Skip to content

org-required-workflow-rollout.md

Latest commit

 

History

History
433 lines (382 loc) · 60.9 KB

org-required-workflow-rollout.md

File metadata and controls

433 lines (382 loc) · 60.9 KB
Raw

ContextualWisdomLab central required workflow rollout

Updated: 2026-09-04 KST

Decision

Use an organization repository ruleset instead of copying workflow files into each repository.

  • Ruleset: CWL Central required workflows
  • Ruleset ID: 18156473
  • Enforcement: active
  • Target: branch rules on every repository's default branch (repository_name.include=["~ALL"], ref_name.include=["~DEFAULT_BRANCH"])
  • Required workflow source repository: ContextualWisdomLab/.github
  • Required workflow source repository ID: 1274066402
  • Canonical required workflow paths (seven entries):
    • .github/workflows/codeql-pr.yml
    • .github/workflows/noema-review.yml
    • .github/workflows/opencode-review.yml
    • .github/workflows/pr-review-merge-scheduler.yml
    • .github/workflows/security-scan.yml
    • .github/workflows/strix.yml
    • .github/workflows/sast-semgrep.yml
  • Required workflow ref: refs/heads/main
  • Last verified workflow implementation base commit: 050e6d59b0de9e62c8413d5f8f26f4f2f9ebea09 (ContextualWisdomLab/.github#584)
  • Required workflow trigger support: pull_request, pull_request_target, push, workflow_run

The required-workflow implementation is current through merged ContextualWisdomLab/.github#584 plus the later governance and security repairs recorded below. The ruleset points at .github@main; if live organization ruleset inspection reports another ref, treat that as operations drift and restore ruleset 18156473 to the current main head.

This keeps Strix security evidence, OpenCode and independent Noema review evidence, and merge/update automation sourced from the central .github repository. Target repositories do not need local copies of these workflows for the organization required workflow rule, and new repositories inherit the rule without a repository-name list update.

Empty non-draft pull requests are closed by the existing metadata-only pr-review-merge-scheduler.yml scan after an exact-head REST recheck. The former standalone required workflow was removed so the same PR no longer consumes a second runner for the same metadata decision.

The central security-scan.yml and sast-semgrep.yml pull-request triggers are base-ref agnostic. They therefore also run for stacked pull requests targeting a feature branch; the organization ruleset's protected-ref scope remains an independent administrative control and is not weakened by this trigger coverage.

Stacked pull requests are audited by organization ruleset CWL Stacked OpenCode required workflow (21732164) in evaluate mode. It targets every non-default branch and references only .github/workflows/opencode-review.yml from .github@refs/heads/main. Its observed scope is ref_name.include=["~ALL"] with ref_name.exclude=["~DEFAULT_BRANCH"]. Active enforcement over every non-default ref is prohibited: GitHub evaluates the ref update before a pull_request_target.synchronize run can exist for the new commit, so it rejects both initial branch creation and later review fixes. Exact-head OpenCode evidence remains a merge requirement enforced by the normal PR procedure while a target-ref-scoped enforcement design is developed.

OpenCode required workflow posture

The central .github/workflows/opencode-review.yml is now part of the active organization required workflow ruleset.

  • Required workflow trigger support: metadata-only pull_request_target; the file contains no checkout, PR-head execution, or secret expression
  • Stable branch-protection job names: required-workflow-bootstrap, coverage-source-tree, coverage-evidence, and opencode-review; these jobs are data-only sentinels, while approval remains a separate current-head PR-review requirement
  • Trusted source: ContextualWisdomLab/.github
  • PR-head handling: authenticated current-head repository_dispatch runs .github/workflows/opencode-review-dispatch.yml from the protected default branch; that workflow owns metadata validation, bounded coverage, source-as-data inspection, model review, and publication
  • Manual target support: the central scheduler sends exact repository, PR, base, and head metadata through repository_dispatch; the dispatch workflow rejects an unauthorized actor, an unallowlisted base repository, a malformed head-repository identity, or any live base/head metadata mismatch. A canonical fork head remains reviewable as untrusted source data.
  • Model token posture: use the organization STRIX_GITHUB_MODELS_TOKEN secret for GitHub Models calls, with github.token as the fallback; live workflow evidence showed github.token alone can return 403 from models.github.ai/inference
  • Write posture: OpenCode may create review/comment side effects through the OpenCode app token when available; the workflow token is limited to the same-repository PR context and publication failures remain visible
  • Coverage execution posture: PR-controlled package, test, build, R, Rust, and Docker inputs are never executed from pull_request_target; the dispatch workflow runs bounded low-privilege coverage only after exact live metadata and scheduler identity validation
  • Fork posture: PR heads are fetched through refs/pull/<number>/head when direct head-SHA fetch is not available, so review can inspect fork PR source as data without executing it in the trusted workflow context
  • Runtime posture: pre-model failed-check evidence waits are capped at about five minutes; the later approval gate rechecks current-head peer checks and extends its bounded wait only while image-validation checks remain pending, logging the reason before approval
  • Model-exhaustion posture: command exit codes and deterministic checks cannot synthesize an approval. Exhaustion remains MODEL_OUTPUT_UNAVAILABLE; only a prior real-model approval bound to the exact current head can satisfy the review gate after all checks, alerts, and threads are revalidated.
  • Adversarial-evidence posture: every probe must cite its exact changed path and positive in-range line in the materialized current-head source tree. Unrelated paths, nonexistent lines, circular claims, and missing observed results fail closed with a concrete rejection reason.

