[Pigbibi]

AI assistance

Cursor Auto (Composer). Continues M03 under owner t1394/t1401 bounded fix after independent FAIL on prior head. No merge authorization; no self-approval.

What changed

1. Lookup-channel fix (vars + mask-before-export; no Variables REST).
2. Offline remediation Cards A/B/C; B0 caller-scope semantics; B1 vs Card C staging; D3 org-vars residual documented as operational-only.
3. Fail-closed discovery classifier (binding≠effective; conditions/deny/PAB/inheritance → UNKNOWN).
4. D1 (this head): Removed live Environment mapping digests, numeric Environment settings path, and numeric Actions run id from the tip of docs/tests/workflow comments. Public text uses presence/absence + private-operator verification language only. Earlier tip commits still contain those fingerprints in git history — not claimed scrubbed.
5. D2 (this head): SUPPORTED_TRUSTED_PROVENANCE_KINDS is empty; self-attested booleans / fixture packs / forged provenance cannot reach accepted. One-sided resource/hash → reject. Missing resource/hash/time/provenance → unknown. Structural tests ≠ runtime IAM proof.

How verified (offline — not CLEAN / not merge acceptance)

Head b013020:

PYTHONPATH=. uv run --no-sync python -m pytest -q \
  tests/test_paper_executor_grant.py tests/test_paper_iam_discovery_evidence.py
# 60 passed

PYTHONPATH=. uv run --no-sync python -m pytest -q tests/test_paper_scheduler_get_iam.py
# 103 passed

uv run --no-sync ruff check --exclude external \
  scripts/paper_executor_grant.py scripts/paper_iam_discovery_evidence.py \
  tests/test_paper_executor_grant.py tests/test_paper_iam_discovery_evidence.py
# clean
python3 scripts/check_style.py   # 0 blocking

Prior 55+103 green did not close D1/D2.

Risk

risk:high. Draft only. No GCP GET, IAM/vars/Secrets writes, token mint, workflow_dispatch, Environment approval, deploy, PAPER, merge, labels, review requests, or PR review comments from this agent.

Residuals for the same independent reviewer

• Historical exposure of fingerprints remains in earlier commits on this branch (no force-push / history rewrite)
• D3 org-only vars still operational-only (not technically enforced)
• Official gates: risk-gate FAILURE; ai-review PENDING; labels empty; reviews none
• Runtime IAM / WIF / bootstrap presence still unknown
• accepted unreachable until a supported trusted provenance kind is owner-wired

Artifacts: docs/iam/paper-executor-grant-remediation.md, scripts/paper_iam_discovery_evidence.py

  

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T13:20:37.516151Z	b013020	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-07T13:23:51.204574Z	b013020	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0130200ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mask mappings before binding them to the first step environment

When any mapping is populated, this first step exposes its value in the Actions log before the JavaScript can mask it: the runner prints the step environment during preparation, before executing the action. Values from vars are not automatically secret-masked, and the later core.setSecret() calls cannot redact output already written. This leaks project IDs, service-account emails and the WIF provider even when a subsequent blank mapping stops authentication. The offline harness only checks masking before export, so it misses this runner-generated disclosure. Use an ingestion mechanism that does not place unmasked mappings in the initial step details, preserving the public-resource boundary in AGENTS.md.

AGENTS.md reference: AGENTS.md:L81-L83

Useful? React with 👍 / 👎.