@@ -1,19 +1,42 @@
 # Repo Health workflow verification
 
-`Repo Health` is intentionally base-controlled. Its `pull_request_target` trigger supplies the
-workflow definition from the target branch, and every checkout keeps the trusted base revision.
-The PR head is fetched only as Git data. Never check out or execute PR-head code in that workflow.
+The github org blocks `pull_request_target`, so Repo Health is split in two:
+
+- `Repo Health` (`squad-repo-health.yml`) runs on `pull_request` with a read-only token and no
+  secrets. Every job checks out the PR's base commit and fetches the PR head only as Git data.
+  Never check out or execute PR-head code there. It uploads one result file per scanner
+  (`repo-health-{leakage,architectural,security}`).
+- **Base-controlled only when the PR leaves `squad-repo-health.yml` unchanged.** A `pull_request`
+  run uses the workflow file from the PR merge commit, so a PR that edits that file controls every
+  job of its own run, including the Bootstrap Protection check (it could make that job `exit 0`).
+  The compensating control is code-owner review: `.github/CODEOWNERS` line 4 requests review from
+  the code owners on every PR. As of 2026-11-07, `dev`'s rules require neither code-owner review
+  nor any approval, and Bootstrap Protection is not a required check, so this control depends on
+  reviewers reading workflow changes. Requiring code-owner review on `dev` would enforce it.
+- `Repo Health Report` (`squad-repo-health-report.yml`) runs on `workflow_run` from the default
+  branch and holds the write token. It downloads each scanner's artifact by its exact name and
+  treats the results as untrusted data: exact schema, size limit, one PR and head SHA across all
+  results, bound to the `workflow_run` payload and the live PR, which must target `dev`
+  (`scripts/repo-health-report.mjs`, `scripts/workflow-run-pr-binding.mjs`). It posts only when
+  the run's head commit holds the same `squad-repo-health.yml` blob as its merge base with `dev`.
+  Both blobs are read by commit SHA, so a push after binding can't change the answer. Otherwise it
+  logs a notice, posts no findings, and overwrites its own existing marker comments with a fixed
+  notice naming the refused commit. Every posted comment names the head commit it describes.
+
+Fork PRs from external contributors need a maintainer to approve their workflow runs first
+(`approval_policy: all_external_contributors`); nothing is posted before that.
 
 ## Evidence levels
 
 - **Shadow / non-authoritative:** `Repo Health Shadow (Non-Authoritative)` runs proposed scanners,
   reporter script bodies, and the reporter helper from the PR head under `pull_request`, a
   read-only token, no persisted checkout credentials, and fake Octokit. It can prove that proposed
   code compiles, preserves hostile text, and propagates API failures, but it cannot prove the
-  elevated production workflow has picked up the merged implementation.
+  default-branch reporter has picked up the merged implementation.
 - **Post-merge / authoritative:** only a disposable PR opened after the change reaches `dev` and
-  observed through `Repo Health` proves the base-controlled writer now creates and cleans up its
-  marker comment.
+  observed through `Repo Health Report` proves the default-branch writer now creates and cleans up
+  its marker comment. A PR that changes `squad-repo-health.yml` itself never gets posted findings,
+  so this canary is the only authoritative evidence for such a change.
 
 Do not weaken a scanner, add an exclusion, or change a finding merely to make the base-controlled
 check on the implementation PR green.
@@ -46,18 +69,18 @@ PR_URL=$(gh pr create --base dev --title 'test: repo-health post-merge canary' \
 PR_NUMBER=${PR_URL##*/}
 ```
 
-Wait for `Repo Health / Squad File Leakage`, then verify exactly one authoritative marker and the
-exact hostile filename:
+Wait for `Repo Health` and then `Repo Health Report` to complete, then verify exactly one
+authoritative marker, the exact hostile filename, and the head commit it describes:
 
 ```bash
 EXPECTED=$(node --input-type=module -e \
   'process.stdout.write(".squad/canary-`paired`-${-apostrophe-'\''-\"double quote\".md")')
 
-gh api --paginate --slurp "repos/bradygaster/squad/issues/$PR_NUMBER/comments" \
+gh api --paginate --slurp "repos/github/squad/issues/$PR_NUMBER/comments" \
   > canary-comments.json
-node --input-type=module - "$EXPECTED" <<'NODE'
+node --input-type=module - "$EXPECTED" "$(git rev-parse HEAD)" <<'NODE'
 import { readFileSync } from 'node:fs';
-const expected = process.argv[2];
+const [expected, head] = process.argv.slice(2);
 const comments = JSON.parse(readFileSync('canary-comments.json', 'utf8')).flat();
 const marked = comments.filter(({ body = '' }) =>
   body.includes('<!-- squad-repo-health-leakage -->'));
@@ -69,6 +92,9 @@ if (listed.length !== 1 || listed[0] !== `- \`${expected}\``) {
 if (!marked[0].body.includes('Authoritative evidence')) {
   throw new Error('comment was not labeled authoritative');
 }
+if (!marked[0].body.includes(`Results for head commit \`${head}\``)) {
+  throw new Error(`comment does not name head commit ${head}`);
+}
 NODE
 rm canary-comments.json
 ```
@@ -80,8 +106,8 @@ git rm -- "$CANARY_PATH"
 git commit -m 'test: clean up repo-health post-merge canary'
 git push
 
-# After Repo Health / Squad File Leakage completes:
-gh api --paginate --slurp "repos/bradygaster/squad/issues/$PR_NUMBER/comments" \
+# After Repo Health and Repo Health Report complete:
+gh api --paginate --slurp "repos/github/squad/issues/$PR_NUMBER/comments" \
   > canary-comments.json
 node --input-type=module <<'NODE'
 import { readFileSync } from 'node:fs';
@@ -95,6 +121,7 @@ gh pr close "$PR_NUMBER" --delete-branch
 git switch dev
 ```
 
