Compiler security review

\n\nReviewed new secrets: `CODEX_API_KEY` and its optional `OPENAI_API_KEY` alias authenticate the Codex engine through gh-aw's credential-isolating proxy. `PR_MAITENANCE_TOKEN` is used by trusted credential validation, native rebasing, and safe-output application; it is excluded from the agent's execution environment. No secrets were removed and no redirects changed.\n\nReviewed SHA-pinned actions: `actions/checkout`, `actions/setup-node`, `actions/github-script`, `actions/upload-artifact`, `actions/download-artifact`, `actions/cache/restore`, `actions/cache/save`, `oven-sh/setup-bun`, and the existing `github/gh-aw-actions/setup@v0.86.2`. These provide checkout, runtimes, framework handlers, and artifacts/caches. The generated agent has read-only GitHub permissions; guarded writes use a separate job. File allowlists block workflow, instruction, manifest, lockfile, and maintenance-script edits. Threat detection fails closed.\n\nThe GitHub PAT's organization approval and permissions must be checked when it is provisioned. Live automated pushes and rebases have not been run before human review.\n\n

\n","MaggieAppleton","documentNavigation","repo","githubnext/chopin","repoId","ownerId","org:89615882","site","nexthub","private","admin","settings","triage","starred","stars","watchers","watching","pinned","notify","views",[3992,3993,3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004],"navigation",{"_3873":3874,"_3953":3954,"_3955":3956,"_3957":3958,"_3959":3960,"_3961":3962,"_99":3963},"sources",[],"meta",{"_3819":3948,"_3949":3950,"_3951":125,"_3863":22,"_3825":3943,"_3952":22,"_3868":56,"_3869":56},"branches",[3891,3892,3893,3894,3895,3896,3897,3898,3899,3900,3901,3902,3903,3904,3905,3906,3907,3908,3909,3910,3911,3912,3913,3914,30,3915,3916,3917,3918,3919,3920,3921,3922,3923,3924,3925,3926,3927,3928,3929,3930,3931,3932,3933,3934,3935,3936,3937,3938,3939,3940,3941,3942,3943,3944,3945,3946,3947],"tags",[3887,3888,3889,3890],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","Let's compose rich plans together","owner","githubnext","section","empty","pins",[3976,3977,3978],"documents",{"_3971":3972,"_3973":3974},"code",{"_23":3968,"_3969":3970},"automations",{"_3966":24,"_3967":-5},"delivery",{"_3964":56,"_3965":-5},"04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows","deployments",1000,"changes",13,"counts",{"_3975":3974},"total",11,"issue",{"_3812":3969,"_3980":3990,"_48":3969,"_3982":3991,"_3871":3842,"_3984":22,"_3985":3842,"_3986":3970},{"_3812":3987,"_3980":3988,"_48":3987,"_3982":3989,"_3871":3842,"_3984":22,"_3985":3842,"_3986":56},{"_3812":3979,"_3980":3981,"_48":3979,"_3982":3983,"_3871":3842,"_3984":22,"_3985":3842,"_3986":3974},"issues","name","Issues","filters",{},"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_3812":3969,"_3980":3990,"_48":3969,"_3982":4035,"_3871":3842,"_3984":22,"_3985":3842},{"_3812":3987,"_3980":3988,"_48":3987,"_3982":4034,"_3871":3842,"_3984":22,"_3985":3842},{"_3812":3979,"_3980":3981,"_48":3979,"_3982":4033,"_3871":3842,"_3984":22,"_3985":3842},{"_3812":4030,"_3980":4031,"_48":4030,"_3982":4032,"_3871":22,"_3984":22,"_3985":3842},{"_3812":4027,"_3980":4028,"_48":4027,"_3982":4029,"_3871":22,"_3984":22,"_3985":3842},{"_3812":3966,"_3980":4025,"_48":3959,"_3982":4026,"_3871":22,"_3984":22,"_3985":3842},{"_3812":3967,"_3980":4022,"_48":4023,"_3982":4024,"_3871":22,"_3984":22,"_3985":3842},{"_3812":3964,"_3980":4020,"_48":3964,"_3982":4021,"_3871":22,"_3984":22,"_3985":3842},{"_3812":4016,"_3980":4017,"_48":4018,"_3982":4019,"_3871":22,"_3984":22,"_3985":3842},{"_3812":3955,"_3980":4014,"_48":3955,"_3982":4015,"_3871":22,"_3984":22,"_3985":22},{"_3812":4011,"_3980":4012,"_48":4011,"_3982":4013,"_3871":22,"_3984":22,"_3985":22},{"_3812":4008,"_3980":4009,"_48":4008,"_3982":4010,"_3871":22,"_3984":22,"_3985":22},{"_3812":4005,"_3980":4006,"_48":4005,"_3982":4007,"_3871":22,"_3984":22,"_3985":22},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups",[],"now",1794436387336,"sidebar","expanded"]