CEG-262-001: owner-managed l9-analysis.yml deleted in a feature PR (PRESERVE-L9-ANALYSIS-OWNER violated)

[cryptoxdog]

Audit ceg-open-prs-2026-09-17, finding CEG-262-001 (CI, High, merge-blocking). Owner class CI_PIPELINE; semantic owner l9-ci-core / CEG platform CI. Filed because no agent authority covers this surface — .github/workflows/l9-analysis.yml is a non-authorizing candidate surface under the handoff, so it carries no write allowlist.

What is wrong

PR #262 deletes the owner-managed governed analysis workflow outright:

$ git diff 9c8e3cf...<pr-262-head> -- .github/workflows/l9-analysis.yml
 .github/workflows/l9-analysis.yml | 186 --------------------------------
 1 file changed, 186 deletions(-)

Preservation obligation PRESERVE-L9-ANALYSIS-OWNER is therefore VIOLATED: governed L9 analysis must remain represented through its owner-managed surface rather than be deleted to remove a failing check.

The root cause the audit identifies is broader than the deletion: unrelated CI/governance/Gate-test baseline remediation was folded into a feature branch. #262 also touches .github/workflows/ci.yml, .github/workflows/supply-chain.yml and .github/governance/quality-thresholds.yaml alongside the IdeaOS feature.

Why it matters beyond the workflow file

Those same CI edits are one of the two drivers of the SonarCloud C Security Rating now blocking #262 — six githubactions:S8541 findings (Omitting "--only-binary :all:") across ci.yml and supply-chain.yml. Repairing the CI baseline through its owning surface removes those from the feature PR's "new code" as a side effect.

Closure condition (from the audit)

#262 restores the owner-managed L9 Analysis surface and no longer carries unrelated CI/governance/Gate-test baseline repairs. Those repairs, if still needed, land independently through their owning surface; both PRs are then rebased and revalidated at new exact heads.

Verification

git diff 9c8e3cf7233e81070fad79c38e8b12411db63a60...HEAD -- .github/workflows/l9-analysis.yml   # expect: no deletion
git diff --name-only 9c8e3cf7233e81070fad79c38e8b12411db63a60...HEAD                            # expect: IdeaOS surfaces only

Evidence: E002, E003, E004, E024. Authorities: AUTH-CI-OWNER, AUTH-USER-SCOPE.

Related: #262.

---

Generated by Claude Code

[cryptoxdog]

Escalating: the deletion is now on main

#262 merged as d26194d. .github/workflows/l9-analysis.yml is gone from the default branch:

$ git cat-file -e origin/main:.github/workflows/l9-analysis.yml
  (absent)

This is no longer "a PR proposes to delete an owner-managed workflow" — the governed L9 analysis surface is simply not present on main, and PRESERVE-L9-ANALYSIS-OWNER is violated in the shipped state. Restoring it is now a change against main rather than a correction to a pending PR.

The unrelated CI/governance edits that came with it also landed: .github/workflows/ci.yml, .github/workflows/supply-chain.yml and .github/governance/quality-thresholds.yaml. The six githubactions:S8541 findings they carry are consequently on main too, and remain part of what SonarCloud is failing on.

main is currently red — Quality Gate, Semgrep Policy Check and SonarCloud Code Analysis all failing on b1054ac.

I have not touched any of it: .github/workflows/ is AUTH-CI-OWNER territory and the audit lists this workflow as a non-authorizing surface. Happy to prepare the restoration as its own PR on request — it is a clean revert of one file plus whatever the owning surface should carry instead.

---

Generated by Claude Code