@algora-pbc /claim #10

Summary

• adds a dependency-free repository automation credential rotation guard for SCIBASE issue #10
• evaluates synthetic GitHub Actions tokens, deploy keys, registry publishers, artifact writers, and bot app grants for rotation freshness, release-window expiry, environment-scoped permissions, wildcard refs, owner attestation, secret-scan status, and required evidence
• emits release-ready / rotate-before-release / hold-release decisions plus deterministic JSON, Markdown, SVG, and MP4 reviewer artifacts

Scope

This is a distinct Project Repository & Version Control slice focused only on CI/deploy automation credentials before scientific release branches, tags, or packages publish. It avoids the existing broad repository ledger, component-owner approval, semantic tag, external reference pinning, notebook-output diff, fork provenance, release signature, restore rehearsal, retention/legal-hold, branch-protection, artifact-prune, and Git LFS slices. Synthetic data only; no real secrets, credentials, GitHub API calls, private repositories, payment data, or external services.

Validation

• npm run check
• npm test
• npm run demo
• git diff --check
• ffprobe -v error -select_streams v:0 -show_entries stream=codec_name,width,height,duration -of default=noprint_wrappers=1 repository-automation-credential-rotation-guard/reports/demo.mp4

Demo MP4 verification: H.264, 1280x720, 6.0 seconds.

AI-assisted with OpenAI Codex; I reviewed and verified the diff and generated artifacts before submitting.