cnp-action

Controlled Negotiation Protocol (CNP) Gate for GitHub Actions

Block risky workflow changes before CI continues.

This repository is the install / Action / product surface for the public controlled negotiation protocol (cnp) path.

What it is

This is the GitHub Action-facing product surface for controlled negotiation protocol (cnp) control. It is meant to make one thing clear fast: this is not another scanner and not a post-hoc reporting layer. This is an execution gate for GitHub automation.

What it does

• Blocks risky workflow changes before CI continues.
• Acts as an external execution gate for GitHub automation.
• Stops unsafe AI / automation changes before they execute.

What it is not

• Not another scanner.
• Not a generic security toolbox.
• Not architecture sold as an abstraction.

Install meaning

This surface exists to show the product-facing path: install, understand the outcome, and understand the commercial path above the public Action surface.

Commercial step

For real commercial use above the public GitHub surfaces, use the Hosted Authority inquiry path:

Current route

1. Understand the outcome here.
2. Evaluate the proof / meaning surface separately if needed.
3. Move to the Hosted Authority inquiry path for the commercial path.

Request access

Request access

This is the single canonical inquiry entry. GitHub is not checkout.

Platform-native policy vs external admission

Pre-run policy is necessary. External admission is the stronger boundary.

Platform-native controls improve the executor. External admission separates execution from authority.

If execution can proceed without an external allow decision, the system has policy, but not external admission authority.

Surrogate Boundary Test: Can execution proceed without an external allow decision?

No Admission = No Execution.

Learn more:

• https://ai-admissibility.com/platform-native-policy/
• https://ai-admissibility.com/external-admission-authority/
• https://ai-admissibility.com/surrogate-boundary-test/