fix: close deep-audit safety gaps

.github/workflows/ci.yml

@@ -20,7 +20,6 @@ jobs:
     timeout-minutes: 5
     outputs:
       node_compat: ${{ steps.scope.outputs.node_compat }}
-      windows_authority: ${{ steps.scope.outputs.windows_authority }}
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -34,7 +33,7 @@ jobs:
           node-version: 24
           package-manager-cache: false
 
-      - name: Detect compatibility and Windows Authority scope
+      - name: Detect Node compatibility scope
         id: scope
         shell: bash
         env:
@@ -44,12 +43,13 @@ jobs:
           set -euo pipefail
           if [[ "${EVENT_NAME}" != "pull_request" ]]; then
             echo "node_compat=true" >> "${GITHUB_OUTPUT}"
-            echo "windows_authority=true" >> "${GITHUB_OUTPUT}"
             exit 0
           fi
 
+          TRUSTED_SCOPE="${RUNNER_TEMP}/github-delivery-ci-scope-base.mjs"
+          git show "${BASE_SHA}:scripts/ci-scope.mjs" > "${TRUSTED_SCOPE}"
           git diff --name-only -z "${BASE_SHA}"...HEAD |
-            node scripts/ci-scope.mjs --mode ci >> "${GITHUB_OUTPUT}"
+            node "${TRUSTED_SCOPE}" --mode ci >> "${GITHUB_OUTPUT}"
 
   core:
     name: Node 24 / ubuntu-latest
@@ -111,18 +111,9 @@ jobs:
 
   windows-authority:
     name: Node 24 / windows-latest
-    needs: scope
-    if: always() && (needs.scope.result != 'success' || github.event_name != 'pull_request' || needs.scope.outputs.windows_authority == 'true')
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
-      - name: Fail closed when scope detection failed
-        if: needs.scope.result != 'success'
-        shell: pwsh
-        run: |
-          Write-Error 'Detect CI scope did not complete successfully.'
-          exit 1
-
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/codeql.yml

@@ -16,41 +16,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  csharp_scope:
-    name: Detect C# analysis scope
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      required: ${{ steps.scope.outputs.required }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Set up Node.js 24
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 24
-          package-manager-cache: false
-
-      - name: Detect C#-relevant pull request changes
-        id: scope
-        shell: bash
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          set -euo pipefail
-          if [[ "${EVENT_NAME}" != "pull_request" ]]; then
-            echo "required=true" >> "${GITHUB_OUTPUT}"
-            exit 0
-          fi
-
-          git diff --name-only -z "${BASE_SHA}"...HEAD |
-            node scripts/ci-scope.mjs --mode csharp >> "${GITHUB_OUTPUT}"
-
   analyze:
     name: CodeQL / Analyze (javascript-typescript)
     runs-on: ubuntu-latest
@@ -80,22 +45,13 @@ jobs:
 
   analyze-csharp:
     name: CodeQL / Analyze (csharp)
-    needs: csharp_scope
-    if: always() && (needs.csharp_scope.result != 'success' || github.event_name != 'pull_request' || needs.csharp_scope.outputs.required == 'true')
     runs-on: windows-latest
     timeout-minutes: 30
     permissions:
       contents: read
       packages: read
       security-events: write
     steps:
-      - name: Fail closed when C# scope detection failed
-        if: needs.csharp_scope.result != 'success'
-        shell: pwsh
-        run: |
-          Write-Error 'Detect C# analysis scope did not complete successfully.'
-          exit 1
-
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

CHANGELOG.md

@@ -10,6 +10,9 @@ All notable changes to `github-delivery` are documented here.
 
 - Bumped the package version from `0.8.6` to `0.8.7`.
 - Restricted temporary Windows Authority branch leases to repeated `push_code` batches and tightened classic branch-protection, routing, mutation-boundary, security-policy, and stack portability contracts (PR #297).
+- Windows Authority CI and C# CodeQL now run on every pull request so candidate code cannot scope out its own security-critical lanes; the remaining Node 22 compatibility selector is executed from the pull request base version (PR #299).
+- Review briefs now apply a global model-facing diff-hunk budget while preserving complete structured review scope for deterministic tooling and on-demand inspection (PR #299).
+- Made quiet execution an entrypoint-visible contract: routine rule/skill/workflow loading, file reads, Git/GitHub snapshots, remote fetches, obvious retries, and shell-quoting corrections run without per-tool user-facing narration unless they materially change the plan or expose a blocker (PR #299).
 