-Record the PR URL and both successful `Repo Health` run URLs in the implementing PR or issue.
-This post-merge canary is the only authoritative evidence for a repo-health workflow/reporter
-change; the pre-merge shadow remains intentionally non-authoritative.
+Record the PR URL and the successful `Repo Health` and `Repo Health Report` run URLs (both
+pushes) in the implementing PR or issue. This post-merge canary is the only authoritative evidence
+for a repo-health workflow/reporter change; the pre-merge shadow remains intentionally
+non-authoritative.
@@ -0,0 +1,26 @@
+name: Squad Heartbeat PR Closed
+
+# Unprivileged PR-close signal for Squad Heartbeat (Ralph).
+#
+# The github org blocks pull_request_target, and a `pull_request` run from a
+# fork or Dependabot gets a read-only token and no secrets. This run does not
+# check out or execute anything and uploads nothing: its completion is the whole
+# signal. squad-heartbeat.yml listens for it through workflow_run and does the
+# privileged work from the default branch, without reading anything from here.
+on:
+  pull_request:
+    types: [closed]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  heartbeat:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Signal PR close (no checkout, no PR code)
+        run: echo "PR closed; Squad Heartbeat (Ralph) runs from the default branch via workflow_run."
@@ -16,14 +16,16 @@ on:
   # React to completed work or new squad work
   issues:
     types: [closed, labeled]
-  # pull_request_target (not pull_request): GITHUB_TOKEN is forced read-only
-  # for `pull_request` events triggered by a fork, so write steps below
-  # (addLabels/createComment) 403 on fork PR closes (#2080-class bug).
-  # Safe here because the checkout step below has no `ref:` override, so it
-  # always checks out the BASE ref — no fork code or fork-controlled input
-  # is ever read or executed by this job.
-  pull_request_target:
-    types: [closed]
+  # PR closes (same-repo, fork and Dependabot). The github org blocks
+  # pull_request_target, and a fork `pull_request` run only gets a read-only
+  # token, so write steps below would 403 there (#2080-class bug). The
+  # unprivileged squad-heartbeat-pr-closed.yml run only signals the close;
+  # workflow_run then runs THIS default-branch file with the write token. The
+  # checkout below has no `ref:`, so it is the default branch, and this job
+  # reads no artifact, output or field from the PR run.
+  workflow_run:
+    workflows: ["Squad Heartbeat PR Closed"]
+    types: [completed]
 
   # Manual trigger
   workflow_dispatch:
@@ -42,6 +44,11 @@ concurrency:
 jobs:
   heartbeat:
     runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'workflow_run'
+      || (github.event.workflow_run.event == 'pull_request'
+          && github.event.workflow_run.conclusion == 'success'
+          && github.event.workflow_run.path == '.github/workflows/squad-heartbeat-pr-closed.yml')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7
 
 
@@ -0,0 +1,44 @@
+name: Squad Impact Analysis Request
+
+# Unprivileged half of Squad Impact Analysis (squad-impact.yml).
+#
+# The github org blocks pull_request_target. This `pull_request` run has a
+# read-only token and no secrets, checks out nothing, and runs no PR code. It
+# only uploads a claim: the PR number and head SHA it ran for. The privileged
+# half treats that claim as untrusted, binds it to the workflow_run payload and
+# the live PR, and computes the report itself from the GitHub API.
+on:
+  pull_request:
+    branches: [dev]
+    types: [opened, synchronize, reopened]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  impact:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    if: github.actor != 'dependabot[bot]'
+    steps:
+      - name: Write PR claim (no checkout, no PR code)
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/claim"
+          jq -n --argjson pr_number "$PR_NUMBER" --arg head_sha "$HEAD_SHA" \
+            '{schema: "squad-pr-claim/v1", pr_number: $pr_number, head_sha: $head_sha}' \
+            > "$RUNNER_TEMP/claim/claim.json"
+
+      - name: Upload PR claim
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7
+        with:
+          name: squad-impact-request
+          path: ${{ runner.temp }}/claim/claim.json
+          if-no-files-found: error
+          retention-days: 1
+          overwrite: true
@@ -1,53 +1,97 @@
 name: Squad Impact Analysis
 
