feat: add secure PoCI external submission admission

[safal207]

What changed

Adds the twelfth PoCI slice: a secure admission path for an independently owned external witness submission.

The implementation adds:

• a dependency-free external admission verifier;
• exact verification of challenge, response, submission, provenance, subject bytes, six graph roots, transition cells, and self-roots;
• an external provenance schema binding repository, owner, workflow, source SHA, signer SHA, OIDC issuer, runner policy, and response digest;
• a pull_request_target intake workflow that checks out only trusted base code;
• exact three-file admission (response.json, submission.json, provenance.json);
• GitHub Contents API retrieval of external JSON as data;
• external source-commit ancestry verification;
• a fully pinned gh attestation verify invocation;
• automatic construction of a third governance domain;
• mandatory organizational-independence ACCEPT after admission;
• 14 admission mutation/identity tests and 7 workflow-security tests;
• a separate conformance workflow that keyless-attests a readiness HOLD until a real external submission exists;
• reference workflow output of deterministic provenance.json.

Security boundary

The trusted intake workflow:

pull_request_target
        ↓
checkout base SHA only
        ↓
download exactly three JSON files through GitHub API
        ↓
never execute external code
        ↓
verify repo + owner + workflow + source + signer + attestation
        ↓
admit domain
        ↓
require organizational governance ACCEPT

Permissions are limited to:

contents: read
pull-requests: write

The write permission is used only to comment the verified result on the pull request.

Honest live result

No repository owned by another GitHub account is connected to the current session. Therefore the conformance workflow must emit:

decision: HOLD
reason: EXTERNAL_SUBMISSION_NOT_PRESENT
next transition: AWAIT_EXTERNAL_SUBMISSION_PR

It does not generate a synthetic external acceptance.

Bootstrap limitation

pull_request_target workflows are loaded from the target branch. This PR validates the verifier and security contract; the live external intake endpoint becomes active after the trusted workflow reaches the branch targeted by an external submission.

Stacked PR

Base: agent/poci-external-witness-sdk-v0.1 / #204

No merge is performed by this PR.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2912b64a-8405-4ae2-a8c2-abb61598748f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final head: 74c2f352aab0620f997042cd6bf7ec3ad7056e9b

Passed:

• PoCI External Submission Admission Conformance run Write ProofPath HTTP Profile v0.1 #1 (30644199127)
  • 14 admission mutation, identity, digest, consensus, authority, and determinism tests;
  • 7 trusted-workflow security tests;
  • trusted-base-only checkout invariant;
  • exact three-JSON intake contract;
  • full repository/workflow/source/signer/OIDC pinning;
  • source ancestry requirement;
  • external-code non-execution invariant;
  • signed readiness HOLD report;
  • evidence artifact upload.
• PoCI External Witness SDK run Implement minimal Rust verifier #2 — success after adding deterministic provenance.json output.
• PoCI run Add community experiment and feedback pack #20 — success.
• Rust run #287 — formatting, clippy, workspace tests, Compute Witness, metrics, reusable action, Personal Agent Guard, and Agent Payment Guard all succeeded.

Readiness result:

decision: HOLD
reason: EXTERNAL_SUBMISSION_NOT_PRESENT
next transition: AWAIT_EXTERNAL_SUBMISSION_PR
external code executed: false
authority granted: false

Evidence artifact:

• name: poci-external-admission-readiness-30644199127
• artifact id: 8798706324
• size: 11068 bytes
• SHA-256: 33895906d67c884b8225ae3696591be93441ef2205a40ccad7e237faf5b3cf56
• expires: 2026-08-14T15:45:04Z

Bootstrap boundary: the pull_request_target intake workflow is validated here but becomes an active external endpoint only after trusted workflow bytes reach the target branch of a future external submission. No merge has been performed.