For a bounded current-head retry in one repository, dispatch merge-scheduler to the central repository with target_repository, pr_number, and the live base_branch. The target must exactly match OPENCODE_REPOSITORY_DISPATCH_TARGETS; the scheduler then re-reads the open PR and rejects a noncanonical base or head repository name, base mismatch, malformed head SHA, or changed/closed PR before using cross-repository credentials. A fork head may pass this read/review boundary, but the scheduler still excludes it from direct merge, auto-merge, and non-maintainer branch mutation:

jq -n '{
  event_type: "merge-scheduler",
  client_payload: {
    target_repository: "ContextualWisdomLab/naruon",
    pr_number: 1179,
    base_branch: "develop",
    trigger_reviews: true,
    review_dispatch_limit: "1",
    enable_auto_merge: false,
    update_branches: false,
    merge_mode: "disabled"
  }
}' | gh api --method POST \
  repos/ContextualWisdomLab/.github/dispatches --input -

Use the canonical full_name returned by the GitHub repository API. Keep mutation options disabled for an evidence-only retry; enabling branch updates or merge behavior is a separate operational decision.

Keep the OpenCode required workflow active only while the central workflow keeps proving current-head coverage, CodeGraph initialization, bounded evidence, model review output, and approval-gate publication on the current head.

Code scanning required workflow posture

Correction (2026-09-04): restore the dispatch-safe CodeQL entrypoint. The 2026-09-03 removal was correct for the old workflow, which called github/codeql-action directly and always failed at startup. The current codeql-pr.yml contains no such action. It validates the exact live head, dispatches the scan to the native codeql-scan-dispatch.yml, and waits for an app-authored codeql-dispatch/<language> status. Ruleset 18156473 must require this dispatch-safe entrypoint after its audit contract reaches protected main. The scheduler may then same-tree restamp a future CodeQL startup_failure just like any other pre-job failure. Native default setup remains a repository-local safety net; it does not replace the central required gate. Do not add any workflow that invokes github/codeql-action directly to a required-workflow ruleset. The org's default_for_new_repos: "all" policy (configuration 17, "GitHub recommended") is supposed to make this automatic for every newly created repository, but item 41's investigation confirmed it is empirically unreliable for this org: 11 non-fork repositories created between 2026-05-09 and 2026-08-18 — well after that policy's own updated_at of 2025-03-04 — never received it. Closing that specific gap (a periodic reconciliation sweep, vs. this org's stated aversion to more scheduled workflows for rate-limit reasons) is recorded as still open in docs/product-technical-gap-baseline.md's item 41 entry, not decided here.

The central .github/workflows/security-scan.yml supplies PR-head OSV and Scorecard evidence in one required workflow. The former standalone PR workflows were retired after the live ruleset and .github classic branch protection stopped requiring their duplicate contexts. .github/workflows/codeql-pr.yml used the same trigger shape and merge-preview technique (checking out refs/pull/<n>/merge and uploading SARIF with sha: pull_request.merge_commit_sha because the ruleset evaluates that commit, not the ephemeral merge ref OID) before its removal above.

Repository-local CodeQL and native default setup may coexist with the central gate only when they do not compete to upload the same SARIF. The central native dispatch handler analyzes the target head without making the target repository's default-setup upload path its source of truth.

Repository-local CodeQL inventory (2026-07-04) — HISTORICAL

This subsection records the original July rollout, not current guidance. That plan invoked github/codeql-action directly inside a required workflow, which GitHub does not support. The old entrypoint was removed on 2026-09-03. The 2026-09-04 correction above restores a different, dispatch-safe codeql-pr.yml: it sends the scan to a native workflow and consumes an app-authored exact-head status. This restored entrypoint is in the current seven-workflow ruleset. Native default setup is a repository-local safety net, not a replacement for that central gate. The table below remains only the 2026-07-04 snapshot of repositories with a local codeql.yml; it does not identify present-day adoption gaps.

Org audit of default-branch workflow files as of 2026-07-04.

Repository Default branch Local CodeQL workflow PR trigger merge_commit_sha SARIF
aFIPC master codeql.yml yes no
bandscope develop codeql.yml yes no
newsdom-api develop codeql.yml yes no
pg-erd-cloud main codeql.yml, codeql-backfill.yml yes (codeql.yml) no
xtrmLLMBatchPython develop codeql.yml yes no
naruon develop codeql.yml yes (temporary; PR #916 retires PR trigger) yes (repo-local interim fix)
all other public non-fork org repos varies none observed as of 2026-07-04 — —

No repository-local PR CodeQL workflow besides naruon uploaded merge-preview SARIF on merge_commit_sha as of this 2026-07-04 snapshot. The plan at the time was that centralizing through codeql-pr.yml would fix every inherited repository in one ruleset change; per-repo deletion of PR triggers was intended as optional cleanup to avoid duplicate scans. Neither happened — see the historical marker above.

