[mikomiel]

Change and reason

First source stage of extract-pve-foundation, plus the shared GitHub repository baseline requested by the maintainer.

• Extract PVE policy parsing, canonical requests, mTLS-proxy identity checks, Ed25519 leases and SSH certificate argv construction into privilege_broker/pve/.
• Preserve the existing PVE protocol versions. Remove deployment-specific certificate source defaults; require an explicit valid, restricted source network.
• Add synthetic tests, an executable local example and a self-contained wheel/sdist build.
• Align uv/Ruff/pytest, docs/examples, contributor/security files, issue/PR forms, grouped Dependabot updates and SHA-pinned hosted CI with the other public repositories.
• Adapt the existing trusted-default-branch review/status and controlled-automerge pattern. Broker code, tests, scripts, workflows, dependencies and unknown paths remain human-merge-only.
• Configure release-please using RELEASE_PLEASE_TOKEN by reference only, with skip-github-release: true: release-PR preparation is allowed, tag/release creation is not.

Verification

• PASS: 116 tests on Python 3.11, 3.12 and 3.14.
• PASS: uv run ruff check . and formatting check.
• PASS: documented local example; no network or PVE mutation.
• PASS: uv build; clean installed-wheel import/configuration smoke test outside the checkout on Python 3.11; wheel/sdist exclude local private configuration.
• PASS: synthetic comparison against the frozen source snapshot for all six PVE actions: identical canonical payloads, digests, signed claims, signatures, verification results and certificate argv/options.
• PASS: negative controls. Removing unrestricted-source rejection causes two policy tests to fail; allowing broker code through automerge causes two merge-policy tests to fail. Both mutations were restored and the complete suite passes.
• PASS: openspec validate extract-pve-foundation --strict; relative documentation links; git diff --check.
• PASS: pre-push Gitleaks and private-identifier scans of the full commit history, current tracked blobs and commit messages, including local forbidden-name rules. Commit author metadata uses a public GitHub no-reply address.
• Hosted exact-head CI and independent App review are still to be established for this PR; local results are not substitutes.

Repository configuration verified

Protected main has strict Actions-bound checks/public-content, admin enforcement, stale-review dismissal, one native independent approval, and no force pushes or deletion. Private vulnerability reporting and dependency alerts are enabled; secret scanning and push protection are enabled. CodeQL default setup is configured for Python and Actions. Description/topics and the shared label vocabulary are set.

The native approval requirement is a deliberate bootstrap transition, not the final App-status arrangement: this PR's writer workflows cannot be trusted before they exist on main. After human merge, verify the trusted publisher and add its Actions-bound review context before aligning native review settings. Do not weaken protection to merge this PR.

Limits and risk

This is an authorization library, not the complete approval service. WebAuthn UI, notifications, HTTP/MCP clients, worker and dispatcher extraction remain in the active OpenSpec tasks. Importing this library does not authenticate a remote caller or prove that a human approved an operation.

No existing deployment or PVE policy has changed. No production credentials, private source history or deployment identifiers are included. No tag, release, package or image has been published. The retained broker implementation is unchanged; no consumer cutover or removal is attempted.

Documentation result: source_docs (docs/architecture.md, docs/configuration.md, docs/repository-standards.md, docs/releases.md and updated contributor/OpenSpec documents).

Merge owner: human maintainer, after green required exact-head CI and independent review. Authoring agents do not manually merge, enable standing auto-merge, or bypass protection.

[ecomwizards-gandalf]

Independent snapshot review of d81e4190e833...db3157720f21 in mikomiel/privilege-broker by pi on codex-lb (gpt-6.1-sol).

Verdict: APPROVE

Reviewer output

Findings

No blocking, concrete source defect identified in the supplied range.

Static inspection found:

• Consistent PVE canonicalization identifiers and signed-claim structure. This is not independent proof of parity with the retained implementation.
• Policy loading rejects unknown actions, malformed grants and boolean target IDs. Certificate policy requires an explicit network and rejects unrestricted IPv4/IPv6 sources.
• Clear documentation that this is an authorization library—not an approval service, executor or evidence of successful execution.
• Default-branch checkout and metadata-only evaluation in the privileged review/automerge workflows. The merge policy denies sensitive and unknown paths and examines both names of a rename.
• Explicit skip-github-release: true, separating release-PR preparation from tag/release publication.

