feat: harden public provenance boundaries

[jmcte]

Summary

• Add the confirmed repository-grounded provenance threat model and keep remote/private sink deployment explicitly disabled.
• Advance generated public provenance to a strict version-2 contract with an explicit metadata allowlist and fail-closed unknown-field handling.
• Reject credential-shaped public identity fields, redact every repeated supported literal, and verify exact typed-placeholder evidence.
• Keep historical version-1 artifacts behind an explicit strict reader while default publication validation remains version-2-only.

Governing Issue

Refs #61. This is the local public-contract and threat-model slice; it does not close the encrypted private provenance, remote sink, audited-read, retention, signing-unification, or material-gate acceptance criteria.

Validation

• TMPDIR=/tmp npm run check — 23 test files, 209 tests passed.
• npm run build — passed.
• git diff --check origin/main...HEAD — passed.
• Focused provenance suite — 18 tests passed.
• OpenAI autoreview — accepted and fixed identity-field coverage, GitHub App reviewer compatibility, reserved-placeholder handling, schema-version compatibility, redaction expansion, downgrade validation, legacy strictness, version export, and legacy metadata-key findings.
• Final substantive-diff autoreview — clean, no accepted/actionable findings; confidence 0.93.

The fail-closed autoreview scanner cannot ingest the full origin/main...HEAD patch because the first behavior-neutral commit removes two historical credential-shaped fixture literals from the old side of the diff. No blocked bundle was sent. The two-line fixture change only composes the same runtime values; the complete behavioral/code/documentation diff after that sanitation commit received the clean final review.

Bootstrap Governance

• Changes are scoped to the issue Implement signed public and encrypted private provenance #61 public-provenance and required threat-model boundary.
• The public contract contains no sink identity, encryption material, runtime auth, private evidence, or long-lived credentials.
• The threat model distinguishes current controls from unimplemented signing, encryption, retention, read-audit, and merge-gate controls.
• Production code diff is 192 added/deleted lines, below the 800-line review threshold.

Material change: yes
ADR: docs/decisions/ADR-0006-public-provenance-v2.md

Merge Automation

• Auto-merge is enabled with squash and will complete after independent review and required checks pass.

Notes

• Public metadata keys are limited to policy, generator, aiProvider, aiModel, promptHash, and changeClass.
• Default validation accepts only version 2; readLegacyPublicProvenance is an explicit historical-read path and is not a publication gate.
• Remote sink use remains prohibited until independent security review and explicit human approval.

[jmcte]

Exact-head validation evidence

Validated head: 65dac73f91b201f9fea7db2ed6dfaead3736ccfa

• TMPDIR=/tmp npm run check — passed: 23 test files, 209 tests.
• npm run build — passed.
• git diff --check origin/main...HEAD — passed.
• Focused provenance suite — passed: 18 tests.
• OpenAI autoreview of the complete substantive diff after fixture sanitation — clean, no accepted/actionable findings; confidence 0.93.
• OpenAI autoreview of ADR-0006 — clean; confidence 0.96.
• PR Fast CI run 29968018868 — description, secrets, action pins, change detection, and Fast Checks passed.
• AI Attestation run 29968018679 — attestation generation and signature verification passed.
• Governance counted 192 production-code changed lines, below the 800-line threshold.

The sole exact-head CI failure is PRS-INDEPENDENT-REVIEW-001: this material change still needs an approving reviewer other than the author. Auto-merge is enabled and reviewers athena-omt and pheidon have been requested.

The fail-closed autoreview scanner rejected the literal historical credential-shaped fixtures on the deleted side of the original whole-branch patch, so that blocked bundle was not sent. A behavior-neutral first commit sanitizes those fixture expressions; the entire substantive code, test, documentation, and ADR diff after that commit received the clean reviews above.

[athena-omt]

Reviewed exact head 65dac73. The v2 provenance boundary is strict and the CLI routes through it; the focused provenance suite and full local check pass (23 files, 209 tests). Live main is the PR base, and no reviews or inline review comments are present. This material PR cannot be approved yet: Validate PR Governance and CI Gate fail with PRS-INDEPENDENT-REVIEW-001 because there is no approving reviewer other than the author. Required next owner: an independent reviewer should approve this exact head; the pull_request_review trigger will then rerun governance CI.

[athena-omt]

Approved for exact head 65dac73. I independently reviewed the v2 provenance boundary and call paths: strict typed metadata allowlisting, schema-bound redaction evidence, and legacy parsing are coherent. Local exact-head validation passed: tests/provenance.test.ts (18 tests), TypeScript typecheck, build, and git diff --check. No unresolved review threads. Auto-merge is already enabled; governance CI should rerun for this approval.

[pheidon]

Pheidon second-pass approval for exact head c0ca88d. Rechecked the full provenance tree, strict v2 boundary, explicit legacy reader, threat-model scope, credential/redaction tests, and fresh CI after replaying the reviewed changes onto merged main. Validate PR Governance and CI Gate pass on this exact head.