feat(integrations): commit cpex-ocsf-audit reference implementation

.gitignore

@@ -101,6 +101,8 @@ docs/strategy/cosai-ws4-adlc-delegation-escalation-workshop-note.md
 docs/strategy/cosai-ws4-trust-graph-kickoff-*.md
 docs/strategy/cosai-ws4-talk-track-*
 docs/cosai-ws4-ocsf-mapping/build_ws4_exec_kit_pdfs.py
+# Offload/delegated-agent task briefs — internal workflow, not deliverables.
+ANTIGRAVITY-TASK*.md
 
 # Confidential GTM material — this repo is PUBLIC. NEVER COMMIT:
 # named prospects/contacts, candid deal risk, pricing, spend, or weekly

CHANGELOG.md

@@ -13,6 +13,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Confidential GTM material removed from this public repo — and the loop that kept republishing it closed.** An exposure audit of the public repository found no leaked credentials (2,969 blobs scanned — every blob reachable from all refs across the full 683-commit history and all ~115 branches; every hit a test fixture or placeholder, and secrets live in Google Secret Manager referenced by name only), but the business was sitting next to the code: a live CRM export naming prospects, contacts, and candid deal risk (`marketing/sales/pipeline-snapshots/`), a design-partner outreach list with named CEOs, verified addresses, and verbatim cold-email drafts, per-account engagement folders, pricing sheets, a competitor teardown, a spend tracker (including a payment method and three unrelated side projects), and weekly internal status against targets. All removed. **The important half is the republishing loop:** `ceo-dashboard-sync.yml` ran every Monday with `contents: write` and committed a fresh pipeline CSV back to the public repo, so deleting the file would have undone itself within a week — that step and the write permission are gone, the snapshot now writes to the gitignored `private/` tree (`PIPELINE_SNAPSHOT_DIR` to relocate), and it is deliberately not uploaded as an Actions artifact (public-repo artifacts are world-downloadable). Two personal Gmail addresses were also published, one pair of them inside `PROTECTED_EMAILS` — the allowlist that stops the weekly cleanup cron from deleting those accounts — so the plaintext could not simply be deleted without making the accounts eligible for deletion. Protection is now two-layered: an env-configured list (`PROTECTED_EMAILS`) plus a hard-coded SHA-256 backstop, joined by `is_protected()`, which every deletion path filters through; **an unset env var can never mean "protect nobody"**, and matching is now case- and whitespace-insensitive (strictly more protective than the previous exact set-membership test). Guarding it going forward: `.gitignore` entries following the existing "this repo is PUBLIC — NEVER COMMIT" convention, plus a `no-confidential-material` pre-commit hook that inspects *staged* content (`.gitignore` is bypassed by `git add -f`) and fails on forbidden paths or personal addresses, matched by hash so the guard doesn't leak them either. **Removal from the working tree does not unpublish anything** — every file remains reachable in history and via the GitHub UI until history is rewritten; `scripts/scrub-public-history.sh` does that (exporting the material before destroying it, refusing to run if the export is empty), and requires a force-push plus the follow-ups in `docs/security/public-repo-exposure-remediation.md`. Deliberately left public and documented as choices rather than oversights: the 2026-04-16 audit-outage incident report, the compliance policy set, infrastructure identifiers, and `docs/strategy/`.
 
 ### Added
+- **CPEX OCSF audit plugin committed as a reference implementation.** `integrations/cpex-ocsf-audit/` — a CMF plugin for the public [contextforge-org/cpex](https://github.com/contextforge-org/cpex) that emits each dispatched request as an OCSF AI Operation event off the `run(audit-log)` seam, optionally hash-chained and DSSE-signed — had sat untracked in the working tree for several sprints. Unlike the gitignored review-package copy under `docs/cosai-ws4-ocsf-mapping/`, this path matched no ignore rule, so it had **neither the protection of an ignore rule nor the backup of being tracked**, and was one `git add -A` from undeliberate publication; the crate's own manifest already stated the intent ("standalone … so it can live in the AI-Identity repo as a reference implementation"), and this makes it deliberate. Own code, Apache-2.0, every dependency from crates.io, and a near-twin of CPEX's own public `audit-logger` builtin. Prepared for publication: build docs point at the public `dev` branch (verified to carry `crates/cpex-core`), while `feat/hil_apl` `ad666ba` is kept as the verified-green provenance with drift against `dev` flagged **unverified — the crate has not been rebuilt against it**; the README's two links to gitignored files (`CMF-OCSF-FIELD-MAP.md`, `cmf-ocsf-mapping-review.md`) are removed — they would have 404'd for every public reader and named a private review artifact — with the mapping now pointing at `src/ocsf.rs`, which is the executable mapping anyway; and the `ANTIGRAVITY-TASK*.md` offload briefs are excluded and gitignored at any depth. Reference implementation — no product impact.
 - **Evidence Anchor checkpoint history is now public — with an off-infrastructure mirror.** Until now a signed Merkle checkpoint left our infrastructure only inside exported Case File bundles, so the "someone else already holds the checkpoint" property depended on bundle distribution. Two additions make it true by default: (1) an unauthenticated feed, `GET /evidence-anchor/checkpoints` (paginated oldest-first — append-only history makes ascending pages stable — filterable by `org_id`/`since`/`until`) plus a split-view spot check, `GET /evidence-anchor/checkpoints/{merkle_root}`, which answers "is the checkpoint my bundle verifies against part of the public record?" — a 404 on a root that verifies offline is the tamper signal, and the 404 body says so. Entries serve the exact DSSE envelope a bundle ships (byte-comparable), never the raw batch internals (`leaves`/`audit_log_ids`); same public-by-design posture as the JWKS, CDN-cacheable, with two new indexes (`signed_at`, `merkle_root`) so the unauthenticated paths can't trigger sequential scans. (2) A GitHub Actions mirror (every 6h + manual dispatch, no secrets) snapshots the full history onto the dedicated `evidence-anchor-mirror` branch of this public repo via stdlib-only `scripts/evidence_anchor_mirror.py`, which **enforces append-only before writing**: a rewritten batch slot, a vanished root, or a mutated envelope refuses the snapshot and fails the run loudly — the existing branch is the evidence. The Case File bundle README now tells recipients how to cross-check their bundle's root against the public record, and the architecture page's two Evidence Anchor blurbs state the public-feed + mirror claim. Detection story, honest scope (per-org trees ≠ one CT log; a same-org mirror is a raised bar, not full independence), and the deliberate metadata trade-off (opaque org UUIDs + batch volumes become public) are documented in `docs/forensics/evidence-anchor-public-feed.md`. **Run the first mirror snapshot via workflow dispatch after deploy.**
 
 ### Fixed