 ### Fixed
 
@@ -19,6 +22,10 @@ All notable changes to `github-delivery` are documented here.
 - Bound GitHub, Git, PowerShell, and registry subprocess helpers now copy argv and force a direct spawn (`shell: false`), so library-provided arguments cannot be reconstructed as a shell command (PR #294).
 - Prevented unusual valid Git filenames from hiding sensitive path changes from scoped CI/CodeQL detection, and made required scoped lanes fail closed when their scope producer fails (PR #296).
 - Fail closed when classic branch protection may apply but cannot be proved absent, added GitHub-style classic branch-pattern coverage, restored contextual `make this green` routing, and strengthened dynamic mutation-command boundary checks (PR #297).
+- Redeem trusted authority before the first mutating GitHub command, including autonomous idempotency tag/ref coordination, so a rejected grant cannot leave coordination state behind before the requested mutation (PR #299).
+- Preserve rename/copy source and destination paths with NUL-delimited local branch diff parsing, keep both path generations in review classification, and make every deterministic required probe a first-class pre-open blocker until its canonical structured probe evidence validates against the deterministic trigger files (PR #299).
+- Enforce open stack-parent ordering at the mutation execution boundary before merge authority, and abort orphan-workflow cleanup before deletion when the default-branch generation changed during preflight (PR #299).
+- Protected Codex streaming now bounds repetitive interleaved tool micro-narration separately from tool-emission stalls: three future-action narration intents without execution/state/workflow progress trigger an interrupt, and evidence/read tool starts do not reset that budget (PR #299).
 
 ## [0.8.6] - 2026-08-18
 
@@ -52,7 +59,7 @@ All notable changes to `github-delivery` are documented here.
 
 - Moved the remaining workflow-level `actions: write` permission down to the cleanup job, kept top-level workflow permissions read-only, and added validation that rejects future top-level write scopes while still permitting explicitly allowlisted job-level writes (PR #282).
 - Hardened PR publication identity and retries: exact duplicate detection now binds target repository, head repository/ref, and base; qualified REST head filters prevent same-repository misses; explicit cross-repository `head_repo` identity is supported; and exact owned idempotent retries converge before the broader duplicate preflight (PR #283).
-- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional removal requires an exact approved identity list that is included in trusted `update_pr_body` authority scope (PR #283).
+- Protected existing PR-body screenshots, videos, GitHub uploads, reference-style Markdown images, and other recognized media from accidental body rewrites. Intentional media removal requires an exact approved identity list that is included in trusted `update_pr_body` authority scope (PR #283).
 - Prevented cross-repository closing issues and unsafe display URLs from masquerading as trustworthy same-repository work-item evidence, and tightened open-work fixtures so PR-number normalization and repository boundaries are actually exercised (PR #283).
 
 ## [0.8.2] - 2026-08-17
@@ -562,4 +569,4 @@ All notable changes to `github-delivery` are documented here.
 - Executable offline routing and retained-regression evaluations.
 - Deterministic versioned skill bundles with checksums, installation planning, backups, and restore.
 - Tag-bound GitHub Releases with checksum verification, SPDX SBOMs, and artifact attestations.
-- Dependabot, Dependency Review, CodeQL, Scorecard, and executable repository workflow policy checks.
+- Dependabot, Dependency Review, CodeQL, Scorecard, and executable repository workflow policy checks.

README.md

@@ -100,7 +100,7 @@ The 0.8.6 line adds the major workflow and safety work developed after 0.8.2, pl
 - competing-PR consolidation analysis;
 - conditional head-bound visual review evidence;
 - multi-base backport/port delivery;
-- a substantially leaner GitHub Actions topology with stale-run cancellation and scoped platform lanes;
+- a substantially leaner GitHub Actions topology with stale-run cancellation and unconditional security-critical Windows Authority/C# lanes;
 - fail-closed delivery integrity for moved PR heads, queued/auto-merge outcomes, mutation receipts, and remaining public workflow routing;
 - bounded GitHub and Git subprocesses on review, verdict, CI forensics, ship-gate, runtime, live-fixture, release, and npm helper paths.
 
@@ -162,7 +162,9 @@ Status, open-work, and competing-PR analysis remain read-only. Implementation-on
 
 Routine network-visible issue/PR writes pass through the typed GitHub mutation boundary. Stale-sensitive requests bind expected head state; branch pushes bind repository/remote/branch plus old/new tips; history rewrites use exact force-with-lease semantics rather than bare force.
 
-**Merge is deliberately stricter.** `scripts/merge-pr-driver.mjs` owns settle, final current-head/base/rules/feedback/review-evidence recapture, trusted destructive authority, head-pinned merge execution, and post-merge reconciliation. Generic hand-built merge mutation documents are rejected.
+For trusted high-assurance operations, authority redemption happens before the first mutating GitHub command, including autonomous idempotency coordination refs/tags. A rejected grant therefore cannot leave a coordination write behind before the requested mutation.
+
+**Merge is deliberately stricter.** `scripts/merge-pr-driver.mjs` owns settle, final current-head/base/rules/feedback/review-evidence recapture, trusted destructive authority, head-pinned merge execution, and post-merge reconciliation. The lower mutation execution boundary also rechecks open-PR stack topology and rejects a child merge while its parent PR is still open. Generic hand-built merge mutation documents are rejected.
 
 ### Exact-effect trusted authority
 
@@ -207,6 +209,8 @@ A full review can combine:
 - proactive contract verification appropriate to the changed behavior;
 - conditional **visual evidence** for rendered/UI surfaces.
 
+The pre-open gate treats those deterministic probes as first-class obligations alongside required bug lenses and security surfaces. A probe detected from the branch diff remains blocking until its canonical structured probe-evidence record validates against the deterministic trigger files. Local branch review uses NUL-delimited Git records so renames and unusual valid paths retain both source and destination identity.
+
 ### Safe simplification
 
 Simplification is **explicit-only**. Its goal is lower cognitive load and safer maintenance. **Line count is never the goal**; fewer lines are acceptable only when behavior and clarity improve.
@@ -226,6 +230,7 @@ The final ship decision is one authoritative `ready`, `blocked`, or `unknown` re
 - review decision, stale approvals, last-push requirements, unresolved threads;
 - conflicts, behind state, merge queue / auto-merge state;
 - unknown ruleset/state values failing closed;
+- open stack-parent topology before destructive merge execution;
 - exact-head merge execution and read-only reconciliation after ambiguous write results;
 - partial success when merge succeeded but non-destructive post-merge ceremony did not.
 
@@ -237,7 +242,7 @@ These are intentionally three different concepts.
 
 ### Stacked PRs
 
-A stack is a dependency chain where a child PR targets a parent PR branch. Stack operations discover repository-qualified topology, restack bottom-up, preserve layer ownership, and revalidate every surviving child after an upstream head changes.
+A stack is a dependency chain where a child PR targets a parent PR branch. Stack operations discover repository-qualified topology, restack bottom-up, preserve layer ownership, and revalidate every surviving child after an upstream head changes. The mutation execution boundary independently rejects a merge while the target PR still points at another open PR's head, so merge-order safety does not depend only on workflow prose.
 
 ### Competing PRs
 
@@ -473,24 +478,24 @@ npm run reliability:gate
 
 ### Lean required CI topology
 
-The pull-request CI topology is deliberately asymmetric to avoid repeating the full repository suite across every OS/runtime combination:
+The pull-request CI topology is deliberately asymmetric to avoid repeating the full repository suite across every OS/runtime combination while keeping the security-critical platform lanes unskippable by PR scope logic:
 
 | Required context | PR behavior |
 |---|---|
 | **Node 24 / ubuntu-latest** | Canonical full `npm run check`; then bounded Node 26 syntax/package/unit compatibility on the same workspace |
-| **Node 22 / ubuntu-latest** | Bounded compatibility lane only when runtime-relevant paths change; forced for `main`/live-fixture acceptance |
-| **Node 24 / windows-latest** | Windows Authority restore/build/self-test/publish/install smoke only when Authority/platform-relevant paths change; forced for `main`/live-fixture acceptance |
+| **Node 22 / ubuntu-latest** | Bounded compatibility lane only when runtime-relevant paths change; its path classifier is executed from the PR base version |
+| **Node 24 / windows-latest** | Always runs Windows Authority restore/build/self-test/publish/install smoke on pull requests |
 | **Dependency Review** | Runs on pull requests |
 | **CodeQL / Analyze (javascript-typescript)** | Runs on pull requests |
-| **CodeQL / Analyze (csharp)** | Scoped to Windows Authority/C#-relevant PRs; still runs on `main` and schedules |
+| **CodeQL / Analyze (csharp)** | Always runs on pull requests, plus `main` and schedules |
 
-There are no macOS PR compatibility lanes and no duplicate Architecture Contracts workflow. Superseded CI, CodeQL, and Dependency Review runs are cancelled when a newer commit arrives. Repository-policy verification is daily and orphan-workflow cleanup is weekly.
+There are no macOS PR compatibility lanes and no duplicate Architecture Contracts workflow. Superseded CI, CodeQL, and Dependency Review runs are cancelled when a newer commit arrives. Repository-policy verification is daily and orphan-workflow cleanup is weekly; cleanup pins the default-branch generation before deleting stale workflow histories.
 
-For ordinary runtime-relevant PRs this reduces full `npm run check` executions from **9 to 1**, full unit-suite runtime executions from **9 to 3**, Windows Authority lanes from **2 to 1 when relevant**, and macOS PR jobs from **2 to 0** while retaining Node 22/24/26 compatibility coverage.
+For ordinary runtime-relevant PRs this keeps full `npm run check` executions at **1**, full unit-suite runtime executions at **3**, one Windows Authority lane on every PR, and **0** macOS PR jobs while retaining Node 22/24/26 compatibility coverage and unconditional Windows/C# security coverage.
 
 ### Live lifecycle fixture
 
-The unit/eval suite proves deterministic contracts. An explicitly opted-in fixture repository exercises the real GitHub lifecycle with immutable repository-identity binding before the first mutation. Fixture runs force the scoped Node 22 and Windows compatibility lanes even when normal PR path filtering would skip them.
+The unit/eval suite proves deterministic contracts. An explicitly opted-in fixture repository exercises the real GitHub lifecycle with immutable repository-identity binding before the first mutation. Fixture diffs force the scoped Node 22 compatibility lane; the Windows Authority lane already runs unconditionally.
 
 See [`docs/live-integration.md`](docs/live-integration.md) and [`docs/live-github-integration.md`](docs/live-github-integration.md).
 
@@ -554,4 +559,4 @@ The project intentionally fails closed rather than claiming unsupported coverage
 
 Some workflow directions were informed by public/open-source agent skills and GitHub automation patterns, including concepts from `OutThisLife/brooklyn-skills`. Adapted ideas are rewritten around GitHub Delivery's own evidence, authority, routing, and lifecycle contracts; relevant workflow files include provenance notes where appropriate.
 
-Licensed under the [MIT License](LICENSE).
+Licensed under the [MIT License](LICENSE).

SKILL.md

@@ -104,7 +104,7 @@ persistent `delivery-controller.mjs` checkpoint. Route/phase graph stay locked;
 the controller owns transitions, evidence/retry/resource/no-progress accounting
 and resume. Only phase/state/blocker/required-evidence/execution change is
 progress. Conditional policy extends unchanged context. The controller grants
-no GitHub write authority.
+no GitHub write authority. Run routine deterministic tooling quietly; narrate only material progress or blockers (GD-CORE-009).
 
 ## Mandatory entrypoint behavior
 

references/gate-helpers.md

@@ -185,4 +185,4 @@ For an **unopened** branch, run the pre-open gate instead of `bug-scope.mjs`/`se
 node "<github-delivery>/scripts/pre-open-gate.mjs" OWNER/REPO BASE_REF HEAD_REF
 ```
 
-Exit `0` (`decision: "ready"`) means the branch diff has no required bug/security scope. Exit `1` (`decision: "blocked"`) lists the required bug lenses and security surfaces that must be reviewed (and Confirmed High/Critical findings fixed) before opening. Exit `2` (`decision: "unknown"`) means the branch diff could not be collected completely — never open a PR on unknown. See `references/create-pr-for-issue.md` step C2.
+Exit `0` (`decision: "ready"`) means every deterministic pre-open obligation is cleared. Exit `1` (`decision: "blocked"`) lists remaining bug lenses, security surfaces, and required probes. Lens/surface evidence uses the pre-open `done` / justified `n/a` records; probe evidence uses the canonical structured `clean` / `findings` / `n-a` records and is validated against the deterministic trigger files. Confirmed High/Critical findings must be fixed before opening. Exit `2` (`decision: "unknown"`) means the branch diff could not be collected completely — never open a PR on unknown. See `references/create-pr-for-issue.md` step D.