[rmcdaniel]

Privileged manual-dispatch guards can pass policy when event-name case or bare-negation precedence is misread. Match ASCII event literals case-insensitively, and treat ungrouped negation/comparison forms as unknown. Preserve grouped negation, Boolean composition and the existing protected-ref model. Unsupported Unicode spellings cannot establish trust.

The old implementation produces six failing rejection subcases and three falsely rejected safe cases. The corrected focused suite passes 25 tests. All 11 local Python modules pass 118 tests, with the npm/Cargo client controls skipped because those binaries are absent from the disposable image; normal hosted CI retains them. The 11-target candidate workflow trust scan passes. This is parser validation, not a live dispatch or credential test.

Keep this correction separate from #271's fork-cache enforcement. No workflow permissions, required checks, publication job or provider setting changes.

Fixes #272.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The final head is f8e8487576d061251db7ffc934da913d00a33f2c. The last change extracts the existing supported-negation check into a helper to meet the complexity limit; its truth model is unchanged. All seven hosted checks pass, including Shared contract tests, CodeQL and Sonar. Sonar reports zero open findings on this PR.

The normal 11 local Python modules complete 118 tests with two npm/Cargo client skips. The fresh immutable public-main workflow catalog, observed November 1 at 23:22 UTC, contains 97 workflows across 11 public targets; every target passes this candidate policy without overlays. The private target is excluded. No live dispatch or credential test ran.

This fixes #272 independently of #271. The fork-cache enforcement PR remains draft until its repository prerequisites merge and its fresh catalog passes.

[rmcdaniel]

Security review of merged source head f8e8487: accepted. Bare negation of an ungrouped comparison is now conservative, event-name comparison models Actions case-insensitivity only for ASCII literals, and grouped negation plus protected-ref composition retain the safe accepted cases. The correction merged normally with current checks green and closes the privately recorded unexploited policy gap. No dispatch, credential use, incident, or release hold resulted.