sec-03 reproduction

Public source retained with the related article. Generated results, dependency directories, runtime storage, secrets, and oversized binary artifacts are intentionally excluded.

README

# SEC-03 CI credential capability fixture

This fixture supports “A Short-Lived Token Can Still Have a Large Blast
Radius.” It is a deterministic local capability model, not a GitHub-hosted
workflow or cloud-security test.

Run:

```sh
./run.sh
```

The run builds the digest-pinned Node image, evaluates seven credential and
artifact scenarios without network access, retains fourteen score-free control
decisions, rejects twenty-six semantic mutations, fetches nine official GitHub
documentation sources, and verifies the complete result set.

The model uses only synthetic token names, claims, roles, resources, artifacts,
and attacks. It does not authenticate to GitHub, request a real OIDC token,
publish a package, deploy an environment, inspect repository settings, or prove
the isolation of any production runner.

## What the cases establish

- A long-lived broad secret permits immediate mutation and later replay.
- Short-lived OIDC closes later replay but still permits immediate operations
  granted by the accepted external role.
- Narrow resource scope preserves malicious authority inside the allowed
  namespace while refusing other resources.
- An unprivileged pull-request verifier can read source but cannot mutate the
  repository, publish, deploy, or request an identity token.
- A privileged job which trusts an artifact by filename publishes
  attacker-selected bytes.
- The hardened split path validates a trusted digest, revision, and builder,
  then grants only one package publication operation.
- Compromise after validation can still replace bytes inside that package
  namespace. The reduced blast radius is not a safety verdict.

The two YAML files are representative workflow definitions used to make the
trust transition reviewable. The fixture verifies their required structural
signals but does not ask a local parser to reproduce GitHub's workflow engine.
Platform claims come from the retained official documentation responses.

## Clean export

After committing fixture changes, reproduce the evidence from the committed
tree:

```sh
./bin/run-clean-export.sh
```

The clean-export runner archives the selected commit into a temporary
directory, runs the fixture there, and retains the commit, evidence hashes,
mutation count, output, and exit code under `results/clean-export/`.

Retained files