[dinakarjs]

A new workflow or inherited permission grant could acquire OIDC authority without the existing release-validation parity test noticing. Scan every .yml/.yaml workflow and pin the four job-level grants approved under .github#54. Codecov ci.yml/test remains the sole test-job exception; the others are release.yml/publish, docker.yml/build-and-push, and scorecard.yml/scorecard.

Reject workflow-wide OIDC grants, job/workflow write-all, unexpected jobs/files and removal of an approved allowance. Cover inherited grants, both filename extensions, read-only inheritance, and regression of the SBOM grant with controls that operate on temporary copies only. Extend the existing test_release_validation_permissions.py; preserve its release-validation parity checks.

Remove id-token: write from sbom.yml: per Imran's scope ruling, its pinned anchore/sbom-action only needs github-token and this job signs nothing. Other SBOM permissions remain as currently declared.

Scope/review owner: agentrust-io/.github#54 (comment). One repository per PR; cA2A port follows separately.

Validation on Python 3.12.14 with existing hash-locked dev environment, source imports selected via PYTHONPATH=src: focused permission controls 12 passed; full unit/integration 2,354 passed, 6 skipped. Repository Ruff passes; mypy passes all 62 source files; Bandit exits successfully with existing annotation warnings; git diff --check passes. Full tests clear inherited proxy variables to avoid environment-induced SOCKS failures. No workflow dispatch, publication, credential or repository-settings changes.

This guard pins reviewed source permissions; it does not establish live registry bindings, environment protections or operator coverage.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

CI triage at 4b46f65: main CI, workflow lint, CodeQL, contributor and vouch checks passed. Confinement reference run https://github.com/agentrust-io/cmcp/actions/runs/38520586762 reports 60 passed, 1 failed. The reported exception is in test_independent_lease_stops_container_after_bridge_failure[watchdog]'s finally cleanup (test_supervision.py:89), at observer.docker('rm', '--force', metadata['container']); adapter.py discards Docker stderr, so the underlying Docker error is not established. Retained evidence: https://github.com/agentrust-io/cmcp/actions/runs/38520586762/artifacts/11873846566.

No confinement executable or test was changed by this PR. I attempted a failed-jobs-only rerun via the connector, but GitHub returned HTTP 403 Resource not accessible by integration (no Actions write access). Please rerun that failed job to distinguish an intermittent cleanup failure from a repeatable issue. The failure is not waived; no unrelated code change or permission-gate workaround is proposed.

[imran-siddique]

Implements the .github#54 ruling: the four allowances are pinned by name with ci.yml/test as the only test-job exception, and sbom.yml loses id-token rather than being allowlisted. Verified locally: 12 of 12 pass; restoring the SBOM grant fails 11, and adding id-token: write to the governance job fails all 12. linux-docker failed in the confinement test's cleanup and passed on re-run with no change.