feat(ticket-048): publish github event acquisition adapter without env fallbacks

[tom-sapletta-com]

Ticket: ticket-048
Correlation ID: todo2code-pr-66-ticket-048

Republishes ticket-047's GitHub acquisition adapter through a route CI governance accepts, and fixes the defect that made it unpublishable.

Why the previous attempt failed

PR #64 was rejected for three independent reasons, none of which make governance could show — that command compares the working tree to HEAD, while CI compares base..head:

Blocker	Cause
GOV-INTENT-003	intent.json and the implementation landed in one commit; the plan must exist in a strictly earlier commit
GOV-TICKET-001	ticket-047 reached DONE before publication, and a closed ticket holds no authority over implementation paths
unownable path	the .env.example follow-up touches a path no workstream owns, and .governance/manifest.json is hash-locked to the pinned upstream standard

The fix

The third blocker had a cause inside the adapter: scripts/github-event-log.mjs fell back to process.env.GITHUB_EVENT_PATH and process.env.GITHUB_REPOSITORY. verify:env scans scripts/** and turns every process.env read into an .env.example requirement — so an acquisition boundary that reads the environment cannot be published in this repository at all.

Both fallbacks are removed. This is a better boundary regardless of governance: a bounded acquisition step should take its input explicitly rather than inherit ambient process state. Input now resolves only from --event-path, --repository, or the payload's own repository.full_name, and a missing repository names the flag.

The other two blockers are addressed structurally: the branch is cut from the protected base (so .env.example never enters the diff), the plan sits in commit b82e10a and the implementation in 2a25976, and ticket-048 stays IN_PROGRESS / VALIDATION until this PR merges — not DONE beforehand, which is exactly what stranded ticket-047.

Changes

• scripts/github-event-log.mjs — no process.env reads; flags required
• test/workflow-validation.test.ts — new case sets both variables in the child environment and asserts the adapter fails closed, writes no output file, and never echoes the ambient repository value
• docs/EVENT_LOG_DSL.md — required flags, deliberate absence of environment reads, and why that constraint exists
• test/fixtures/event-log/v1/github-event-payloads.json — carried across unchanged
• project/ticket-047/** — historical record carried across verbatim, including its explicit note that it never obtained Koru or Validator approval

.env.example, .governance/**, .github/workflows/** and src/** are untouched.

Verification

• project/governance-check.sh --actor ci --base b8392f7 --head 2a25976 — GOV-PASS, the check PR feat(ticket-047): add github event acquisition event log adapter #64 could not pass
• make governance — GOV-PASS (0 errors, 0 warnings)
• make verify — 402 tests, 401 pass, 1 skip, 0 fail
• npm run verify:env — passes with .env.example byte-identical to origin/main
• make docker-smoke — PASS
• git diff --check — clean

Known gap

CHANGELOG.md gets no entry: like .env.example, it is owned by no workstream, so no ticket can edit it. That is the same trap this PR removes for .env.example, and it remains open for a future governance ticket.

🤖 Generated with Claude Code

[tom-sapletta-com]

Added 95a4d91 after a pre-review audit.

Defect found in the carried-over ticket-047 code: every emitted event recorded SOURCE "github-api", but the adapter never calls the API — it reads a payload delivered by GitHub Actions, and intent.json lists API polling as a non-goal. Recording provenance the producer does not have contradicts the contract's own rule that missing knowledge is never guessed.

All four mappings now record SOURCE "github-actions", a value already established in the ticket-045 golden fixture, and the ambient-environment case asserts it on every emitted event. AC-04 was reworded to state this deviation from ticket-047 rather than claim identical behavior.

Also audited the diff for secret-shaped literals, since the Validator rejected #62 for a token= pattern. None present: the negative fixture uses a plainly descriptive string.

Re-verified at 95a4d91: CI-equivalent governance GOV-PASS, make verify 402 tests / 401 pass / 0 fail, verify:env passes with .env.example byte-identical to the base, docker-smoke PASS, and the documented invocation checked end-to-end against a real payload.

[tom-sapletta-com]

Autonomy path (validator)

Root cause of no bot review: scan-direct is not on main yet — it lives in subactor/validator-agent#8. Repo variables DIRECT_PR_SCAN_ENABLED / DIRECT_PR_SCAN_CONFIG alone cannot trigger reviews until that job lands and semcod/todo2code is in the matrix.

Actions taken:

1. Confirmed variables are set and complete (including todo2code checks on main).
2. Added semcod/todo2code to the scan matrix + config on validator-agent PR fix(linker): restore raw similarity scoring #8 (8cf40bf).
3. Dispatched direct-pr dry-run for this PR at head 95a4d91e94862b9d745422341aceb8368e0a0cae (ticket-048 / correlation todo2code-pr-66-ticket-048). Live approval follows if dry-run is clean.

Trust root preserved: reviewer is still outside the reviewed repository; todo2code never triggers its own approval.

[tom-sapletta-com]

Autonomy status (automated)

Item	State
Head	c7ce179
Product (local)	build + acquisition tests green
koru / code-review	success on this head
verify / Java	still queued — GitHub Actions major_outage
Validator App review	none yet (correct: requires green required checks)
Merge	BLOCKED on GOV-APPROVAL + incomplete checks

Do not push further commits while freeze is pending.

When Actions recovers, operators should run:

~/github/subactor/validator-agent/bin/dispatch-direct-pr.sh \
  --owner semcod --name todo2code --pr 66 --ticket ticket-048 \
  --wait-checks --watch

Diagnosis probe: publication.gate in subactor/twin-probes (see docs/PUBLICATION_PROBE.md / docs/ECOSYSTEM.md).