ci: org migration (ernestprovo23 -> DataScience-EngineeringExperts) + workflow hardening

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,7 +8,7 @@ body:
         ⚠️ **Do not report security vulnerabilities here.** If this is a way to
         bypass a control mcp-warden claims to enforce (drift slips through, a real
         secret is emitted unredacted, a poisoned result evades the block tier),
-        report it privately per [SECURITY.md](https://github.com/ernestprovo23/mcp-warden/blob/main/SECURITY.md).
+        report it privately per [SECURITY.md](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/SECURITY.md).
   - type: checkboxes
     id: prechecks
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: 🔒 Report a security vulnerability
-    url: https://github.com/ernestprovo23/mcp-warden/security/advisories/new
+    url: https://github.com/DataScience-EngineeringExperts/mcp-warden/security/advisories/new
     about: "Security issues must be reported privately — do NOT open a public issue. See SECURITY.md."
   - name: 📖 Documentation & threat model
-    url: https://github.com/ernestprovo23/mcp-warden/tree/main/docs
+    url: https://github.com/DataScience-EngineeringExperts/mcp-warden/tree/main/docs
     about: "Read the design specs and threat model before filing — some behaviors are explicitly out of scope."

.github/dependabot.yml

@@ -22,3 +22,8 @@ updates:
       - "ci"
     commit-message:
       prefix: "ci"
+    # Batch all github-actions bumps into a single PR to reduce CI churn.
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/action-test.yml

@@ -22,6 +22,15 @@ on:
       - "tests/fixtures/**"
       - ".github/workflows/action-test.yml"
 
+# Least-privilege by default; the action-upload-sarif job widens scope locally
+# (security-events: write) for the real SARIF upload path.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # --------------------------------------------------------------------------
   # Matrix job: pass path + blocking proof on ubuntu / macos / windows.

.github/workflows/deps-locked.yml

@@ -24,6 +24,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   deps-locked:
     name: Hash-locked dev/CI install

.github/workflows/examples.yml

@@ -16,6 +16,14 @@ on:
   pull_request:
     branches: [main]
 
+# Least-privilege: both jobs only read the repo.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # --------------------------------------------------------------------------
   # Job 1: YAML-lint the example workflows.

.github/workflows/integrity-gate.yml

@@ -6,6 +6,15 @@ on:
   pull_request:
     branches: [main]
 
+# Least-privilege by default; the sigstore-e2e job widens scope locally
+# (id-token: write) for ambient-OIDC signing.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # --------------------------------------------------------------------------
   # Job 1: pytest suite

.github/workflows/release.yml

@@ -101,7 +101,7 @@ jobs:
   # No API token, no stored secret: pypa/gh-action-pypi-publish mints a short-lived
   # OIDC token from this job's `id-token: write` and exchanges it for a PyPI upload
   # token. PyPI must have a Trusted Publisher (pending or active) for `mcp-warden-cli`
-  # pointing at owner=ernestprovo23, repo=mcp-warden, workflow=release.yml — see
+  # pointing at owner=DataScience-EngineeringExperts, repo=mcp-warden, workflow=release.yml — see
   # RELEASING.md. Until that exists, this job fails CLOSED (publish denied), it
   # never falls back to anything insecure.
   #
@@ -197,7 +197,7 @@ jobs:
           # Self-check: verify what we just signed against THIS workflow's own
           # identity so a broken run never publishes a bad bundle.
           verify: true
-          verify-cert-identity: "https://github.com/ernestprovo23/mcp-warden/.github/workflows/release.yml@${{ github.ref }}"
+          verify-cert-identity: "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/release.yml@${{ github.ref }}"
           verify-oidc-issuer: "https://token.actions.githubusercontent.com"
           # release-signing-artifacts defaults to true: on a release event the
           # .sigstore bundles are attached to the Release assets automatically.