Audit tool coverage

scripts/ci/audit_central_required_workflows.py defines all nine canonical required workflow paths (codeql-pr.yml deliberately excluded, per the 2026-09-03 correction above) and treats the live policy as an exact inventory: every required path must appear exactly once with repository id 1274066402 and refs/heads/main, while any additional well-formed workflow path — including a re-added codeql-pr.yml — is reported as unexpected workflow present in required set drift instead of silently passing. A malformed workflow entry (not an object, or missing a string path) is now reported by its index (central required workflow entry N is malformed) instead of being silently skipped, so a structurally broken ruleset payload surfaces as loud audit failures rather than a quietly incomplete inventory check.

tests/test_central_required_workflow_exact_inventory.py pins the full nine-path oracle independently of the production tuple, proves the independent payload passes, and proves an extra live workflow fails. This prevents a future edit to REQUIRED_WORKFLOW_PATHS from silently rewriting the only happy-path fixture. The scheduled audit and rollout-document tests continue to assert the canonical code-scanning paths explicitly.

Scheduler required workflow posture

The central .github/workflows/pr-review-merge-scheduler.yml is now part of the active organization required workflow ruleset.

  • Required workflow trigger support: pull_request_target
  • Stable required check job name: scan-pr-queue
  • Trusted source: ContextualWisdomLab/.github
  • PR-event scope: when GitHub invokes the workflow for a PR, the scheduler passes --pr-number and inspects only that PR instead of scanning or mutating the whole repository queue
  • Token posture: the workflow passes the first available mutation credential in this order: PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, exchanged OpenCode GitHub App token, then the target repository workflow token. The scheduler reports the non-secret token source and expected actor class in every mutation decision.
  • Flow posture: default branches named main or master are treated as GitHub Flow; default branches named develop are treated as Git Flow unless a repository explicitly sets PROJECT_FLOW
  • Merge posture: the default merge mode is direct_or_auto. When a current-head approved PR is same-repository and the scheduler has no failed-check, action-required, unresolved-thread, or conflict blocker, it requests an immediate guarded squash merge with --match-head-commit. This includes PRs where native GitHub auto-merge is already enabled; native auto-merge is a fallback queue, not the scheduler's first stop when direct merge is possible.
  • Fork posture: fork or external-head PRs remain reviewable, but the scheduler does not direct-merge them and does not enable auto-merge for them. A maintainer must make the final merge decision after same-head OpenCode approval, same-head Strix evidence, required checks, and unresolved-thread checks are clean.
  • Branch freshness posture: the scheduler also runs after protected base-branch pushes to main, develop, or master, because those pushes can create the GitHub UI state where reviews are satisfied, auto-merge is enabled, checks are stale or failed, and the PR shows Update branch without a PR synchronize event.
  • Auto-merge posture: auto_merge_enabled PR events trigger the scheduler so an already stale branch is refreshed immediately after native auto-merge is turned on instead of waiting for the periodic schedule. If the same PR is already mergeable, the scheduler attempts the guarded direct merge immediately.
  • Automation boundary: current-head failed checks and ACTION_REQUIRED checks are reported before branch updates, so an update attempt does not hide the concrete reason a PR cannot merge. update-branch handles approved BEHIND PRs and already queued auto-merge PRs only when there is no current-head failed or action-required check to diagnose first. DIRTY or CONFLICTING PRs still require author or maintainer conflict resolution guidance; current-head approved conflicts may keep or queue native GitHub auto-merge as a wait state while the conflict is repaired, but the scheduler must not treat queued auto-merge as a conflict resolver.
  • Retry posture: before retrying OpenCode, the scheduler force-cancels older active OpenCode runs for the same PR number and a previous head SHA. It does not automatically cancel Strix runs because security evidence should not be silently discarded by force-push churn.

Do not centralize the scheduler by running a .github scheduled job against other repositories with the .github repository token. That would either fail permission checks or use the wrong mutation actor. The central path is a required workflow executed in each target repository context.

  • Recovery posture: native PR and review events own normal progress, GitHub auto-merge owns required-check completion, and each repository keeps one daily scan-pr-queue recovery. The central organization-wide polling job was removed because each invocation occupied a runner, walked every repository, and amplified the same Actions and API pressure it was intended to repair. Same-PR supersession remains with trigger-aware concurrency and the repository-local exact-head coalescer.

