feat(api): bind org .github workflows as CI/review/security only

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `tepp_api` org-central `.github` reusable-workflow bindings: CI/review/security authority only, fail-closed table-access and Copilot/review-agent secret refusal, and Check conclusions that cannot promote scientific or implemented-main claims (ADR 0011; no new migration).
 - `membership_core` estimation rows: one document emits every active membership at an event time, recovered weights are scored with computed RMSE, and collapsing a known multiple-membership set into a single independent row is refused (atomistic fallacy).
 - `persistence_postgres` typed membership assignment (migration `0006`): `entity_record`, `project_record`, and `text_segment` plus exactly-one observed-unit and target constraints that replace the polymorphic `membership_target_id` stub, with SQL insert/lookup, fail-closed inverted-window and backslash-label refusal, and live proof that one document persists two entity memberships and one project membership.
 - Actions workflow fleet auditor (`scripts/actions_workflow_fleet.py`): paginated registry inventory bound to the exact default-branch SHA/tree, classification of present/orphan/disabled/GitHub-dynamic identities, and fail-closed orphan disable that confirms GitHub's official `disabled_manually` state.

DOCUMENTATION.md

@@ -11,6 +11,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Modular/API integration contract | [`docs/API_CONTRACT.md`](docs/API_CONTRACT.md) |
 | naruon modular consumer contract | [`docs/connectors/naruon-artifact-consumer.md`](docs/connectors/naruon-artifact-consumer.md) |
 | contextual-orchestrator interpretation port | [`docs/connectors/contextual-orchestrator-interpretation-port.md`](docs/connectors/contextual-orchestrator-interpretation-port.md) |
+| org-central `.github` control plane | [`docs/connectors/org-github-control-plane.md`](docs/connectors/org-github-control-plane.md) |
 | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) |
 | Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) |
 | Security policy | [`SECURITY.md`](SECURITY.md) |

crates/membership_core/src/network.rs

@@ -88,7 +88,9 @@ impl MembershipNetwork {
         self.assignments
             .iter()
             .copied()
-            .filter(|assignment| assignment.member_id() == member_id && assignment.is_active_at(instant))
+            .filter(|assignment| {
+                assignment.member_id() == member_id && assignment.is_active_at(instant)
+            })
             .collect()
     }
 
@@ -133,7 +135,12 @@ impl EstimationMembershipRow {
     /// Copy the scientifically relevant fields from one assignment.
     #[must_use]
     pub fn from_assignment(assignment: MembershipAssignment) -> Self {
-        Self { member_id: assignment.member_id(), group_id: assignment.group_id(), role: assignment.role(), weight: assignment.weight().value() }
+        Self {
+            member_id: assignment.member_id(),
+            group_id: assignment.group_id(),
+            role: assignment.role(),
+            weight: assignment.weight().value(),
+        }
     }
 
     /// Member identity on this row.
@@ -235,6 +242,9 @@ mod tests {
         assert!(network.active_memberships_for(other, during).is_empty());
         let active = network.active_memberships_for(member, during);
         assert_eq!(active.len(), 1);
+        assert_eq!(network.active_group_multiplicity(member, during), 1);
+        let active_weights = network.active_weight_by_role(member, during);
+        assert_eq!(active_weights.get(&MembershipRole::Template), Some(&1.0));
         assert_eq!(
             active[0].validity().certainty(),
             temporal_core::TemporalCertainty::Bounded
@@ -245,7 +255,46 @@ mod tests {
         assert!(network.active_weight_by_role(other, during).is_empty());
         let rows = network.estimation_rows_at(member, during).expect("one row");
         assert_eq!(rows.len(), 1);
+        assert_eq!(
+            network.estimation_rows_at(other, during),
+            Err(MembershipError::InvalidWirePayload)
+        );
+        assert_eq!(
+            network.insert(active[0]),
+            Err(MembershipError::DuplicateMembershipAssignment)
+        );
+        network
+            .insert(
+                MembershipAssignment::new(
+                    other,
+                    GroupId::new(),
+                    MembershipRole::Project,
+                    MembershipWeight::full().expect("full"),
+                    start,
+                    end,
+                )
+                .expect("other assignment"),
+            )
+            .expect("other insert");
         super::refuse_atomistic_collapse(&rows, 1).expect("single membership");
+        assert_eq!(
+            super::refuse_atomistic_collapse(&[], 1),
+            Err(MembershipError::InvalidWirePayload)
+        );
+        assert_eq!(
+            super::refuse_atomistic_collapse(&rows, 2),
+            Err(MembershipError::AtomisticCollapseRefused)
+        );
+        let mut mixed_rows = rows.clone();
+        mixed_rows.extend(
+            network
+                .estimation_rows_at(other, during)
+                .expect("other row"),
+        );
+        assert_eq!(
+            super::refuse_atomistic_collapse(&mixed_rows, 2),
+            Err(MembershipError::InvalidWirePayload)
+        );
         assert_eq!(rows[0].member_id(), member);
         assert_eq!(rows[0].group_id(), group);
         assert_eq!(rows[0].role(), MembershipRole::Template);

crates/membership_core/tests/atomistic_collapse_structure_contract.rs

@@ -10,11 +10,7 @@ fn event_time(value: &str) -> EventTime {
     EventTime::parse_rfc3339(value).expect("event time")
 }
 
-fn assignment(
-    member: MemberId,
-    group: GroupId,
-    role: MembershipRole,
-) -> MembershipAssignment {
+fn assignment(member: MemberId, group: GroupId, role: MembershipRole) -> MembershipAssignment {
     MembershipAssignment::new(
         member,
         group,

crates/tepp_api/src/lib.rs

@@ -11,6 +11,7 @@ mod authorization;
 mod envelope;
 mod error;
 mod export;
+mod org_github;
 mod wire;
 
 /// Analysis-run contract version constant.
@@ -46,3 +47,19 @@ pub use authorization::ExportAuthorizationRequest;
 pub use authorization::authorize_export;
 /// Fail closed when an export decision is denied.
 pub use authorization::require_export_allowed;
+/// Org reusable-workflow contract version.
+pub use org_github::ORG_GITHUB_WORKFLOW_CONTRACT_VERSION;
+/// Organization control-plane repository identity.
+pub use org_github::ORG_GITHUB_WORKFLOW_OWNER;
+/// Fail-closed org reusable-workflow binding.
+pub use org_github::OrgGithubWorkflowBinding;
+/// Authority an org reusable workflow may hold.
+pub use org_github::OrgWorkflowAuthority;
+/// Bind an org reusable workflow as CI/review/security only.
+pub use org_github::bind_org_github_workflow;
+/// Check conclusions never promote scientific claims.
+pub use org_github::refuse_check_conclusion_as_scientific_claim;
+/// Refuse Copilot, GitHub, or review-agent secret names.
+pub use org_github::refuse_org_workflow_secret;
+/// Org workflows never receive application-table access.
+pub use org_github::refuse_org_workflow_table_access;