[guillaume-flambard]

Related Issue and spec

Closes #65. Companion: memolabs-dev/memo-bridge#258 for memo-bridge#257 (merges first). Spec: owner decision of 2026-10-22; the scope is in memo-bridge docs/OWNER_SCOPE.md.

STAR receipt

Situation:

• The ledger accepted memolabs-dev/* only.
• Private enrollment was granted to the Mac runtime mode only.
• Each lease commit in this public repository stored repo and issue in clear, so private repositories' names and Issue numbers were published.

Task: let the owner's sessions use every repository he owns without widening anyone else's access, and stop publishing private identities.

Actions:

• issue_preflight:
  • ORG_REPO covers the owner namespaces memolabs-dev and guillaume-flambard; any other owner is still refused before any GitHub call.
  • The receipt carries repository_private, GitHub's answer.
  • The PUBLIC_ALLOWLIST literal is kept: deployed coordinators still parse it.
• private_owner_allowlist:
  • Mode stdio (the owner's local Memo Bridge) is accepted next to runtime, with the same darwin, host, uid, 0600, fixed path and owner_sub checks. Any other mode is refused.
  • A second owner file, external-projects.json, enrolls the owner's checkouts outside MEMOLABS_ROOT; it is validated exactly as memo-bridge validates it.
  • Limit 100.
• issue_lease:
  • A lease on a private repository stores subject (the digest already used as the ref name) in place of repo and issue.
  • The local receipt still names the repository.
  • Old clear records stay readable; a clear private record loses its identity at its next heartbeat.

Results:

• 128 tests OK (before: 114).
• On the real ledger, two private-repository leases written by this code carry only subject.

Verification

• Commit SHA examined: 9ea7763 (feature 37d2366).
• python3 -m unittest discover -s tests -p 'test_*.py': 128 tests, OK.
  • New: private records over their whole lifecycle, the clear form for public repositories, forged subjects, redaction of a legacy record, the owner account namespace, enrolled private receipts, stdio and other modes, the 100 limit, and the external file (trust, schema, path, owner).
• memo-bridge suites run against this branch: 1017/1021 pass. The 3 failures fail on memo-bridge main too and are not ledger tests.
• Live check, nothing written, real GitHub:
  • a non-enrolled private owner repository gives Repository privacy or enrollment mismatch;
  • a wrong mode gives the same;
  • someone-else/x gives Repository not in the owner namespaces allowlist.
• Live end-to-end through the companion branch: one claim on a private organization repository and three on a private personal one. Every new lease commit has subject, with no repo, issue or name.
• Known gaps:
  • The digest is unsalted: whoever guesses an exact owner/repo#n can confirm a lease.
  • The release of a legacy clear private record appends a clear commit.
  • Existing clear records stay in history; cleaning them is destructive and is the owner's decision.
  • A separate private ledger is not built.

Safety and delivery

• No credentials or private data in patch / screenshots / logs
• Existing branch, release and deployment rules preserved
• No automatic deployment or approval implied
• Human review requested when required (T3: independent review still to do)

Merge order: after memo-bridge#258. memo-bridge main at 8794838 fails one coordinator test against this ledger (a personal-namespace case now reaches GitHub instead of repo_not_allowed).

Rollback: revert. Leases written in the new form then read as "Lease identity mismatch" under the old code until released or reclaimed, so prefer rolling forward. Draft, not merged, not deployed.

[guillaume-flambard]

Fix pass after the security review of memo-bridge#258. Still DRAFT. Head 88fb819.

Finding	Status
2: the ledger child in runtime/stdio mode granted a private lease to any caller	Fixed: allowed() grants a new private lease only with MEMO_BRIDGE_LEDGER_OWNER_CALL=1. memo-bridge sets it per call, for the owner only. The holder's own verify/heartbeat (holding=True) does not need it.
3: unsalted lease ref names are enumerable	Fixed: see below.

How finding 3 is fixed:

• For an enrolled private repository, the ref name and subject are now HMAC-SHA256(owner key, "star-lease-v1\0owner/repo#n").
• The key comes from lease_key(): a 0600 owner file, owner-policy/lease-key.json, read only on the owner's Mac.
• The record keeps a keyed body digest and no issue_updated_at.
• A private claim without the key fails closed.
• Legacy records stay readable where they are. A live legacy lease keeps working for its holder; the next lease moves to the keyed name, with the epoch carried over.
• Re-measured: hashing Issues 1 to 2000 of 7 names recovers 99 of the 122 refs, 27 of them private. On the Mac, the new keyed refs for memo-orbit#126 and jobs#6 are not recovered.
• Docs corrected: the old text said "confirm that this Issue was leased, and nothing more".

Tests: 14 new or changed tests were red first (2 failures, 12 errors), then the suite went green: 137 OK. Real CLI against GitHub: a claim without the marker is refused with "Repository privacy or enrollment mismatch", and nothing is written.

Owner decision still open: deleting the historical clear and unsalted refs. That is destructive, and their commits may stay fetchable by SHA.

Merge after memo-bridge#258. Deploy both together on the Mac (the lease key is already in place).

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.