chore(reconcile): activate .console reconciliation (enforce R1/R2; scrub leaks) #26

	name: custodian-audit

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install Custodian
	run: \|
	python -m pip install --upgrade pip
	pip install "custodian[tools] @ git+https://github.com/ProtocolWarden/Custodian.git@main"
	pip install ruff vulture ty

	- name: Install repo (best-effort, for adapter passes)
	run: \|
	if [ -f pyproject.toml ]; then
	pip install -e . \|\| true
	fi

	- name: Materialize boundary artifact file
	env:
	REPOGRAPH_BOUNDARY_ARTIFACT_FILE: ${{ secrets.REPOGRAPH_BOUNDARY_ARTIFACT_FILE }}
	run: \|
	if [ -z "${REPOGRAPH_BOUNDARY_ARTIFACT_FILE:-}" ]; then
	echo "Missing REPOGRAPH_BOUNDARY_ARTIFACT_FILE secret" >&2
	exit 1
	fi
	if [ ! -f "$REPOGRAPH_BOUNDARY_ARTIFACT_FILE" ]; then
	echo "Boundary artifact file not found at $REPOGRAPH_BOUNDARY_ARTIFACT_FILE" >&2
	exit 1
	fi
	python - <<'PY'
	import json
	import os
	from pathlib import Path

	p = Path(os.environ["REPOGRAPH_BOUNDARY_ARTIFACT_FILE"])
	data = json.loads(p.read_text(encoding="utf-8"))
	print(f"boundary_provenance={data.get('source_graph_id')}@{data.get('source_ref_or_commit')}")
	PY
	echo "REPOGRAPH_BOUNDARY_ARTIFACT_FILE=$REPOGRAPH_BOUNDARY_ARTIFACT_FILE" >> "$GITHUB_ENV"

	- name: Run Custodian audit
	run: \|
	custodian-multi --repos . --fail-on-findings --no-color

Provide feedback