Second-reviewer (Noema) posture

The org's two-reviewer merge rule needs a second approving-review identity independent of OpenCode. That identity is cwl-noema-review[bot], supplied by the organization-owned cwl-noema-review GitHub App. The central workflow is an active organization required workflow. It runs the centrally versioned noema_review_gate.py judgement path and mints a short-lived installation token restricted to the target repository; the App has read-only Actions/checks/contents/status/code-scanning/Dependabot access and write access only to pull-request reviews.

The scheduler's independent-review gate recognizes this canonical App only when GitHub authenticates its bot actor, the attached review commit is the exact head, and the publisher's head/result/actor/App-source receipt agrees. The PR author cannot satisfy this condition, including alternate REST and GraphQL spellings of the same bot. Latest malformed formal approvals or revocations block older receipts; comments do not replace formal policy state. Other automation remains excluded. This reviewer eligibility does not replace GitHub approval policy, required checks, security evidence, resolved threads, or fresh head/base validation before a head-guarded merge.

The PydanticAI ReviewAgent product in ContextualWisdomLab/noema (reviewer/noema_reviewer, ContextualWisdomLab/noema#9) is the target standalone judgement plane, while the central Python gate remains the deployed fail-closed reviewer. The standalone package is not imported into the privileged workflow. External proof exists on ContextualWisdomLab/clearfolio#161: cwl-noema-review[bot] submitted an APPROVED review whose review commit, explicit Head SHA, current-head checks, SARIF/dependency evidence, test evidence, and review marker all bind to 4512fb9e9b56ab95df3acd85ebec2e6b849335a7.

  • Token posture: noema-review.yml prefers a NOEMA_REVIEW_TOKEN emergency fallback when present, otherwise mints the repository-scoped App token with actions/create-github-app-token pinned to an immutable SHA. The OIDC Worker exchange remains a compatibility fallback. If none of these identities is configured, the required check fails with the exact missing-credential reason; an unconfigured reviewer can never pass by skipping.
  • Honesty posture: noema_review_gate.py refuses to review as a primary review actor (opencode-agent, github-actions), so a NOEMA_REVIEW_TOKEN that resolves to one of those identities cannot manufacture a fake second review — it must be a distinct write-access identity.
  • Required admin config: install cwl-noema-review on the organization, set NOEMA_GITHUB_APP_CLIENT_ID plus NOEMA_GITHUB_APP_PRIVATE_KEY, and configure NOEMA_LLM_MODEL, NOEMA_LLM_API_URL, and either NOEMA_LLM_API_KEY or the shared OPENAI_API_KEY. Every missing setting is a visible failed-check reason.

Scope

The active ruleset uses repository_name.include=["~ALL"] together with the canonical exclusions .github, noema, and IRT-bibliography-set, matching scripts/ci/audit_central_required_workflows.py::EXPECTED_EXCLUSIONS and the live ruleset contract re-verified on 2026-09-03 KST. Every current or future organization repository outside that exclusion set inherits the nine central required workflows on its default branch — the workflow count itself is not fixed at the count an earlier inspection observed (seven, on 2026-07-02) or at ten (2026-09-02, before codeql-pr.yml's removal); see the "Active required workflow paths" list under Decision above for the current live count and treat that list, not this sentence, as the source of truth for how many workflows are currently required. The table below is the public non-fork inventory snapshot and rollout ledger, not the ruleset target list.

Repository Visibility Default branch Flow Open PRs Local central-workflow copies on default branch Rollout status
ContextualWisdomLab/.github public main GitHub Flow 27 central source; keep single source of truth; historical central PRs are evidence only; current PR state must be re-read before action
ContextualWisdomLab/aFIPC public master GitHub Flow 22 none central checks proven on PR #78; active queue still needs per-PR review
ContextualWisdomLab/pg-erd-cloud public main GitHub Flow 81 none repo-local autofix worker removed by PR #393; default branch now keeps only repository-owned application and security workflows
ContextualWisdomLab/fast-mlsirm public main GitHub Flow 25 none migrated; re-verify inherited checks on current open PRs
ContextualWisdomLab/bandscope public develop Git Flow 36 none no local central copies observed; verify inherited checks on active PRs
ContextualWisdomLab/contextual-orchestrator public main GitHub Flow 2 none default branch has no local central copies; current open PRs are runtime proof fixtures
ContextualWisdomLab/naruon public develop Git Flow 7 none default branch has no repo-local OpenCode, Strix, or scheduler copies; application/security workflows remain repository-owned
ContextualWisdomLab/newsdom-api public develop Git Flow 3 none local workflows already gone; re-verify inherited checks on current open PRs
ContextualWisdomLab/appguardrail public develop Git Flow 9 none migrated; re-verify inherited checks before final closure
ContextualWisdomLab/scopeweave public develop Git Flow 2 none local workflows already gone; re-verify inherited checks on current open PRs
ContextualWisdomLab/ContextualWisdomLab.github.io public main GitHub Flow 19 none migrated; re-verify inherited checks on current open PRs
ContextualWisdomLab/codec-carver public main GitHub Flow 42 none local workflows already gone; quality uplift still needs 100% test/docstring evidence before closure
ContextualWisdomLab/clearfolio public main GitHub Flow 57 none migrated; re-verify inherited checks before final closure
ContextualWisdomLab/semantic-data-portal public main GitHub Flow 3 none PR #3 merged; default branch has no local central copies
ContextualWisdomLab/hyosung-itx-slogan-brief public main GitHub Flow 1 none migrated; re-verify inherited checks on current open PR
ContextualWisdomLab/kaefa public develop Git Flow 6 none newly discovered public non-fork target; ruleset inherited but current PR #60 lacked central check runs in status rollup
ContextualWisdomLab/waf-ids-ai-soc public main GitHub Flow 1 none newly discovered public non-fork target; PR #6 merged after central workflow proof; PR #8 is now the open current-head runtime proof fixture

