chore(autopilot-core): add codeowners, harden workflow permissions, extend operator timeout coverage

.github/CODEOWNERS

@@ -1 +1,2 @@
 * @Coding-Autopilot-System/core
+/.github/         @Coding-Autopilot-System/core

.github/workflows/autopilot-create-issue.yml

@@ -15,6 +15,7 @@ jobs:
   create-issue:
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Create or update issue
         uses: actions/github-script@v9

.github/workflows/autopilot-docs-daily.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       ORG: ${{ vars.ORG || github.repository_owner }}
       GH_TOKEN: ${{ secrets.ORG_READ_TOKEN || github.token }}

.github/workflows/autopilot-operator.yml

@@ -13,6 +13,8 @@ permissions:
 jobs:
   operator:
     runs-on: [self-hosted, Windows]
+    # Cover the intended batch work: clone, Codex, dependency install, and tests.
+    timeout-minutes: 60
     env:
       ORG: ${{ vars.ORG }}
       GH_TOKEN: ${{ secrets.ORG_AUTOPILOT_TOKEN }}

.github/workflows/autopilot-org-installer.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   installer:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       ORG: ${{ vars.ORG }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -4,10 +4,14 @@ on:
     branches: ["main", "master"]
   pull_request:
     branches: ["main", "master"]
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       actions: read
       contents: read

.github/workflows/pages.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v5
@@ -29,6 +30,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-lint.yml

@@ -3,9 +3,14 @@ on:
   pull_request:
     types: ['opened', 'edited', 'reopened', 'synchronize']
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/stale.yml

@@ -3,9 +3,15 @@ on:
   schedule:
     - cron: '30 1 * * *'
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/stale@v8
         with:

memory/examples/20260704_operator-timeout-safe.md

@@ -0,0 +1,8 @@
+# F-07 operator timeout safety
+
+Issue Description: The GitHub Actions operator job could time out after marking an issue `in-progress`, leaving it stranded until a later manual cleanup.
+State: The workflow timeout was too short for the intended batch work of clone, Codex, dependency install, and tests.
+Action: Increased `.github/workflows/autopilot-operator.yml` timeout to 60 minutes and added a contract assertion in `tests/contract-tests.ps1`.
+Result: The operator job now has enough time for its designed batch work, and CI prevents the timeout from being reduced unnoticed.
+Diff Patch: Updated the workflow timeout and added a workflow contract check.
+Rationale: Batch automation should not strand claim-state on a predictable timeout boundary.

tests/contract-tests.ps1

@@ -23,6 +23,7 @@ Assert-TextMatch -Text $operator -Pattern 'Assert-SafeChangeSet' -Message "Opera
 Assert-TextMatch -Text $operator -Pattern 'ALLOW_UNVERIFIED' -Message "Operator must enforce verification by default."
 Assert-TextMatch -Text $workflow -Pattern 'secrets\.ORG_AUTOPILOT_TOKEN' -Message "Workflow must use an explicit org mutation token."
 Assert-TextNotMatch -Text $workflow -Pattern 'GH_TOKEN: \$\{\{ secrets\.GITHUB_TOKEN \}\}' -Message "Workflow must not use repository token for org mutations."
+Assert-TextMatch -Text $workflow -Pattern 'timeout-minutes: 60' -Message "Operator workflow must allow enough time for the intended batch work."
 
 Assert-TextNotMatch -Text $installer -Pattern 'autofix,queued,docs' -Message "Installer must not queue automation before repository opt-in."