fix(slsa): close the rejection fail-open — match gh's real rejection signatures (#65)

Follow-up to #62, from the adversarial review's **confirmed** high
finding (empirically reproduced by the verifier agent against cli/cli's
attested artifact with gh 2.92.0):

Genuine cryptographic rejections — certificate-identity mismatch,
subject-digest mismatch, signer-repo mismatch — all exit 1 with stderr
exactly `Error: verifying with issuer "sigstore.dev"`, which the shipped
`verif`+`fail` heuristic classified as *operational*. Result: a
rejected/forged artifact degraded to an advisory note instead of a hard
`{:error}` — the `verified: false` branch was effectively dead code on
current gh.

**Fix**: both classifiers (Elixir local-gh fallback and checky-monkey's
Rust endpoint) now match the empirically observed rejection signatures
(`verifying with issuer`, `no attestations found`) ahead of the generic
heuristic, with comments pinning them to the gh version for future
upgrades. Trust is still only ever *granted* on gh exit 0. Additionally,
"attestations exist but no verifier could check them" now surfaces as a
pipeline **warning** rather than info — the package claims provenance
nothing could confirm; still non-blocking per the advisory doctrine.

5 new signature tests (rejections definitive; operational/auth/empty
degrade fail-open; blocked CLI is unavailable). 23/23 Elixir + 4/4 Rust
tests green.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

opsm_ex/lib/opsm/slsa/github_attestation.ex

@@ -244,15 +244,24 @@ defmodule Opsm.Slsa.GithubAttestation do
   # errors (auth, network). Only a clear verification failure is reported
   # as a definitive rejection; everything else is "verifier unavailable"
   # so the caller degrades fail-open instead of raising a false alarm.
-  defp classify_gh_failure(message) do
+  #
+  # Empirical rejection signatures on gh 2.92.0 (cert-identity mismatch,
+  # digest mismatch, signer-repo mismatch all print the first form):
+  #   Error: verifying with issuer "sigstore.dev"
+  #   Error: no attestations found ...
+  # These are gh-version-coupled; revisit on gh upgrades (issue #56 review).
+  @doc false
+  def classify_gh_failure(message) do
     down = String.downcase(message)
 
     cond do
       String.contains?(down, "safe-exec blocked") ->
         {:error, "gh CLI unavailable: #{message}"}
 
-      String.contains?(down, "verif") and
-          (String.contains?(down, "fail") or String.contains?(down, "none of the")) ->
+      String.contains?(down, "verifying with issuer") or
+        String.contains?(down, "no attestations found") or
+          (String.contains?(down, "verif") and
+             (String.contains?(down, "fail") or String.contains?(down, "none of the"))) ->
         {:ok,
          %GithubAttestationVerification{
            verified: false,

opsm_ex/lib/opsm/trust/pipeline.ex

@@ -236,8 +236,11 @@ defmodule Opsm.Trust.Pipeline do
         {:ok, %{verified: false, message: message}} ->
           {:error, "GitHub attestation failed verification: #{message}"}
 
+        # Attestations exist but none of the verifiers could check them —
+        # louder than info (the package claims provenance we cannot confirm),
+        # still non-blocking.
         {:unverified, message} ->
-          {:info, message}
+          {:warning, message}
 
         {:none, message} ->
           {:skipped, message}

opsm_ex/test/opsm/slsa/github_attestation_test.exs

@@ -134,6 +134,36 @@ defmodule Opsm.Slsa.GithubAttestationTest do
     end
   end
 
+  describe "classify_gh_failure/1 — empirical gh 2.92.0 signatures" do
+    test "rejection signatures are definitive verified: false" do
+      # cert-identity / digest / signer-repo mismatches all print this
+      assert {:ok, %GithubAttestationVerification{verified: false}} =
+               GithubAttestation.classify_gh_failure(~s(Error: verifying with issuer "sigstore.dev"))
+
+      assert {:ok, %GithubAttestationVerification{verified: false}} =
+               GithubAttestation.classify_gh_failure("Error: no attestations found")
+
+      assert {:ok, %GithubAttestationVerification{verified: false}} =
+               GithubAttestation.classify_gh_failure("X verification failed: subject mismatch")
+    end
+
+    test "operational errors degrade fail-open, never as rejection" do
+      for msg <- [
+            "Error: the provided token was denied access to the requested resource",
+            "Error: HTTP 503: Service Unavailable",
+            "connection refused",
+            ""
+          ] do
+        assert {:error, _} = GithubAttestation.classify_gh_failure(msg)
+      end
+    end
+
+    test "a blocked or missing gh CLI is unavailable" do
+      assert {:error, "gh CLI unavailable:" <> _} =
+               GithubAttestation.classify_gh_failure("safe-exec blocked: command not found: gh")
+    end
+  end
+
   describe "decode_gh_output/1" do
     test "extracts builder identity from gh verify JSON" do
       gh_output = [

services/checky-monkey/src/main.rs

@@ -438,9 +438,16 @@ async fn verify_github_attestation(
         // errors (auth, network). Only report a definitive rejection as
         // verified=false; surface operational errors as a gateway problem so
         // the caller can fall back instead of recording a false negative.
+        // Empirical rejection signatures on gh 2.92.0: cert-identity,
+        // digest and signer-repo mismatches all print
+        //   Error: verifying with issuer "sigstore.dev"
+        // and missing subjects print "no attestations found". Version-coupled;
+        // revisit on gh upgrades.
         let lower = trimmed.to_lowercase();
-        let definitive =
-            lower.contains("verif") && (lower.contains("fail") || lower.contains("none of the"));
+        let definitive = lower.contains("verifying with issuer")
+            || lower.contains("no attestations found")
+            || (lower.contains("verif")
+                && (lower.contains("fail") || lower.contains("none of the")));
 
         if definitive {
             Ok(Json(GithubAttestationResponse {