Optional suggestions

1. Commit deterministic compatibility vectors.
   tests/test_pve_authorization.py:115 checks different random nonces rather than determinism for identical inputs; :644 computes its expected digest using the same canonicalization helper under test. Add frozen synthetic vectors for all six actions, covering canonical bytes, digests, signed claims and signatures. These would make the reported extraction-parity result reproducible without the private source snapshot.

2. Test the automation orchestration, not only its predicates.
   scripts/github_pr_automation.py:199–277 contains important collection, revocation, ref-revalidation and merge sequencing. Add fake-API tests for pagination failure, changed refs, failed status revocation and uncertain merge responses. The existing policy/workflow tests do not exercise those runtime paths.

3. Make refusal tests exercise refusals.
   tests/test_pve_authorization.py:790 is named as testing rejection of every excluded action, but only checks the constant’s size and string prefixes. Parameterize actual lease-issuance attempts over every excluded action.

Review coverage and limits

• Read the complete 4,369-line diff and the relevant supporting source, workflows, tests and specifications.
• Made no repository changes.
• NOT RUN: pytest, Ruff, builds, examples, secret scans or mutation controls; no command-execution tool was available.
• The frozen retained implementation was not supplied, so I could not independently reproduce the claimed compatibility comparison.
• Full commit history/messages, hosted exact-head CI, repository protection settings and external dependency/action identities were not independently verified.

This is an independent source-review approval, not a CI verdict, runtime acceptance, merge instruction or release authorization. This bootstrap PR remains human-merge-only; its proposed privileged workflows cannot approve it.

VERDICT: APPROVE

Evidence: not written. This review is evidence, not merge authorization.

[mikomiel]

One-time governance bootstrap — existing approval reused

The maintainer authorized this specific bootstrap transition; no second review is requested and the source head is unchanged.

• Exact head: db3157720f2148a78fce6d1c0f45a168037b44f1.
• Independent approval: Gandalf review 5881218517, bound to that head. The metadata-only policy evaluation returns success / approved_at_head.
• Hosted CI: the App-backed provider reports PASS at that head and base d81e4190e8330ff05ddbc84979986db953b2809b.
• Only protection change: the temporary native approval count changed from 1 to 0. Strict Actions-bound checks and public-content, admin enforcement, conversation resolution, and force-push/deletion prohibitions remain unchanged.

The maintainer must perform the human merge. The implementation agent has not merged this PR or enabled an auto-merge order. No App permissions, credentials, PVE consumers, or deployed PVE services changed.

After merge, verify that the trusted default-branch review-gate actually publishes the review status, then require the Actions-bound review context. If the refs change before merge or the publisher cannot be verified afterward, restore the native approval requirement instead of leaving an unenforced steady state.

The bootstrap paragraph in docs/repository-standards.md describes the original native-review guard. This explicit, PR-specific exception supersedes that temporary requirement only for this bootstrap; the final required-review-status model remains the target. The reviewed branch was not edited merely to update that transitional prose.

Recorded by the Pi implementation session as a status and maintainer-authorization record, not as another review.

[mikomiel]

Bootstrap exception closed

PR #1 was human-merged as e76d6054b1b6980697fb5b6cf8c9418074c2c08b. Its original Gandalf approval was reused; no second review was requested for that PR.

The trusted default-branch publisher was verified after merge. Protected main now requires strict checks, public-content, and review, each bound to GitHub Actions (App 15368), with native approval count zero. Admin enforcement and the other protections remain intact. The temporary bootstrap exception is no longer an open transition.

The normal path was then exercised by docs-only PR #4: Gandalf approved its new head, exact-head CI passed, and trusted GitHub Actions merged it as 7ec42d7713f92f55378543c72019fb74c982bee0. No authoring-agent merge or standing auto-merge order was used. Executable and sensitive changes still require human merge.

Release-please prepared release PR #2 only. No tag, product release, package/image publication, consumer cutover or PVE deployment was performed. The source remains a pre-release authorization foundation; service and execution extraction are still pending in OpenSpec.

Status record from the Pi implementation session, not a review or release authorization.