phase2: enforce standalone product boundary

Author: sumitake

CHANGELOG.md

@@ -42,4 +42,11 @@ Nothing in this section has shipped as a tagged release.
   and hosted CI checks for Linux, containers, supply chain, and static
   analysis.
 
+### Changed
+
+- Clarified the standalone product boundary: consumer repositories and
+  development-time collaboration or review tools are optional integrations,
+  never Portable GHAR build, test, release, deployment, or runtime
+  dependencies.
+
 [Unreleased]: https://github.com/sumitake/portable-ghar/compare/main...HEAD

README.md

@@ -43,6 +43,16 @@ does not operate a shared control plane on anyone's behalf. Isolation is
 isolation; see [Trust boundaries](#trust-boundaries) for the full,
 explicit non-claims list.
 
+### Standalone boundary
+
+Portable GHAR's source, build, tests, release artifacts, deployment tools,
+and runtime are self-contained in this repository plus its declared public
+dependencies. No consumer repository, collaboration broker, reviewer plugin,
+or developer workspace is a required component. External review tools are
+replaceable development aids, and consumer repositories are optional workload
+integrations selected from a deployment's live inventory; neither is part of
+the Portable GHAR product or a prerequisite for Phase 2 source completeness.
+
 ## Architecture
 
 ```mermaid

docs/superpowers/plans/2026-07-11-portable-ghar-program.md

@@ -340,12 +340,19 @@ unsupported browser/container jobs on `ubuntu-latest`.
 
 Canary order:
 
-1. the smallest public read-only, secretless build;
-2. workspace unit-test chain;
-3. workspace governance aggregate;
-4. application core and aggregate tests;
+1. the project-owned dedicated secretless recovery canary;
+2. one low-complexity, read-only consumer build or unit-test workload;
+3. one read-only multi-job aggregate workload, when eligible;
+4. one representative application core or aggregate workload;
 5. any write-capable deployment recorder only after separate review.
 
+No named consumer repository or workflow is mandatory. Portable GHAR source,
+build, test, release, and deployment gates never clone, import, or execute a
+consumer repository as an implementation dependency. Deployment canaries are
+selected at cutover time from authenticated live inventory according to the
+capability and risk classes above; an unavailable or ineligible consumer is
+skipped rather than becoming a Portable GHAR blocker.
+
 Fresh inventory immediately before migration is authoritative. A repository
 with no workflow that can route self-hosted is excluded from the private fleet
 configuration, receives no scale set or idle capacity, and is not retained as a

docs/superpowers/plans/2026-07-29-task11-implementation.md

@@ -1783,7 +1783,7 @@ git status --short
 
 Expected: all source tests/vet pass; only Task 11 planned files differ.
 
-### Task 9: Obtain exact xAI/Grok review and create a signed source checkpoint
+### Task 9: Obtain exact distinct-family review and create a signed source checkpoint
 
 #### Step 1: Seal the exact review artifact
 
@@ -1797,9 +1797,11 @@ Include:
 - exact list of pending target proofs; and
 - statement that no host action or numeric choice occurred.
 
-Run a synchronous read-only xAI/Grok exact-artifact governance review. Accept
-only a substantive matching-digest result. If findings materially change the
-plan, return to the plan cross-check before implementation changes.
+Run a synchronous read-only distinct-family exact-artifact governance review
+through any eligible reviewer route. Accept only a substantive matching-digest
+result. The provider and transport are replaceable development tooling. If
+findings materially change the plan, return to the plan cross-check before
+implementation changes.
 
 #### Step 2: Verify after review
 
@@ -1918,8 +1920,8 @@ The Task 11 source checkpoint is complete when:
 - all Linux effect code is opt-in and closed;
 - synthetic and actual evidence cannot substitute for each other;
 - cleanup is mandatory, bounded, positively verified, and precedence-safe;
