Scorecard: 5 high alerts on main from the first real analysis (Token-Permissions ×3, Code-Review, Branch-Protection)

[hyperpolymath]

The first real Scorecard analysis on main (dd87b48, 2026-09-22T23:41Z, produced by the #168 cure via #169) opened 5 high alerts. Ruleset 18110203's code_scanning rule requires Scorecard at high_or_higher, so these are the alerts that rule now reads. Per the standing rule, a new scanner finding is an issue with acceptance criteria, not a merge blocker; nothing here is fixed by this issue.

alert	check	location	Scorecard's text
510	Token-Permissions	.github/workflows/publish-container.yml:14	top-level packages: write
509	Token-Permissions	.github/workflows/hypatia-scan.yml:28	top-level security-events: write
508	Token-Permissions	.github/workflows/scorecard.yml:38	job-level security-events: write on the reusable-workflow call (Scorecard cannot see the callee's steps, so it cannot apply its SARIF-upload exemption)
25	Code-Review	repo	3/24 recent changesets approved (owner bypass merges land without a review)
1	Branch-Protection	repo	force pushes enabled on main; protection "not maximal"

Snapshot after the analysis: open Scorecard alerts high=5, medium=2, low=1; 43 older alerts moved to fixed.

Acceptance criteria

1. 510 / 509: each top-level write scope moves to the job that needs it, with workflow-level permissions: contents: read (or {}), and the workflow's own next push: main run succeeds with jobs > 0. Remember that a job-level permissions: block replaces the workflow map (the scorecard.yml has never run: 20/20 startup_failure (jobs=0); Scorecard is a required code_scanning tool with zero analyses #168 root cause), so the job block must list every scope the job's steps use.
2. 508: either (a) keep the caller as is and dismiss the alert with the reason won't fix and a comment pointing at the callee's SARIF upload step (hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@0f13f51f, job scorecard), or (b) if Scorecard learns to follow reusable-workflow calls, re-run and let it close. Not to be "fixed" by dropping security-events: write — the callee's upload needs it and the workflow would die at startup again.
3. 25: an owner decision, not a workflow change. Acceptance is a decision row on hyperpolymath/standards#787 recording whether Code-Review's approved-changeset ratio is a metric the estate wants Scorecard to gate, and if so what the required-approval count on ruleset 18110203 becomes.
4. 1: Branch-Protection reads classic protection and ruleset fields. Acceptance is the alert's most_recent_instance text listing zero Warn: lines the owner has not explicitly waived on #787 (force pushes on main is the first).
5. The Scorecard analysis on refs/heads/main after these land reports 0 open high alerts, or every remaining high is dismissed with a stated reason.

Evidence: run 35798071972; GET /repos/hyperpolymath/absolute-zero/code-scanning/alerts?tool_name=Scorecard&ref=refs/heads/main&state=open.

🤖 Generated with Claude Code