+# Privileged half of the impact report. The github org blocks
+# pull_request_target, so squad-impact-request.yml runs on `pull_request`
+# (read-only token, no secrets, no checkout) and uploads only a claim: the PR
+# number and head SHA it ran for. workflow_run runs THIS file from the default
+# branch with a write token.
+#
+# Trust boundary:
+# - The claim is untrusted data: a fork controls the request workflow. It is
+#   parsed strictly and bound to the workflow_run payload and the live PR (same
+#   head SHA, same head repository, this base repository, still open) before
+#   anything is written. See scripts/workflow-run-pr-binding.mjs.
+# - Only default-branch scripts run. PR code is never checked out or executed;
+#   the report is computed from the GitHub API file list.
 on:
-  pull_request_target:
-    branches: [dev]
-    types: [opened, synchronize, reopened]
+  workflow_run:
+    workflows: ["Squad Impact Analysis Request"]
+    types: [completed]
 
-# Security: Using pull_request_target so we get a write token for fork PRs.
-# Scripts are checked out from the BASE branch (trusted), not the PR head.
-# PR data is fetched read-only via gh CLI — no untrusted code is executed.
 permissions:
+  actions: read
   contents: read
   pull-requests: write
-  issues: write
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}
   cancel-in-progress: true
 
 jobs:
   impact:
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    if: github.actor != 'dependabot[bot]'
+    if: >-
+      github.event.workflow_run.event == 'pull_request'
+      && github.event.workflow_run.conclusion == 'success'
+      && github.event.workflow_run.path == '.github/workflows/squad-impact-request.yml'
+      && github.event.workflow_run.actor.login != 'dependabot[bot]'
     steps:
-      - name: Checkout scripts (base branch only)
+      - name: Checkout scripts (default branch only)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7
         with:
+          persist-credentials: false
           sparse-checkout: |
             scripts/analyze-impact.mjs
             scripts/impact-utils/parse-diff.mjs
             scripts/impact-utils/risk-scorer.mjs
             scripts/impact-utils/report-generator.mjs
+            scripts/workflow-run-pr-binding.mjs
           sparse-checkout-cone-mode: false
 
+      - name: Download PR claim (untrusted data)
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 #v8
+        with:
+          name: squad-impact-request
+          path: ${{ runner.temp }}/impact-request
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Bind claim to the workflow run and live PR
+        id: bind
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9
+        env:
+          CLAIM_DIR: ${{ runner.temp }}/impact-request
+        with:
+          script: |
+            const { bindWorkflowRun } = await import(`${process.env.GITHUB_WORKSPACE}/scripts/workflow-run-pr-binding.mjs`);
+            await bindWorkflowRun({
+              github,
+              context,
+              core,
+              claimDir: process.env.CLAIM_DIR,
+              claimWorkflowPath: '.github/workflows/squad-impact-request.yml',
+            });
+
       - name: Setup Node.js
+        if: steps.bind.outputs.bound == 'true'
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 #v6
         with:
           node-version: 22
 
       - name: Run impact analysis
+        if: steps.bind.outputs.bound == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-        run: node scripts/analyze-impact.mjs ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ steps.bind.outputs.pr_number }}
+        run: node scripts/analyze-impact.mjs "$PR_NUMBER"
 
       - name: Post impact report
+        if: steps.bind.outputs.bound == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9
         env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ steps.bind.outputs.pr_number }}
         with:
           script: |
             const fs = require('fs');
 
@@ -0,0 +1,47 @@
+name: Squad PR Readiness Request
+
+# Unprivileged half of Squad PR Readiness (squad-pr-readiness.yml).
+#
+# The github org blocks pull_request_target. This `pull_request` run has a
+# read-only token and no secrets, checks out nothing, and runs no PR code. It
+# only uploads a claim: the PR number and head SHA it ran for. The privileged
+# half treats that claim as untrusted, binds it to the workflow_run payload and
+# the live PR, and computes every check itself from the GitHub API.
+#
+# The job keeps the name `readiness` so scripts/pr-readiness.mjs still excludes
+# this workflow's own check run from the "CI passing" check (SELF_CHECK_NAMES).
+on:
+  pull_request:
+    branches: [dev, main, insider]
+    types: [opened, synchronize, reopened, edited, ready_for_review]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  readiness:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    if: github.actor != 'dependabot[bot]'
+    steps:
+      - name: Write PR claim (no checkout, no PR code)
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/claim"
+          jq -n --argjson pr_number "$PR_NUMBER" --arg head_sha "$HEAD_SHA" \
+            '{schema: "squad-pr-claim/v1", pr_number: $pr_number, head_sha: $head_sha}' \
+            > "$RUNNER_TEMP/claim/claim.json"
+
+      - name: Upload PR claim
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 #v7
+        with:
+          name: squad-pr-readiness-request
+          path: ${{ runner.temp }}/claim/claim.json
+          if-no-files-found: error
+          retention-days: 1
+          overwrite: true