-- the exact source artifact receives matching-digest substantive xAI/Grok
-  review; and
+- the exact source artifact receives matching-digest substantive
+  distinct-family review through an eligible read-only route; and
 - the signed commit contains only planned source/test/plan files.
 
 Task 11's operational gate is complete only when a separately approved

docs/superpowers/plans/2026-07-29-task14-implementation.md

@@ -669,9 +669,9 @@ gates.
 - Every implementation change is TDD: observe a targeted RED failure, make the
   smallest implementation change, rerun focused tests, then run the full local
   source gate.
-- Direct distinct-family review uses xAI/Grok before Anthropic/Claude. The
-  broker is bypassed only for this session as explicitly authorized; no broker
-  lifecycle state is read or changed.
+- Direct distinct-family review uses any eligible read-only route. Reviewer
+  provider and transport are replaceable development tooling; no collaboration
+  runtime lifecycle state is read or changed.
 
 ## Threat Model and Adversarial Classes
 
@@ -1053,13 +1053,14 @@ or unregistered file may remain.
   Expected on this macOS host: nonzero typed prerequisite failure. Record this
   as the still-open Linux/Docker gate, not a skip/pass.
 
-## Task 14.7: Exact Direct xAI/Grok Review and Signed Checkpoint
+## Task 14.7: Exact Distinct-Family Review and Signed Checkpoint
 
 - [ ] Seal the complete Task 14 diff plus this plan into one exact UTF-8
   artifact and record byte length/SHA-256.
-- [ ] Use the directly authenticated xAI/Grok CLI in read-only mode for an
-  exact-artifact code review. Require a substantive matching-digest verdict.
-  Do not use or mutate the managed broker.
+- [ ] Use any eligible direct, read-only distinct-family route for an exact-
+  artifact code review. Require a substantive matching-digest verdict. The
+  provider and transport are replaceable development tooling and must not
+  mutate product or runtime state.
 - [ ] Adjudicate every finding against exact source/tests. Material changes
   require a changed-artifact confirmation review. No matching approval means
   no checkpoint commit.
@@ -1088,9 +1089,9 @@ or unregistered file may remain.
     release-settings GitHub App variable/secret/installation are still
     operator configuration gates; and
   - no deployment or host mutation occurred.
-- [ ] Obtain exact-head distinct-family review with xAI/Grok before
-  Anthropic/Claude, satisfy required checks/compliance, resolve every review
-  thread, and merge without admin bypass.
+- [ ] Obtain exact-head distinct-family review through an eligible read-only
+  route, satisfy required checks/compliance, resolve every review thread, and
+  merge without admin bypass.
 - [ ] Read back the merge commit and `origin/main`.
 - [ ] Do not label the merge as **Phase 2 fully verified**.
 

docs/superpowers/plans/2026-07-30-pr15-final-review-repair.md

@@ -45,7 +45,9 @@ name, and HTTPS deadline contracts. This plan incorporates those constraints.
    phase authority returns a typed failure before effects.
 5. Phase 2 source completion is mergeable only when all local and hosted gates
    pass at one signed head, every PR review thread is resolved with evidence,
-   and a distinct-family Grok exact-diff review reports no material defect.
+   and an eligible read-only distinct-family exact-diff review reports no
+   material defect. Reviewer provider and transport are replaceable development
+   tooling, not Portable GHAR dependencies.
 6. After the normal PR merge and exact merge-commit readback, stop. Do not
    begin Phase 3, deployment, activation, or the deferred evidence PR.
 
@@ -751,8 +753,9 @@ python3 scripts/sanitize_public.py --tracked
 - Create deliberate signed crash-safe commits, push, and wait for all hosted
   checks at the exact head.
 - Seal the final base-to-head artifact (byte count + SHA-256), obtain a direct
-  xAI/Grok high-effort exact-diff review before Anthropic/Claude, and count only
-  a matching-digest substantive approval.
+  high-effort distinct-family exact-diff review through any eligible read-only
+  route, and count only a matching-digest substantive approval. The provider
+  and transport remain replaceable development tooling.
 - Merge PR #15 normally, never with admin bypass. Read back the PR merge commit,
   signature, `origin/main`, and all required checks.
 - Report the merged Phase 2 source checkpoint and the deferred Linux/Docker,

docs/superpowers/plans/2026-08-01-pr15-lifecycle-completion.md

@@ -35,6 +35,10 @@ not fabricate those deferred external proofs.
   closed commands.
 - Preserve the approved Grafana/InfluxDB activation contract as documentation
   only.
+- Do not add an unrelated repository, collaboration broker, reviewer plugin,
+  or developer workspace as a source, build, test, release, deployment, or
+  runtime dependency. Review transport remains replaceable development
+  tooling; its availability does not change Portable GHAR's product boundary.
 
 ## Threat and failure model
 
@@ -344,9 +348,11 @@ the declared trusted-root boundary rather than adding cosmetic copies.
    Debian snapshot, sanitizer, and controller aggregate checks.
 7. Re-run all source/container gates available on macOS. Record Linux/Docker
    skips as deferred, never as passes.
-8. Seal the exact base-to-head diff and obtain a direct high-effort xAI/Grok
-   exact-artifact adversarial review. Integrate any valid finding, rehash, and
-   obtain a matching-digest approval.
+8. Seal the exact base-to-head diff and obtain a direct high-effort
+   distinct-family exact-artifact adversarial review through any eligible
+   read-only reviewer route. Review provider and transport are replaceable
+   development tooling, not product dependencies. Integrate any valid finding,
+   rehash, and obtain a matching-digest approval.
 9. Create a signed crash-safe commit, push, reply to and resolve exact-head PR
    threads with focused evidence, pass hosted checks, and merge normally.
 

docs/superpowers/specs/2026-07-10-portable-ghar-platform-design.md

@@ -26,6 +26,17 @@ The first implementation will:
 
 This project is not an official GitHub project. Its scale-set integration depends on a public-preview upstream interface and must be presented as experimental until the compatibility and migration gates in this document pass.
 
+### 1.1 Standalone dependency boundary
+
+Portable GHAR source, builds, tests, release artifacts, deployment tools, and
+runtime depend only on this repository and its declared public dependencies.
+No consumer repository, collaboration broker, reviewer plugin, or developer
+workspace is a product dependency. Independent review tooling is replaceable
+development infrastructure, and deployment-time consumer workflows remain
+external integrations chosen from authenticated live inventory. Failure or
+absence of either cannot create a new Portable GHAR build, test, release, or
+runtime prerequisite.
+
 ## 2. Goals
 
 1. Replace fixed, always-online runner slots with on-demand ephemeral runners.
@@ -40,6 +51,7 @@ This project is not an official GitHub project. Its scale-set integration depend
 10. Produce reproducible binaries and images with checksums, SBOMs, provenance, and third-party license notices.
 11. Survive GitHub-forced runner version bumps without manual intervention or loss of the GitHub-hosted execution path.
 12. Reclaim every job-scoped cgroup, tmpfs, process, namespace, and workspace by whole-container destruction, with bounded steady-state host memory and no persistent runner work area.
+13. Keep every mandatory source and operational contract consumer-neutral so the platform can be built, tested, deployed, and operated without any unrelated repository or development tool.
 
 ## 3. Non-goals
 

internal/productionruntime/lifecycle_authority_test.go

@@ -277,7 +277,7 @@ func writeHostedHoldEvidenceFixture(
 		FenceGeneration: 9,
 		Route:           "hosted",
 		HoldActive:      true,
-		Repositories:    []string{"keicrew", "workspace"},
+		Repositories:    []string{"example-readonly", "example-service"},
 		NotBefore:       now.Add(-time.Minute),
 		NotAfter:        now.Add(time.Minute),
 		ProofDigest:     strings.Repeat("a", 64),