Audit publication: emit bounded refusal diagnostics for hosted mismatches

[jeffhuber]

Part of #1025 and blocks #1024.

Problem

The repository-dispatch publisher still fails before reserving a comment after #1026, while a read-only replay of its API-side checks against the same sealed #1024 metadata succeeds. The workflow intentionally collapses every exception to one generic line, so the remaining GitHub-hosted event/environment mismatch cannot be identified without repeated guesses.

Observed failed exact-default-branch publication runs: 35308727611 and metadata-only replay 35308957904. No comment/reservation was written. Source audit 35308536301 produced an exact-head Claude PASS and successful seal for PR #1024 head 942f1b37d7e1d3f1b404af792e7c41e3ace361f2.

Scope

• Give each publication refusal a stable, non-sensitive diagnostic code, or safely expose only allowlisted literal Refused reasons. Continue collapsing all other exceptions to a generic internal refusal.
• Prove with AST/runtime tests that submitted payloads, paths, response bodies, tokens, URLs, identities and dynamic exception text can never enter the diagnostic.
• Preserve all fail-closed checks, source seals, exact-head checks, replay protection, receipt binding and comment cleanup.
• Keep source/tools helper bytes synchronized and package/release guards current.
• Use the diagnostic to identify and fix the remaining hosted mismatch if the evidence makes the correction unambiguous within this PR; otherwise stop after producing a precise bounded code for the next replay.

Acceptance

• A failed publisher emits one stable safe reason code and no submitted data.
• Non-Refused exceptions remain generic.
• Adversarial tests cover malicious/dynamic reason text and payload/token leakage.
• Existing publication, attestation, replay, exact-head and workflow tests pass.
• Independent exact-head audit, normal CI and gate evidence are recorded.

No provider rerun, Slack canary, deployment or package publication belongs to this issue. Reuse the already sealed #1024 metadata for the post-merge diagnostic replay.

[jeffhuber]

Implemented in #1030, now merged by the owner.

Final reviewed head: d1613d7de2829b152878c73d550e85cc5e9b490d. Sole source writer: Code Mower Codex, branch codex/1028-publication-refusal-diagnostics.

The publisher now emits one fixed catalog code for each of its 73 literal refusal reasons. Unknown/dynamic reasons and other exception types emit INTERNAL_ERROR. Source/tools helper bytes remain identical; all validation, source seals, exact-head checks, replay defenses, receipt binding and cleanup remain unchanged.

Validation:

• 33 publication tests passed, including eight new AST/runtime diagnostic tests, adversarial leakage cases, standalone execution, and existing publication/attestation/replay/gate/cleanup regressions.
• Ruff, privacy scan, package workflow guard, compilation, manifest currency, all 22 release-readiness checks, 15 generated-workflow actionlint checks, and easy-mode smoke passed.
• Exact-head normal CI passed, including Python 3.12/3.13/3.14 full suites, Linux/macOS containment, Board qualification, packaging and installation checks. The supplemental full local run reported failures and is not claimed as passing evidence.
• Independent exact-head Claude audit: PASS, no P0/P1/P2 findings, one non-blocking P3. Its metadata matches successful seal 17475ee1e0736048086c39dfbeafe247cf6b35e2c8219679391142c38894b7ec. Owner-recorded evidence.
• Default-branch publication failed; gate success reflects the owner's explicit bootstrap override, followed by the owner's merge.

Remaining: use the already sealed #1024 metadata for the post-merge diagnostic replay and record its bounded code. The current evidence does not identify the hosted mismatch unambiguously, so this PR preserves all checks and supplies the diagnostic for that replay. Preserve the original source seal, artifact timestamp and exact head; no provider rerun is needed for a still-valid artifact. No Slack canary, deployment or package publication was performed for this issue.

[jeffhuber]

Mac lane runner (codex): this run ended without a validated delivery. The unit stays open for the next cycle.

• provider exit: 0
• supervision: completed
• observed transition: none
• classification: exit_zero_without_delivery