fix(portfolio): bind security cohort to live identities

[saagpatel]

Why now

The natural security lane exposed both cardinality drift and a same-count identity substitution: the installed 11-member truth/receipt still names cross-provider-egress-guard, while current source derives agent-permission-diff-bot. Count-only validation could admit the wrong repositories.

What changed

• Reconcile egress-guard-oss as an alias of the canonical manual-only cross-provider-egress-guard entry instead of a second active project.
• Set the reviewed repo-backed default-attention cohort contract to 11.
• Derive the receipt candidate from current base facts plus prior validated security evidence, before applying the new receipt.
• Require exact, case-sensitive candidate/receipt identity; reject self-promotion, same-count substitution, expansion, contraction, missing repository identity, and contradictory supplementary identities.
• Treat current repository status asymmetrically during candidate derivation: fresh GitHub archived=false may expand membership and force receipt coverage, while archive status cannot remove a candidate before receipt corroboration.
• Preserve prior final membership when its SHA-bound canonical truth kept a repository covered despite contradictory receipt archive evidence; this suppresses only that prior archive fallback and never imports or freezes missing/renamed identities.
• Permit a covered member to leave only on fresh observed Dependabot high/critical resolution, or when both final truth is archived and the fresh receipt independently observed the archive.
• Validate and SHA-bind the prior canonical truth, preserve custom security freshness windows, and serialize the complete build/recheck/multi-file replacement with in-process and OS locks.
• Preserve fail-before-touch authority validation for producer and receipt failures.

Current reviewed cohort

1. saagpatel/agent-permission-diff-bot
2. saagpatel/AIGCCore
3. saagpatel/bridge-db
4. saagpatel/GithubRepoAuditor
5. saagpatel/mcp-trust
6. saagpatel/MCPAudit
7. saagpatel/operant
8. saagpatel/operator-os-explainer
9. saagpatel/portfolio-index
10. saagpatel/PortfolioCommandCenter
11. saagpatel/proof-pr

Verification

• Current no-install local suite: 3212 passed, 7 skipped, 2 warnings.
• Impacted truth/security surface: 268 passed, 1 warning.
• Ruff, AST parsing across 448 Python files, and git diff --check: passed.
• Adversarial regressions cover self-promotion, high-to-zero resolution, contradictory receipt/live archive state, two-cycle loss of live archive status, archive and unarchive transitions, uncovered/audit-only unarchive rejection, live-archive same-count substitution, custom 48-hour continuity, prior-pointer replacement, competing publishers after prior SHA recheck, and fail-before-touch binding rejection.
• Two independent exact-patch reviews: GO for source merge.
• Latest review-fix commit: 50c7df30ae18a14063bfad76546e53e4360a854b.

Live evidence and claim ceiling

This PR is source-ready only. It does not update installed scripts/runtime, regenerate canonical truth or receipts, reload/trigger launchd, or prove a natural scheduled run.

The installed canonical truth was produced by runtime c3646ea and lacks the portable producer.expected_repository field required by base commit 2eaa2bc. Current source correctly rejects that legacy envelope. Runtime activation is therefore NO-GO until the follow-on lane performs a two-phase migration:

1. Pin the canonical runtime to base 2eaa2bc, collect a matching fresh receipt, publish once, and verify portable producer-envelope readback.
2. Pin the merged SHA from this PR, then run controlled candidate-truth -> fresh 11-member receipt -> canonical publication and verify exact identities before waiting for natural scheduler proof.

Do not weaken validation or directly activate this PR against the legacy live truth.

PR #211 overlaps src/portfolio_truth_reconcile.py, src/portfolio_truth_validate.py, and tests/test_portfolio_truth.py and is already conflicting with main. Whichever PR lands second must rebase, resolve, and rerun the complete gate.

[saagpatel]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71ead226c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

Addressed the P1 at exact head 39f1dd8728877170d414c0ceb0c00610d0cb0246.

• Candidate membership is now materialized from current base facts plus prior validated security evidence before the new receipt is applied.
• Fresh observed high/critical resolution and repository archival are explicit one-way departure paths; self-promotion and same-count substitution remain rejected.
• Prior canonical truth is validated, SHA-bound, and rechecked.
• Complete truth publication is serialized across threads/processes; authority failures still occur before filesystem touch.
• Full suite: 3354 passed, 2 skipped, 2 warnings; independent final reviews: GO for source merge.

Runtime activation remains deliberately blocked on the two-phase legacy producer-envelope migration documented in the PR body.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39f1dd8728

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

Addressed the exact-head P1s at b840e5c7b12f2451f670447eedbab3fa2fb39984.

• Current archive status can no longer erase pre-receipt candidate membership.
• Fresh GitHub unarchive status may only expand the candidate and therefore forces receipt coverage; audit fallback cannot reactivate a repo.
• Archive departure now requires both final archived truth and fresh receipt-observed archive evidence, so contradictory live state cannot authorize an unrelated departure.
• Live-archive same-count substitution remains rejected with both identity-diff sides reported.
• Current local gate: 3,211 passed / 7 optional skips; impacted truth/security: 267 passed; Ruff, AST, and diff checks clean; two independent exact-patch reviews GO.

Runtime activation remains blocked on the two-phase legacy producer-envelope migration documented in the PR body.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b840e5c7b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

Addressed the prior-final-membership P1 at 50c7df30ae18a14063bfad76546e53e4360a854b.

• Prior final cohort identities are derived from the same canonical bytes as prior receipt evidence and remain covered by the existing SHA recheck under the publication lock.
• Candidate reconstruction suppresses only a contradicted prior archived=true fallback for an exact identity the prior final truth kept covered.
• It does not union or inject prior identities, so removed, renamed, case-drifted, and controlled candidate transitions remain fail-closed.
• A two-cycle publication regression proves live archived=false can overrule receipt archive on cycle one, then a fresh archive receipt can publish when live status disappears on cycle two.
• Current gate: 3,212 passed / 7 optional skips; impacted truth/security: 268 passed; Ruff, AST, and diff checks clean; two independent exact-patch reviews GO.

Runtime activation remains blocked on the two-phase legacy producer-envelope migration documented in the PR body.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 50c7df30ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".