll run both dry runs again. Re-running now would fail the same way.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T04:10:59.326510Z	52b32f9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix