Live second-party proofs: fork PR from another account, private book in another org

[clintecker]

Remaining live proofs

Issue #37 and automated CI-posture tests proved the boundary as far as one repository owner can. Two outcomes still require an independent GitHub identity/organization:

1. Public fork pull request: open a fork PR from another account and prove its code runs read-only without repository secrets, publish/deploy authority, or an unsafe pull_request_target path.
2. Private cross-organization consumer: create a private book in another organization, consume clintecker/press@v1, pull the now-public ghcr.io/clintecker/press-toolchain without a package grant or cross-repository secret, and complete the full reusable workflow.

The toolchain image became public in #161. Earlier comments describing a private image and per-repository package grant are historical and are superseded by this body.

Invariants

• Untrusted fork code receives no write token, secret, OIDC, Pages, package-publish, or release authority.
• A private book outside the owner account can consume the public action/toolchain using only its own ordinary GITHUB_TOKEN.
• The installed press comes from the action checkout at the exact requested ref; it is never replaced by pip-from-git.
• The workflow and container identities in the live receipt match the requested immutable release contract.
• Evidence is redacted and contains no book content, secret, private URL, or reusable token.

Acceptance criteria

• Record links and redacted receipts for both independent runs.
• Include negative evidence: the fork cannot publish/deploy and the private consumer needs no package grant.
• Run from an immutable three-part tag and separately confirm floating-major behavior.
• Link results into the release trust chain and the public installation/architecture docs.
• Repeat after any material token-permission, action-install, or package-visibility change.

Links

• Completed same-owner boundary proof #37
• Public toolchain boundary #161
• Composite action
• Reusable workflow
• Installation guide
• Release architecture
• Immutable dependency identity #194

[clintecker]

Grouped into native milestone v1.12 as the remaining L7 live second-party evidence. #37 is the completed same-account boundary proof; release-chain issue #97 should consume both records.

[clintecker]

Accumulated-trust navigation

• Program sequence: v1.12 — Trust foundations → v1.13 — Adversarial artifact proof → v1.14 — Accumulated delivery trust
• Foundation anchors: #78 pytest/selftest harness, #79 invariant ledger, #80 collection enforcement, #82 deterministic adapters, #83 test factories
• Proof and delivery anchors: #88 damage operators, #91 real-tool integration, #93 trust receipts, #94 layered CI, #97 release proof
• Repository contracts: architecture, generated artifact reference, contributor guide

Specific prerequisites and acceptance criteria remain in the issue body; milestone descriptions provide phase-level entry points.

[clintecker]

What the two live proofs require, and how to run them

These genuinely need a second GitHub identity, so they are left for a human with a second account/org. The mechanical posture they would exercise is now proven automatically in tests/test_ci_posture.py (no pull_request_target, every workflow least-privilege), so a regression that would break the live proof is caught here without a second party.

1. Fork PR from another account

1. From a second GitHub account (not clintecker), fork clintecker/press.
2. Open a PR from the fork that touches a file the CI runs against (e.g. a docs change).
3. Confirm on the PR's checks:
   • The workflows run with a read-only GITHUB_TOKEN (no write to contents/packages).
   • No repository secret is exposed to the fork's code (the toolchain login step must not run, or must fail closed, for a fork PR).
   • No id-token/Pages write is granted to the fork run.
4. Expected: the PR's build runs read-only and cannot publish, deploy, or push.

2. Private book in another org

1. In a second org, create a private book repo (press new, scaffolded).
2. Grant that repo read access to the private press-toolchain package (Manage Actions access on the package), the one-time grant documented in CLAUDE.md.
3. Point its workflow at clintecker/press/.github/workflows/build.yml@v1.
4. Push; expected: the build pulls the private toolchain image via the org's grant and completes the gauntlet. Without the grant, it must die at "Initialize containers" with the documented pull denial.

Recorded amendment (from #37)

"Public books without owner-specific grants" was amended by design: the toolchain image stays private, so the one-time package grant applies to every consumer regardless of book visibility. The action itself needs no grant. Flipping the image public would dissolve that criterion and is Clint's call.