Fix live GitHub security reconciliation

[saagpatel]

What

Repair the bounded GitHub security collector and PortfolioTruth overlay so the current nine-repository cohort carries fresh provider evidence or exact fail-closed reason codes. The receipt now also binds the live default branch and head SHA observed in the same collection pass.

Why

The scheduled collector was failing before refresh because its local wrapper pinned an obsolete producer commit. PortfolioTruth then accepted a newly generated wrapper around an aging security receipt, leaving the entire cohort stale. The receipt also lacked normalized reason codes, explicit completed-zero semantics, and same-pass remote branch/head evidence.

Review Of What Was Built

• Add normalized provider reason_code, completed, and zero_findings fields while retaining GitHubSecurityCoverageReceiptV1 read compatibility.
• Emit fail-closed credential outcomes even when no token is available.
• Collect each cohort repository default branch, head SHA, and archived state through one bounded GraphQL request.
• Bind receipt consumption to the validated GithubRepoAuditor producer commit.
• Thread remote observations, transient-error reconciliation, and explicit zero-finding rollups into PortfolioTruth 0.11.0 without changing existing fields.
• Add fixtures and coverage for auth failure, partial coverage, staleness, zero findings, malformed responses, rate limits, transient failures, producer mismatch, and deterministic output.

Cleanup Review

Kept the existing receipt and PortfolioTruth schema versions because all additions are backward-compatible. No GitHub settings, alerts, secrets, schedules, issues, or unrelated repository state were changed. The separate local wrapper-pin repair is intentionally deferred until this code is merged and has a final protected-branch SHA.

Verification Summary

• Focused suite: 115 passed.
• Full suite: 2,951 passed, 2 skipped.
• Ruff 0.15.16: all src/ and tests/ checks passed; CI is bounded below Ruff 0.16 to avoid silently adopting an expanded rule contract.
• GitHub CI on 4387067: Python 3.11, Python 3.12, CodeQL Analyze, and CodeQL all passed.
• Diff hygiene and staged secret-pattern check passed.
• Independent local Codex Light-reasoning exact-diff review: no merge-relevant findings.
• GitHub Codex re-review on 4387067: no major issues; all four earlier review findings were repaired and resolved.
• Fresh authenticated pass on 4387067: 9/9 Dependabot observed, 5/9 code scanning observed, 6/9 secret scanning observed, 9/9 remote default branches and heads observed; 28 requests, no stop reason.
• PortfolioTruth live readback: cohort complete=5, partial=4, stale=0, unknown=0; completed zeros are explicit, unavailable providers remain non-zero partial outcomes, and remote outcome counts reconcile to the project denominator.

Shipped Summary

The branch produces a current, provenance-bound nine-repository security receipt and a PortfolioTruth snapshot that distinguishes completed zero findings from missing, partial, stale, malformed, rate-limited, transient, or unauthenticated evidence.

Next Phase

The protected branch requires one approving review. After an eligible independent reviewer approves, merge through the governed protected-branch path. Then pin the canonical automation checkout and its sole reviewed wrapper contract to the merge SHA, remove the duplicate stale collector pin, run a controlled canonical refresh, and verify the published PortfolioTruth artifact from main.

Remaining Roadmap

Independent GitHub approval, governed merge, canonical wrapper reconciliation, and current PortfolioTruth readback are the remaining delivery steps for this repair.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 60deba9c5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Addressed the prior archived-lifecycle finding on commit 01dab51: live github_api status remains authoritative, while the fresh receipt now supplies archived state when only stale audit-report status is available. Added precedence regression coverage. Also bounded CI Ruff below 0.16 after the runner pulled an expanded unreviewed ruleset.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01dab51ccd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Addressed both 01dab51 re-review findings in 524ea4a: lifecycle status bypasses the response cache, and fresh partial remote observations retain archived authority. Added observed/partial plus uncached-loader regression coverage; focused suite is 115 passed and Ruff 0.15 is clean.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 524ea4a790

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Re-review head 4387067 after adding transient_error to remote coverage counts and pinning full count reconciliation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 4387067a4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".