Current policy

  1. Security evidence, review evidence, and mechanical merge/update automation are centralized through the organization workflows ruleset rule.
  2. The central required workflows come from .github; repositories should not receive copied Strix, OpenCode, Noema, or scheduler workflow files only to satisfy this rollout.
  3. GitHub Flow repositories are those whose default branch is main or master.
  4. Git Flow repositories are those whose default branch is develop.
  5. OpenCode remains responsible for review judgment and structured decisions.
  6. GitHub Actions remains responsible for mechanical branch updates and merges.
  7. A merge is acceptable only when the current head has required checks passing, distinct current-head OpenCode and Noema approvals, no unresolved review threads, and a clean or mergeable merge state.
  8. Previous-head approvals or checks are not merge evidence.
  9. Same-repository approved PRs should merge immediately when GitHub reports CLEAN; fork or external-head PRs are excluded from scheduler merge and auto-merge.

Evidence from this rollout

  • On 2026-09-02 KST, live verification via gh api repos/<org>/<repo>/rules/branches/<branch> against six repositories (aFIPC, bandscope, newsdom-api, naruon, xtrmLLMBatchPython, pg-erd-cloud) found ruleset 18156473's workflows rule listed exactly the same seven required paths for every repository checked, and that codeql-pr.yml, scorecard-pr.yml, and osv-scanner-pr.yml were absent from all of them. This is historical pre-fix evidence, not the current operator state. The gap required org-admin action and was fixed later the same day.

  • On 2026-09-02 KST, later the same day, an organization administrator granted a session admin:org scope specifically to close the gap above. With that scope, gh api orgs/ContextualWisdomLab/rulesets/18156473 confirmed the same seven-path gap from the org side, and PUT /orgs/ContextualWisdomLab/rulesets/18156473 appended .github/workflows/codeql-pr.yml, .github/workflows/scorecard-pr.yml, and .github/workflows/osv-scanner-pr.yml (each pinned to ContextualWisdomLab/.github@refs/heads/main) to the ruleset's workflows rule, preserving every other existing path and rule field unchanged. The write was verified live from two independent angles: re-reading the org ruleset itself, and re-reading aFIPC's inherited dispatch list (gh api repos/ContextualWisdomLab/aFIPC/rules/branches/master) — both now show all ten required workflow paths. Interim restoration PRs ContextualWisdomLab/aFIPC#321, ContextualWisdomLab/bandscope#1144, and ContextualWisdomLab/pg-erd-cloud#1059 may be retired only after verified complete successor carryover of every unique valid delta; redundancy alone is not a close instruction.

  • On 2026-09-03 13:05 KST, the 23-repository CodeQL coverage gap recorded below was made permanently self-detecting instead of relying on another one-time manual sweep: scripts/ci/audit_org_codeql_coverage.py (pure audit_codeql_coverage(repositories) -> list[str] function plus a load_payload/parse_args/main CLI wrapper, 100% test and docstring coverage) flags any non-archived organization repository where both code-scanning/default-setup state is not configured and code-scanning/analyses?tool_name=CodeQL shows no recent run, exactly the two signals used to find the original 23 repositories; archived repositories are skipped, matching the trivy-sarif-repro exclusion below. The existing scheduled audit-central-ruleset.yml workflow (cron 11 2 * * *, plus repository_dispatch and relevant-path push) now also enumerates every organization repository via gh api --paginate "orgs/${ORG_LOGIN}/repos?type=all&per_page=100", probes both coverage signals per repository (tolerating a 404/403 on either endpoint as no-coverage rather than a hard failure), and pipes the result into this script. Like the existing ruleset audit, this is read-only: it reports drift with ERROR:/FAIL: lines and a nonzero exit code, and never mutates default-setup or repository settings itself — a newly created repository or one where default-setup is later disabled will now surface here on the next scheduled run instead of silently regressing.

