security: replace blanket inherited secrets in hourly reusable callers

[seonghobae]

Buyer-visible credential-boundary gap

The EgressWeave caller-side least-privilege repair is IMPLEMENTED ON PROTECTED MAIN. This issue remains open because the matching reusable-workflow secret interface is still only present on an unmerged read-only central candidate, not protected central main.

This is a credential-exposure/control-plane assurance boundary, not evidence that any secret leaked.

Fresh protected EgressWeave evidence (2026-08-13)

Protected EgressWeave main is 7faf7a3b8a47980113982914000e724ab6a6cda5.

On that exact protected tree, .github/workflows/hourly-pr-maintenance.yml:

• contains no secrets: inherit;
• maps only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN to fix-review-feedback;
• maps only the same two named credentials to review-recheck-and-merge;
• does not pass NVIDIA_NIM_API_KEY, COPILOT_GITHUB_TOKEN, release/package credentials, or blanket repository/organization secrets through this reusable-workflow boundary;
• preserves enable_auto_merge: false and merge_mode: disabled;
• pins both reusable workflows to immutable central revision 59505c1d89eb7ea816e921b6da38079c736608c2.

Protected tests/test_hourly_opencode_nvidia_contract.py machine-checks this boundary: it rejects secrets: inherit, requires both named mappings exactly twice, rejects NVIDIA_NIM_API_KEY and OPENAI_API_KEY from the review scheduler, and preserves disabled autonomous merge authority.

Fresh protected-main scheduled operational evidence is run 31652432378 (Hourly PR Maintenance, run 133) on exact head 7faf7a3..., completed success. Its referenced_workflows are exactly the pinned pr-review-fix-scheduler.yml@59505c1d... and pr-review-merge-scheduler.yml@59505c1d...; the substantive called jobs fix-review-feedback / dispatch-review-fixes and review-recheck-and-merge / scan-pr-queue both materialized and completed successfully. Optional/non-applicable wait, org-sweep, and closed-PR cancellation paths were skipped and are not promoted into separate evidence.

This proves the EgressWeave caller no longer depends on blanket inheritance merely to materialize and execute the called jobs. It does not promote the pinned central candidate into protected-central authority.

Read-only central dependency

Fresh read-only central state:

• protected .github main: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• central PR #897: open / Ready / mergeable / unmerged;
• exact #897 head: 59505c1d89eb7ea816e921b6da38079c736608c2.

At exact central candidate 59505c1d..., pr-review-fix-scheduler.yml declares the named workflow_call.secrets interface used by this protected EgressWeave caller. Candidate state remains non-authoritative until protected-central integration.

The same central candidate owns the fail-closed Dependency Review repair tracked by EgressWeave #76; aggregate Security Scan green remains non-passing while the actual immutable-pinned Dependency review action is skipped. The separate Strix unavailable/no-report boundary remains tracked by EgressWeave #197 and read-only central .github#891.

RCA / remedy status

First boundary: caller-to-reusable-workflow secret transport.

Historical root cause: the reusable scheduler interface relied on blanket inheritance while downstream paths consumed optional organization mutation credentials, preventing the leaf repository from expressing a minimal explicit caller contract.

Selected remedy: central reusable workflows publish a minimal named secret interface; EgressWeave maps only those names on an immutable pin and protects the caller contract with deterministic tests.

The EgressWeave half is implemented and freshly re-proven on protected main. The remaining root-cause closure belongs to protected-central integration and a protected consumer run against that accepted central authority, not another EgressWeave source mutation.

Rejected alternatives remain:

1. restore secrets: inherit — widens credential exposure and regresses protected-main policy;
2. remove all credentials without respecting the called-workflow contract — can silently disable intended bounded dispatch;
3. copy central workflows into EgressWeave or add another credentialed writer — duplicate/wrong-layer authority;
4. infer an active central PR as protected authority — governance-invalid evidence;
5. churn the clean EgressWeave caller merely to manufacture another external run — no root-cause change.

Acceptance criteria

• Revalidate the caller/callee credential boundary and identify the named credentials actually consumed by the reusable scheduler path.
• Add an EgressWeave regression rejecting blanket secrets: inherit on the maintenance caller.
• Map only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN; do not expose model, release/package, or unrelated secrets.
• Preserve enable_auto_merge: false, merge_mode: disabled, immutable central identity, reviewer separation, and least-privilege caller permissions.
• Integrate the EgressWeave caller-side repair to protected main.
• Re-prove on current protected main 7faf7a3... that called reusable jobs materialize and execute under the named-secret caller mapping without restoring autonomous merge authority.
• Integrate an accepted protected-central reusable-workflow revision that declares and preserves the minimal named workflow_call.secrets contract; active-PR state is non-passing authority.
• After that central integration, refresh EgressWeave to an accepted protected-central immutable pin if identity changes and re-run the exact caller contract tests.
• Add/prove the accepted negative-control behavior for missing/unavailable named credentials without secret-value disclosure.
• Obtain protected EgressWeave scheduled/manual consumer evidence against the protected-central contract and revalidate exact source/ref/workflow identities.
• Preserve the separately governed fail-closed Dependency Review/Strix gates; named-secret success does not substitute for those evidence channels.
• Close only after the protected-central contract and protected EgressWeave consumer path are proven end to end.

Writer discipline / non-goals

.github remains read-only. Do not create a competing reusable workflow, restore blanket inheritance, invent/rotate credentials, use COPILOT_GITHUB_TOKEN, grant autonomous merge/publish authority, or churn an unchanged clean caller merely to retrigger external behavior.