fix(portfolio): bind security cohort to live identities

config/portfolio-catalog.yaml

@@ -971,6 +971,8 @@ repos:
     automation_eligible: false
     doctor_standard: basic
     notes: Lane is live end-to-end as of 2026-06-12; keep residual hardening, policy widening, and hook deployment under explicit operator review.
+    aliases:
+      - egress-guard-oss
   da-scaffold:
     owner: d
     lifecycle_state: archived
@@ -1271,12 +1273,6 @@ repos:
     review_cadence: weekly
     operating_path: finish
     maturity_program: finish
-  egress-guard-oss:
-    owner: d
-    lifecycle_state: active
-    review_cadence: weekly
-    operating_path: finish
-    maturity_program: finish
   proof-pr:
     owner: d
     lifecycle_state: active

src/github_security_coverage.py

@@ -31,7 +31,7 @@
 DEFAULT_ATTENTION_STATES = frozenset(
     {"active-product", "active-infra", "decision-needed"}
 )
-DEFAULT_EXPECTED_GITHUB_COHORT_COUNT = 9
+DEFAULT_EXPECTED_GITHUB_COHORT_COUNT = 11
 PROVIDER_NAMES = ("dependabot", "code_scanning", "secret_scanning")
 ELIGIBILITY_SOURCE = "github-account-repository-preflight-v1"
 ELIGIBILITY_REASON = "private_user_repo_plan_unavailable"
@@ -431,19 +431,23 @@ def derive_default_attention_cohort(
     *,
     expected_count: int = DEFAULT_EXPECTED_GITHUB_COHORT_COUNT,
 ) -> tuple[str, ...]:
-    """Return the repo-backed default-attention cohort, failing on expansion."""
+    """Return the repo-backed default-attention cohort, failing on size drift."""
     repos: list[str] = []
     for project in portfolio_truth.get("projects") or []:
         if not isinstance(project, dict):
             continue
+        identity = _mapping(project.get("identity"))
+        project_key = _text(identity.get("project_key"))
+        repo_full_name = _text(identity.get("repo_full_name"))
+        if project_key.startswith("supp:") and repo_full_name:
+            raise SecurityCoverageError(
+                "supplementary project identity cannot declare a repository: "
+                f"{project_key}"
+            )
         derived = _mapping(project.get("derived"))
         if derived.get("attention_state") not in DEFAULT_ATTENTION_STATES:
             continue
-        identity = _mapping(project.get("identity"))
-        repo_full_name = identity.get("repo_full_name")
-        if not _text(repo_full_name) and _text(identity.get("project_key")).startswith(
-            "supp:"
-        ):
+        if project_key.startswith("supp:"):
             # Supplementary projects such as personal-ops are real portfolio
             # identities, but they do not have a GitHub repository to query.
             continue