.github/workflows/sigstore-fixture.yml

@@ -4,7 +4,7 @@
 # !!! NEVER RENAME OR MOVE THIS FILE !!!
 #
 # The committed offline fixture's signer identity is PINNED to this exact path:
-#     https://github.com/ernestprovo23/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main
+#     https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/sigstore-fixture.yml@refs/heads/main
 # (issuer https://token.actions.githubusercontent.com). The offline-fixture test
 # (tests/test_signing.py::test_offline_fixture_verifies_when_present) and
 # docs/SIGNING.md both hard-code this path. Renaming/moving this file changes the
@@ -63,7 +63,7 @@ jobs:
             --lock fixture-out/warden.lock \
             --verify \
             --certificate-identity \
-              "https://github.com/ernestprovo23/mcp-warden/.github/workflows/sigstore-fixture.yml@${GITHUB_REF}" \
+              "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/sigstore-fixture.yml@${GITHUB_REF}" \
             --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
 
       - name: Upload signed fixture (lock + bundle)

CHANGELOG.md

@@ -146,6 +146,6 @@ v1-strong foundation. Highlights of the 0.3.0 → 1.0.0 arc:
   declared surface, RFC 8785 (JCS) + SHA-256 canonicalization, SARIF output, and a live
   integrity-gate workflow with committed `clean.warden.lock`.
 
-[Unreleased]: https://github.com/ernestprovo23/mcp-warden/compare/v1.0.1...HEAD
-[1.0.1]: https://github.com/ernestprovo23/mcp-warden/compare/v1.0.0...v1.0.1
-[1.0.0]: https://github.com/ernestprovo23/mcp-warden/releases/tag/v1.0.0
+[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.1...HEAD
+[1.0.1]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/releases/tag/v1.0.0

DOCUMENTATION_INDEX.md

@@ -17,7 +17,7 @@ describe and visualize the implementation that satisfies that contract.
 ## GitHub Action (`action.yml` — Issue #18)
 
 The composite reusable action is the primary delivery vehicle for the `check` gate.
-Consumers pin `ernestprovo23/mcp-warden@<tag>` and get a zero-copy-paste integrity
+Consumers pin `DataScience-EngineeringExperts/mcp-warden@<tag>` and get a zero-copy-paste integrity
 gate with hash-locked supply-chain, SARIF upload, and cross-OS support.
 
 | Artifact | Purpose |

README.md

@@ -1,10 +1,10 @@
 # mcp-warden
 
-[![CI](https://github.com/ernestprovo23/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/ernestprovo23/mcp-warden/actions/workflows/integrity-gate.yml)
+[![CI](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml/badge.svg)](https://github.com/DataScience-EngineeringExperts/mcp-warden/actions/workflows/integrity-gate.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
-[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-mcp--warden-2088FF?logo=githubactions&logoColor=white)](https://github.com/ernestprovo23/mcp-warden/blob/main/action.yml)
-[![Latest release](https://img.shields.io/github/v/release/ernestprovo23/mcp-warden?display_name=tag&sort=semver)](https://github.com/ernestprovo23/mcp-warden/releases)
+[![GitHub Action](https://img.shields.io/badge/GitHub%20Action-mcp--warden-2088FF?logo=githubactions&logoColor=white)](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/action.yml)
+[![Latest release](https://img.shields.io/github/v/release/DataScience-EngineeringExperts/mcp-warden?display_name=tag&sort=semver)](https://github.com/DataScience-EngineeringExperts/mcp-warden/releases)
 
 **mcp-warden is the lockfile and CI gate for stdio-transport MCP servers: it pins
 an MCP server's declared tool/resource/prompt surface into a signed `warden.lock`,
@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ernestprovo23/mcp-warden@v0
+      - uses: DataScience-EngineeringExperts/mcp-warden@v0
         with:
           server-cmd: "node ./build/index.js"
           lock: "warden.lock"
@@ -107,7 +107,7 @@ mcp-warden does not replace a scanner or a gateway — it adds the missing **dri
 gate**: a signed baseline plus a deterministic CI check that the surface you
 approved is the surface you still run. For the full, sourced breakdown of how
 these layers complement each other and when to use which, see the
-[**comparison page**](https://ernestprovo23.github.io/mcp-warden/comparison/)
+[**comparison page**](https://datascience-engineeringexperts.github.io/mcp-warden/comparison/)
 on the docs site.
 
