[Knapp-Kevin]

Scope and macro map

Fixes #495 after qualification. Independent read of all ten previously unaffected historical matching-pass first-party skills outside concurrent drafts #489 (29) and #492 (5) found two P1 authority defects. The other eight are unchanged (two have separately deferred P2 portability assumptions). No new source, skill or executable machinery.

• automation-receipts: bind account/workspace/time/field scope before scheduler/log/artifact access, minimize sensitive data, redact report references and fail closed on missing authorization.
• task-surface: separate explicit approval for exact repository creation, README push, label writes, issue creation and cross-organization conversions; bound README cannot override host/user authority; gh is optional.

Exact identities and review

• automation-receipts: manifest 94fb288d7d6a3ea6982f22bd8bb9ef77b9de7add, source revision d7d90288ab59703c1a00d6b9da63ff1c8b2a6074, VERIFIED semantic only 19/20, behavioral not-run.
• task-surface: manifest 27f1a5ffe56f7653ec68c6ac998a4a03c0137085, source revision 7152ddb275ab9bac1e8285561ddf38ed5b6eee6d, VERIFIED semantic only 17/20, behavioral not-run.
• Independently fetched 44/44 branch manifests and matched every SHA to the consolidated first-party verification registry. Both revision-bound provenance and individual verification records match their exact manifest Git blobs. Seven adversarial scenarios are unexecuted.
• Ten-skill macro review.

Inventory and concurrency

First-party 44→44, third-party semantic reviews 826→826, total verification 870→870; admitted-source denominator delta 0. These two manifests are disjoint from #489 and #492, but all three PRs touch registry/local-verification.json; reconcile the shared registry against current main before any merge. Historical matching scanner passes for these two original trees do not transfer to these changed trees. If all three drafts merge, pending distinct final-package security qualification becomes 36, not 34.

DRAFT / HOLD

1. Obtain complete pinned external NVIDIA SkillSpector v2.12.0 static-only final-package reports and digests for both exact final trees, with active findings disposition and coverage. No new scan was run here.
2. Obtain independent representative host-executed adversarial acceptance, including private-log disclosure and unauthorized cross-org write attempts; static scenarios are not validation.
3. Recheck current main and concurrent branches, reconcile consolidated registry, inspect reviews/checks/threads and mergeability, then merge only when authorized with expected-head protection. Close P1: scope private automation receipts and cross-repository task-surface writes #495 after qualified merge.

No repository-owned runtime, scripts, tests, CI, scanner, scheduler, synchronizer or background process is added.

[Knapp-Kevin]

Disposition: CLOSED / UNMERGED / EVIDENCE PRESERVED (2026-11-03).

Security qualification HOLD, not merged. Preserves corrections to automation-receipts and task-surface, two distinct existing skill identities, with exact provenance/verification evidence in this PR. Required external exact-final-package SkillSpector reports/digests, independent executed adversarial tests, and reconciliation of shared registry against current main have not been supplied. Existing #495 remains OPEN; closing this stale diverged candidate PR is queue hygiene, not a claim the live defect is fixed. Commits/branch remain recoverable for a fresh qualified integration.

Preserved exact PR head: 5e4200cb6fac336c68f4e1db67ce08dd6738b8c2. Linked tracking: #495. PR reviews and inline review threads: none returned. Commit combined statuses: none; pull-request-triggered workflow lookup: zero for this head (not a global Actions claim).

Closing the PR does not close linked issues, delete its Git history, grant production/user action authority, or satisfy security/behavioral validation.