Skip to content

docs(g01): refresh canary policy evidence #170

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jjangg96 merged 2 commits into from
Nov 13, 2026
Merged

docs(g01): refresh canary policy evidence #170

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
15e12be
docs(g01): refresh canary policy evidence
jjangg96 Nov 13, 2026
233a257
docs(g01): clarify remaining live admission gate
jjangg96 Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions docs/evidence/g01-live-canary.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1098,3 +1098,34 @@ Scale Set cleanup, trusted runtime/isolation/resource qualification, protected
canary configuration, or the separately authorized Linux ARM64/JIT canary.
Issue #1 remains OPEN and Project #2 remains In progress. This Public CI run
did not execute the separately authorized live canary.

### Read-only canary policy recheck — 2026-11-13

An additional `gh api` read-only check found that the private, non-archived
target's default `main` branch reports `protected: false`. Branch-protection and
repository-ruleset reads are unavailable under the repository's current plan;
the API returns the upgrade-to-GitHub-Pro response. No caller-protection policy
was changed, so the checked-in protected-ref predicate remains unsatisfied.

The dedicated organization runner group currently reports selected-repository
visibility, public repositories disabled, and workflow restriction enabled.
Its selected-repository inventory contains exactly one repository, the canary
target, and its runner inventory is empty. The group response's
`selected_workflows` field contains exactly one entry matching the current
caller's full-SHA reusable-callee pin; the caller workflow itself is not the
selected entry. This matches GitHub's documented [runner-group response
shape](https://docs.github.com/en/rest/actions/self-hosted-runner-groups#get-a-self-hosted-runner-group-for-an-organization).
The group reports that its workflow restriction is not read-only. Exact callee
selection is therefore verified, but it does not bind the mutable caller; the
unprotected `main` ref still fails the callee's `github.ref_protected` guard.
The private target's Actions-environment inventory returned 404, so this check
does not establish that an environment is configured or absent.

The current Linux ARM64 canary-runner workflow's run inventory is empty. No
workflow, repository policy, runner group, App installation, runner, Scale Set
or credential was changed, and no workflow was dispatched. Protected-caller
authorization, live job-admission and runner behavior, authenticated production
provenance and trust-root custody, broker-only execution, conditional cleanup,
trusted runtime/isolation/resource qualification, and the separately authorized
live canary remain unresolved. Issue #1 remains OPEN and Project #2 remains In
progress.