 ---
@@ -221,7 +221,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ernestprovo23/mcp-warden@v0
+      - uses: DataScience-EngineeringExperts/mcp-warden@v0
         with:
           server-cmd: "node ./build/index.js"
           lock: "warden.lock"
@@ -324,7 +324,7 @@ Add this to your `.pre-commit-config.yaml` (a complete, copy-pasteable example):
 
 ```yaml
 repos:
-  - repo: https://github.com/ernestprovo23/mcp-warden
+  - repo: https://github.com/DataScience-EngineeringExperts/mcp-warden
     rev: v1.0.1                       # pin to a release tag (supply-chain hygiene)
     hooks:
       - id: mcp-warden-check

RELEASING.md

@@ -8,7 +8,7 @@ Two names matter and they are deliberately different:
 |-------|-------|
 | PyPI distribution name (what `pip install` uses) | `mcp-warden-cli` |
 | CLI command (what users type) | `mcp-warden` |
-| GitHub repository | `ernestprovo23/mcp-warden` |
+| GitHub repository | `DataScience-EngineeringExperts/mcp-warden` |
 
 Install is therefore `pip install mcp-warden-cli`, but the command stays `mcp-warden`.
 The PyPI name `mcp-warden` is an unrelated package by another author. PyPI rejects
@@ -37,7 +37,7 @@ the very first upload is already OIDC-published.
 2. Go to **Account → Publishing** (<https://pypi.org/manage/account/publishing/>).
 3. Under **Add a new pending publisher**, fill in **exactly**:
    - **PyPI Project Name**: `mcp-warden-cli`
-   - **Owner**: `ernestprovo23`
+   - **Owner**: `DataScience-EngineeringExperts`
    - **Repository name**: `mcp-warden`
    - **Workflow name**: `release.yml`
    - **Environment name**: *(leave blank — the workflow does not use a GitHub
@@ -75,7 +75,7 @@ without the publish job failing red before the Trusted Publisher exists.
   and nothing is uploaded to PyPI. Use this to cut signed GitHub Releases for
   versions already published by token (e.g. `1.0.0`, `1.0.1`).
 - **After you have configured the Trusted Publisher above** (project
-  `mcp-warden-cli`, owner `ernestprovo23`, repo `mcp-warden`, workflow
+  `mcp-warden-cli`, owner `DataScience-EngineeringExperts`, repo `mcp-warden`, workflow
   `release.yml`), enable OIDC publishing for future releases by setting the
   variable:
   ```bash
@@ -160,14 +160,14 @@ Do this on a clean checkout of `main` with all v1 PRs merged.
    sigstore verify identity dist/mcp_warden_cli-1.0.0-py3-none-any.whl \
      --bundle mcp_warden_cli-1.0.0-py3-none-any.whl.sigstore \
      --cert-identity \
-       "https://github.com/ernestprovo23/mcp-warden/.github/workflows/release.yml@refs/tags/v1.0.0" \
+       "https://github.com/DataScience-EngineeringExperts/mcp-warden/.github/workflows/release.yml@refs/tags/v1.0.0" \
      --cert-oidc-issuer "https://token.actions.githubusercontent.com"
    ```
    (Download the `.whl` and its `.sigstore` bundle from the Release assets first.)
 
 3. **Confirm the PyPI page.** Visit <https://pypi.org/project/mcp-warden-cli/> and check:
    - version `1.0.0` is listed;
-   - the project URLs (homepage / repository) point at `ernestprovo23/mcp-warden`;
+   - the project URLs (homepage / repository) point at `DataScience-EngineeringExperts/mcp-warden`;
    - "Publisher" shows the Trusted Publisher (OIDC), not a token upload.
 
 4. **Smoke-test the gate** in a throwaway dir to confirm the published wheel works:

SECURITY.md

@@ -16,7 +16,7 @@ preferred because it keeps the report, the fix, and the CVE in one place):
 
 1. **GitHub Security Advisories** — go to the repository's **Security** tab and
    click **"Report a vulnerability"**
-   (<https://github.com/ernestprovo23/mcp-warden/security/advisories/new>). This
+   (<https://github.com/DataScience-EngineeringExperts/mcp-warden/security/advisories/new>). This
    opens a private advisory visible only to you and the maintainers.
 2. **Email** — `ernest@thedataexperts.us`. Use a clear subject line such as
    `[mcp-warden security]`. If you want to encrypt, say so in a first plaintext

SYSTEM_CONTEXT_DIAGRAM.md

@@ -22,7 +22,7 @@ logic) plus a separate informational provenance section. It never prints raw
 > runtime dependency and is never invoked by `pin`/`check`/`policy`.
 