  • On 2026-09-04 KST, backlog item 38 closed the remaining remediation gap. The same daily audit now exchanges its trusted-main OIDC identity for an OpenCode GitHub App installation token and runs scripts/ci/bootstrap_codeql_pull_requests.py before the final fail-closed audit. Each uncovered, non-archived repository receives at most one opencode/codeql-setup pull request against its exact default-branch SHA. The generated workflow queries GitHub's language statistics on every default-branch push and scheduled run, maps every CodeQL-supported language to its canonical identifier, always includes Actions analysis, and uses build-mode: none; it therefore adapts when the repository stack changes without executing repository build scripts or PR heads. Organization-required codeql-pr.yml remains the single PR scanner, avoiding duplicate local PR jobs. Existing open setup PRs are reused, an unexplained bot branch blocks rather than being overwritten, empty repositories wait for their first commit, and every action is pinned to a full commit SHA. The bootstrap treats the installation token as an opaque non-empty value and uses a multiline output, so neither the older fixed-length token nor GitHub's new stateless installation-token format is assumed. The trusted central workflow alone performs writes; it never checks out or executes a target repository's PR head.

  • On 2026-09-03 12:20 KST, ruleset 18156473 was updated to remove .github/workflows/codeql-pr.yml from its required workflows list, bringing the count to nine. Every ruleset-injected run of that workflow, in every one of the ~71 covered repositories, had concluded startup_failure with zero check runs ever created — the REST API surfaces no reason, but the run page's web UI "Annotations" panel does: github/codeql-action/init and github/codeql-action/analyze are categorically disallowed inside a required workflow, a GitHub platform restriction confirmed by independent web corroboration, not a defect in the workflow file's own content. Before treating removal as safe, real CodeQL coverage was ground-truth-verified (via code-scanning/analyses, not workflow-file-name pattern matching — some repositories run CodeQL from unexpectedly-named files, e.g. contextual-orchestrator's coverage comes from security.yml:codeql_analysis) across all 71 covered repositories: 48 already had real coverage from a local workflow or GitHub's native default-setup; 23 (CalendarWeave, ConceptWeave, DiagramWeave, ELUNVERA, EmbedRelay, LineageWeave, Orgmetra, OriginWeave, PolicyWeave, TEPP, accounting-information-platform, context-graph-contracts, disksage, enterprise-architecture-core, j-planner, learning-content-studio, learning-interoperability-contracts, learning-management-platform, learning-record-store, life-os, pingora-gateway, quarantine-sandbox-runtime, supply-chain-control-plane) had none from any source and were given GitHub's native code-scanning/default-setup (trivy-sarif-repro excluded — an archived, explicitly-throwaway repro repository, not a real coverage gap). .github#1768 records this in docs/product-technical-gap-baseline.md.

  • On 2026-08-28 21:43 KST, ruleset 21732164 was created with active enforcement for every non-default branch. Reproduction on an existing LineageWeave PR head and a new branch returned GH013 before either ref could emit the required workflow event. The ruleset was returned to evaluate mode at 21:49 KST; the audit now fails if this impossible all-ref contract is reactivated.

  • On 2026-06-30 08:33 KST, organization ruleset 18156473 was changed from an explicit repository-name list to repository_name.include=["~ALL"] while keeping ref_name.include=["~DEFAULT_BRANCH"] and the same three central required workflow paths from .github@refs/heads/main.

  • On 2026-07-01 02:52 KST, ruleset 18156473 still reported enforcement=active, repository_name.include=["~ALL"], ref_name.include=["~DEFAULT_BRANCH"], and the three required workflow paths from ContextualWisdomLab/.github@refs/heads/main.

  • On 2026-07-01 06:30 KST, organization ruleset 18156473 still reported enforcement=active, repository_name.include=["~ALL"], ref_name.include=["~DEFAULT_BRANCH"], and the three required workflow paths from ContextualWisdomLab/.github@refs/heads/main.

  • On 2026-07-02 07:25 KST, organization ruleset 18156473 still reported enforcement=active, repository_name.include=["~ALL"], ref_name.include=["~DEFAULT_BRANCH"], and the same three required workflow paths from ContextualWisdomLab/.github@refs/heads/main.

  • On 2026-07-11 11:30 KST, organization ruleset 18156473 was normalized to keep the five central required workflows, stale-review dismissal, last-pusher protection, and review-thread resolution while setting required_approving_review_count=0 and require_code_owner_review=false. The merge gate remains current-head OpenCode approval plus required checks and scheduler evidence; the change removes self-authored/code-owner deadlocks that left approved PRs unable to merge.

  • On 2026-07-13 21:10 KST, live inspection found that sast-semgrep.yml described itself as the central replacement for removed repository-local Semgrep jobs but was absent from ruleset 18156473. The active ruleset was updated to require that workflow from .github@refs/heads/main, while preserving one approval, stale-review dismissal, last-push approval, and review-thread resolution. scripts/ci/audit_central_required_workflows.py and the scheduled ruleset audit now report each missing workflow, wrong source ref, weakened review protection, malformed/duplicate entry, or unexpected workflow explicitly.

  • On 2026-07-13 22:21 KST, the first main-branch ruleset audit proved that a repository GITHUB_TOKEN cannot read the organization-administration endpoint (HTTP 403 Resource not accessible by integration). The audit uses the least-privilege inherited-ruleset endpoint, logs RULESET_SCOPE for each enumerated repository, and validates the complete workflow and pull-request rule payload through naruon. The original public-only scope and its historical .github/argos/noema exclusions were superseded by the 2026-07-23 audit below.

