OSPS-AC-01.01 is always ERROR on a user-owned repository (owner-type detection, follow-up to #467) #580

Summary

On a repository owned by a user account, OSPS-AC-01.01 is always ERROR, and the message reads like a failed API call:

$ darnit audit -f openssf-baseline --include OSPS-AC-01.01 <checkout of Marc-cn/SSI>
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=unavailable): Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404
WARNING: OSPS-AC-01.01: gh_api handler could not complete (error_class=evaluation): Could not evaluate expr over the response from /user: CEL evaluation failed: ("no such member in mapping: 'two_factor_authentication'", ...
Total: 1 | Pass: 0 | Fail: 0 | Warn: 0 | N/A: 0 | Error: 1 | Pending: 0
  ! OSPS-AC-01.01: ERROR [unavailable] - Platform API call /orgs/Marc-cn could not be measured (unavailable): HTTP 404

gh api /repos/Marc-cn/SSI --jq .owner.type returns User.

What is by design

The control's TOML says "404 (a user, not an org) and 401/403 are ERROR, never FAIL", and the /user step is evidence only, so that the auditor's own 2FA can never produce a PASS. That is the fix for #467 and it should stay.

What is missing

This is the follow-up #467 describes: PR #271 "promised a follow-up issue for owner-type detection; none was filed", and #467's suggested direction includes "Gate the /user fallback on the owner being a User account (owner.type from /repos/{owner}/{repo} is already fetched elsewhere in the audit)".

Without it, on a user-owned repository:

1. The org step asks /orgs/<user>, which can only 404. The result is ERROR with a message about an unreachable platform. Nothing says "this owner is a user, so there is no organization setting to check".
2. The help text says "a person confirms the control for a user-owned repository", but the audit result does not lead there. An agent reading the result (Claude Code, in my case) reported it as an API error and suggested confirming MFA by hand, which is the right conclusion reached by guessing.
3. With a default gh auth login, the /user step errors as well, because the token has no read:user scope and the field is absent. So even the evidence is not recorded unless the user knows to run gh auth refresh -s read:user.

Suggested direction

• Detect the owner type once (from /repos/{owner}/{repo}) and make it available to the control.
• For a User owner: do not call /orgs/<owner>. Conclude a "needs confirmation by a person" result (WARN, or whatever fits the result-authority contract), with the /user response as evidence when the field is visible, and a message that says the repository is user-owned.
• For an Organization owner: unchanged.
• When /user has no two_factor_authentication field, say that the read:user scope is missing instead of reporting a CEL evaluation error.

Which status a user-owned repository should get is a design decision for this control, so I have not sent a PR.

Environment

darnit main at 24a4fed, RHEL 10.2, gh 2.102.0 logged in with scopes gist, read:org, repo, workflow.

Drafted with Claude; reviewed and filed by me.