 > **`action.yml` (Issue #18)** is the primary consumer delivery vehicle for the `check`
-> gate. Consumers pin `ernestprovo23/mcp-warden@<tag>` in their workflow; the composite
+> gate. Consumers pin `DataScience-EngineeringExperts/mcp-warden@<tag>` in their workflow; the composite
 > action wraps the C2 sequence (steps 1–5 of the pin/check sequence above) behind a
 > single `uses:` step with hash-locked supply-chain, injection guard, SARIF upload, and
 > cross-OS support. See `action/requirements.lock` and `README.md` §GitHub Action.

docs-site/checklist.md

@@ -49,7 +49,7 @@ not the right layer.** No single tool covers this list — that is the point.
       exits non-zero on any drift. Wire it into [CI](pin-in-ci.md).
 - [ ] **Run the same verdict locally before CI.** Catch drift at commit time, not
       in the pipeline. mcp-warden ships a pre-commit hook
-      ([example config](https://github.com/ernestprovo23/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml))
+      ([example config](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/examples/pre-commit/.pre-commit-config.yaml))
       that reuses the identical drift path as `check`.
 - [ ] **Surface findings where your team already looks.** mcp-warden emits SARIF
       (`--sarif`) that uploads straight to GitHub code scanning, so drift shows up
@@ -88,4 +88,4 @@ not the right layer.** No single tool covers this list — that is the point.
     only the pin-and-drift items. mcp-warden does **not** defend behavioral /
     runtime attacks, does **not** statically classify new definitions, and makes
     **no compliance or regulatory claim**. Read the limits in the
-    [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md).
+    [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md).

docs-site/comparison.md

@@ -89,7 +89,7 @@ Each tool above is good at its own job; pick the layers you need and combine the
     classify new definitions (use a scanner), does **not** mediate runtime traffic
     as its core job (use a gateway), and makes **no compliance or regulatory
     claim**. Read the limits in the
-    [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md).
+    [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md).
 
 ---
 

docs-site/index.md

@@ -31,4 +31,4 @@ definitions, alert on drift* — mcp-warden is the deterministic tool that does
     `resources/list` / `prompts/list`; it does **not** defend against behavioral
     attacks at runtime and makes **no compliance or regulatory claim** of any
     kind. Read the limits first in the
-    [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md).
+    [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md).

docs-site/lock-format.md

@@ -31,7 +31,7 @@ the same declared surface** — that byte-reproducibility is the conformance bar
 The complete, normative specification is the source of truth and lives in the
 repository:
 
-- **[MCP Lock Format v1 — `docs/SPEC.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/SPEC.md)**
+- **[MCP Lock Format v1 — `docs/SPEC.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/SPEC.md)**
 
 It covers the file format and location, server identity, the per-entry schema
 (tool / resource / prompt), field / entry / overall digest construction, the
@@ -40,10 +40,10 @@ conformance section, and a minimal worked-example lock.
 
 The mcp-warden-specific implementation details (how *this* tool realizes the
 format) are documented separately in
-[`docs/WARDEN_LOCK_SCHEMA.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/WARDEN_LOCK_SCHEMA.md),
+[`docs/WARDEN_LOCK_SCHEMA.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/WARDEN_LOCK_SCHEMA.md),
 which references `SPEC.md` as the format source of truth. A short, concrete
 example lock is in
-[`docs/WARDEN_LOCK_EXAMPLE.md`](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/WARDEN_LOCK_EXAMPLE.md).
+[`docs/WARDEN_LOCK_EXAMPLE.md`](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/WARDEN_LOCK_EXAMPLE.md).
 
 ## What the format is for — and is not
 
@@ -60,4 +60,4 @@ is explicitly **not**:
     The lock format covers declared-surface integrity only. It does **not** attest
     runtime behavior, does **not** judge whether a surface is benign, and makes
     **no compliance or regulatory claim**. Read the limits in the
-    [threat model](https://github.com/ernestprovo23/mcp-warden/blob/main/docs/THREAT_MODEL.md).
+    [threat model](https://github.com/DataScience-EngineeringExperts/mcp-warden/blob/main/docs/THREAT_MODEL.md).