  • On 2026-07-13 22:37 KST, xtrmLLMBatchPython current-head evidence proved that Semgrep 1.169.0 reports zero blocking findings while retaining 23 source-suppressed results in raw SARIF. The central gate now logs the suppressed count, removes only SARIF results carrying explicit in-source suppressions before upload, and fails from the remaining SARIF finding count even when Semgrep's SARIF-mode exit code is zero.

  • On 2026-07-16 14:18 KST, ContextualWisdomLab/clearfolio#161 proved the independent reviewer on exact current head 4512fb9e9b56ab95df3acd85ebec2e6b849335a7: cwl-noema-review[bot] submitted an APPROVED review whose body records the same Head SHA and cites the clean SARIF, dependency, test, and diff evidence.

  • On 2026-07-23 06:35 KST, ruleset 18156473 was updated to require .github/workflows/noema-review.yml, making seven central required workflows while preserving exactly two approvals, stale-review dismissal, last-push approval, review-thread resolution, and merge/squash-only policy. The all-repository scope excludes only .github, noema, and private IRT-bibliography-set; argos now inherits the ruleset. The scheduled audit now enumerates every organization repository visible to its credential (type=all), rather than only public repositories, so the private exclusion and all other visible private-repository inheritance are verified. Existing open PRs may need a new PR event or branch update before GitHub creates the newly required Noema run.

  • .github PR #225 raised high reasoning effort for all reasoning-capable OpenCode review model definitions and merged at 50c6ef82f52af3eeb0e58c174902fc9855c36682.

  • .github PR #226 stopped the merge scheduler from treating old deterministic fallback approval bodies as current-head approval evidence and merged at 57a1fa580731a0f76b31dcf29a597c5715dba2fd.

  • .github PR #230 added changed-file candidates to merge-conflict guidance so DIRTY or CONFLICTING PRs name the first files to inspect instead of giving only generic conflict instructions. It merged at 0cab5c8d46e88c1a3f68ef3f71b5d44d971cd2ef.

  • .github PR #232 removed the workflow-only deterministic approval fallback introduced by PR #231; model-pool exhaustion now stays on the fail-closed REQUEST_CHANGES path, and reasoning-capable OpenCode model candidates must have reasoningEffort: high before execution. It merged at f545a9917933f8f81a76ea0044cbce0aae1ac5bd.

  • .github PR #233 blocks false trivial approval reasons such as Typo fix in documentation string when current-head changed files include workflow, script/source, or test surfaces. It merged at 4ff660c8396b78a1b82aef8c316b26527864d450.

  • .github PR #234 made approval-summary repair parse bullet-form changed-file evidence from bounded review logs, so changed-file evidence is not lost when the evidence section is rendered as a Markdown list. It merged at da3a4a5788e7019229d66247c360b258b1a5b1f7.

  • .github PR #235 changed the post-approval OpenCode merge-scheduler follow-up to prefer the workflow github.token for same-repository mechanical merge/update mutations, keeping secret/app fallbacks for cross-repository manual dispatch. It merged at 482b05c6c11d9da9895246406aca1c3bd8f6a691.

  • .github PR #239 centralized the OpenCode reasoning-effort guard into scripts/ci/assert_opencode_reasoning_effort.py, reused it for the review model pool and failed-check diagnosis path, and merged at 2aa1fa36255a558bafca05567125ef7e44571976 after required OpenCode, Strix, Noema, coverage, and scheduler checks passed.

  • .github PR #242 added REST fallbacks for transient scheduler GraphQL read failures in open-PR and single-PR lookup paths, then merged at 0d2c6d9e7ae1bad947e7ee3629e2a412ac2ce248.

  • .github PR #244 added the central PR Review Autofix worker and changed the fix scheduler to dispatch the central .github autofix worker by default while preserving explicit target-repository overrides. It merged at 4d2dd64028231b1154642bfe23b822fc3403e217.

  • .github PR #246 hardened the OpenCode model pool after pg-erd-cloud PR #393 exposed model exhaustion: full review policy is kept on disk behind a compact launcher prompt, context-window overflow skips same-model retries, additional cataloged tool-calling models are included, reasoning-capable candidates keep reasoningEffort: high, and the model pool now has a five-hour total retry budget. It merged at f5f00b782ae4f7806f0e3197bf9b49c9c5a2cb91.

  • .github PR #247 was closed without merge because its reviewed-merge-update fallback would have approved a current head from previous-parent approval evidence after model exhaustion. That path conflicts with the current fail-closed policy: model timeout, model-pool exhaustion, or missing usable control output must lead to retry, alternate model execution, or a source-backed request for changes, not deterministic approval.

  • .github PR #249 guarded the central PR Review Fix Scheduler so CHANGES_REQUESTED review states dispatch the central autofix worker only when the latest OpenCode review is on the current head, the merge state is CLEAN or HAS_HOOKS, and the review body does not indicate process-only blockers such as merge conflict, model-pool exhaustion, unresolved human review threads, failed checks, coverage-evidence, or failed Strix evidence. It merged at dbd33b3a0384de0129aa082a210383188d012415 after current-head coverage-evidence, strix, opencode-review, noema-review, and scan-pr-queue all completed successfully.

  • .github PR #255 removed the remaining deterministic low-risk approval fallback from the OpenCode approval gate and changed coverage-evidence blocker handling to publish a REQUEST_CHANGES review event, producing the PR review state CHANGES_REQUESTED, instead of leaving only a failed check/log. It merged at e2beae72b87a8817cd57f9f51bab3947353baa61; the first current-head OpenCode run reached an APPROVE gate result but hit the OpenCode GitHub App installation rate limit while publishing the review, then a rerun published approval and native auto-merge completed.

  • .github PR #283 refreshed the central OpenCode model configuration so every reasoning-capable review candidate sets reasoning=true, options.reasoningEffort: high, and variants.high.reasoningEffort: high; non-reasoning fallback candidates remain available without a false effort claim. It merged at ef9950e6b55bf943c0295e1df3e34c94210d21cc.

  • After PR #255 merged, ContextualWisdomLab/bandscope PRs #493, #494, #495, and #500 were rechecked for branch freshness. Merge simulation against develop found real conflicts rather than update-branch candidates: #493 conflicts in apps/desktop/src/App.tsx plus the design-system docs, while #494, #495, and #500 conflict in docs/design-system/README.md, docs/design-system/component-contract.md, and docs/design-system/figma-to-code-workflow.md. Each PR received a corrected conflict-resolution comment with the exact file list and merge/rebase repair commands.

  • ContextualWisdomLab/aFIPC PR #78 is no longer a target-coverage gap. It merged after current-head central coverage-evidence, opencode-review, strix, and scan-pr-queue checks all passed on head b1ddafced86302f461e95259699f1efde5ec87c9; the OpenCode review approved the same head on 2026-06-30 06:02:55Z.

  • ContextualWisdomLab/pg-erd-cloud#393 removed the repo-local pr-review-autofix.yml worker after the central autofix worker merged. The first OpenCode run on head 9d8eed5be47670b1b46f413295d9a6044d7327b2 exhausted the older model pool and requested changes. After .github PR #246 merged, central OpenCode run 28485070313 approved the same head and the PR merged at 1e0d6a3dda5ea9afcd74dcd8380689672e1c8ef1 on 2026-07-01 00:33:50Z. Live default-branch content lookup returned 404 for .github/workflows/pr-review-autofix.yml after merge.

  • Live non-fork inventory on 2026-07-02 18:15 KST found 17 public non-fork repositories, inherited ruleset 18156473 on kaefa and waf-ids-ai-soc, and no default-branch copies of opencode-review.yml, strix.yml, or pr-review-merge-scheduler.yml outside .github.

  • ContextualWisdomLab/waf-ids-ai-soc PR #6 merged at e1c0a85fd4a8e6dd67039be43eb7f659fec22abd after central required workflow proof on head 43b62b5f347d1532c81b5ae38d8e41b4494fd486; PR #8 current head 48d8b56a0f995829fc95de4fed129d1c33aaadff is now the open runtime proof fixture with central and local Rust checks queued at the 2026-07-02 18:15 KST refresh.

  • ContextualWisdomLab/kaefa inherits ruleset 18156473, but PR #60 current head 13c9089855fcdd34391173560ccf6935bac1eebe showed only repo-local R-CMD-check, dependency-review, and CodeQL signals in status rollup. Treat this as a runtime proof gap until a new PR event or manual dispatch proves central OpenCode, Strix, and scheduler checks on a kaefa current head.

  • .github scheduler default merge mode is now direct_or_auto: approved same-repository CLEAN PRs request immediate guarded merge, approved non-clean same-repository PRs can queue native auto-merge, and fork or external-head PRs are left for maintainer merge.

  • OpenCode approval runs the trusted central merge scheduler script directly with pr_number and max_prs=1, so the just-reviewed PR is inspected immediately even when organization required workflows are not repo-local workflow_dispatch targets.

  • .github PR #74 changed OpenCode review model order to DeepSeek R1 first and added a catalog fallback pool.

  • .github PR #75 removed the Strix finding against the scheduler command wrapper by using subprocess.run(..., check=True) and preserving the existing scrubbed failure contract.

  • .github main Strix run 28218982899 passed after PR #75 merged.

  • .github PR #77 merged the central OpenCode required-workflow path.

  • .github PR #77 same-head OpenCode proof run 28224085121 passed coverage evidence, CodeGraph initialization, bounded evidence preparation, model review, review comment publication, and approval-gate publication on head 59a8da0b2f56b862f6c5a0c69885f4045d6dc732.

  • .github PR #77 central Strix required workflow run 28223698075 passed on the same head before merge.

  • