[kirkmarple-clockgrove]

Summary

• establish clockgrove/.github as the trusted, secret-bearing Factory qualification controller
• bind exact controller/candidate/oracle SHAs and fetch private Factory with a transient least-privilege credential
• support explicit personal-PAT mode now and GitHub App installation-token mode later
• treat candidate content as data, reject symlinks, sanitize declared behavior into a neutral workspace, and disable candidate hooks/MCP/plugins/settings/custom instructions
• add outer-supervisor Docker CI for valid, os._exit(0), stdout-spoof, and adversarial-hook fixtures
• add bootstrap, promotion, compromise recovery, and revocation lifecycle

Validation

• 6 controller unit tests pass
• marketplace validation passes
• workflow YAML parses
• Docker integration is defined in CI; Docker is unavailable in the local Codex host

Activation remains fail-closed

The lifecycle is intentionally bootstrap_pending. After this PR passes review and merges, two owners must record the trust-root decision, configure the factory-release environment and credential mode, then merge a small activation-ledger PR. Factory PR clockgrove/factory#70 can then pin that activation commit.

[kirkmarple-clockgrove]

Superseded by the accepted architecture decision to keep clockgrove/.github marketplace-only and move the trusted qualification authority into the dedicated private clockgrove/factory-controller repository. The Clockgrove organization is now on GitHub Team, so the private controller can enforce repository rulesets and protected environments without the public-repository workaround.

This PR must not be merged. Its useful implementation will be hardened against the outstanding independent-review findings and republished in the dedicated controller repository; Factory PR #70 will be retargeted to that repository and exact accepted controller SHA.