Add GitHub self‑governance/workflow gates, agent manifests, docs, CODEOWNERS, and trust‑authority tests

[blocksifrdev]

Motivation

• Establish a self‑governance reference for applying TTP to GitHub actions by gating meaningful non‑human actions through a Runtime Authority (POST /re/authorize) and requiring auditable receipts.
• Provide secure repo access and review controls for protocol/security‑critical paths via CODEOWNERS and related repo access guidance.
• Seed operator and integration documentation, policies, and role‑agent manifests to enable safe rollout and adoption.
• Harden and test the reference Trust Authority implementation with unit tests and CI to improve release readiness.

Description

• Add GitHub governance artifacts: a global CODEOWNERS, two workflow skeletons (.github/workflows/ttp-protected-gate.yml, .github/workflows/ttp-governed-pr-action.yml) and a CI job (.github/workflows/ci.yml) that builds and tests the trust‑authority reference.
• Add a comprehensive set of docs and policies under docs/, policy/, spec/extensions/, receipts/schemas/ and new README/CONTRIBUTING/SECURITY updates to document self‑governance, operator guides, open‑source boundary, and public‑readiness.
• Introduce role/agent manifests and agent descriptors under agents/ (multiple manifest.json and role-agents.yaml) to model workload identities and allowed actions for AI role‑agents.
• Add a starter Authority service (services/authority/) that implements POST /re/authorize, receipt signing/chain hashing, policy loader, and example decision logic and schemas.
• Update the reference Trust Authority: add tests (src/aggregation.test.ts), jest config, package.json dev deps, tsconfig adjustments, API extension GET /v1/admin/agents, in‑memory store helpers (listAgents, getAgentReceiptsAcrossDomains), and multiple small crypto/sha512 sync fixes.
• Provide example workflows, acceptance tests and RFCs for the GitHub self‑governance model and a trimmed, implemented version of the ttp-language docs to match repository semantics.

Testing

• Added unit tests: reference-implementations/trust-authority/src/aggregation.test.ts which exercise aggregateTrustScore behavior (windowing, issuer weight cap, metadata outputs).
• Configured CI job CI (.github/workflows/ci.yml) to run npm install, npm run build, and npm test in reference-implementations/trust-authority; the job is wired to run on push/pull_request.
• The new aggregation unit tests were executed (npm test / jest) as part of validation and passed (aggregation behavior and cap logic succeeded).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eb0ff11c05

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce bearer auth before processing authorization requests

The /re/authorize handler processes and signs decisions without checking the Authorization header, so any caller that can reach this service can obtain valid receipts (including PERMIT for non-critical actions) and pollute the receipt chain. This is a security boundary issue because the workflows already assume token-gated access via RUNTIME_AUTH_TOKEN, but the service currently ignores that trust boundary entirely.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate reauth targets match the prior receipt context

Reauthorization only checks that the prior receipt exists and had STEP_UP/ESCALATE, then permits on generic approval/freshness checks; it never verifies that the new request matches the prior receipt’s repo/resource/commit/action scope. This allows reusing a step-up receipt from one change to authorize a different change, which breaks the intended step-up security model.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Handle JSON parse failures in /re/authorize requests

The route awaits parseBody(req) without a try/catch, but parseBody rejects on malformed JSON; in that case the request never gets a structured error response and can surface as an unhandled rejection. A single malformed client payload can therefore cause request hangs and potentially destabilize the process depending on runtime unhandled-rejection settings.

Useful? React with 👍 / 👎.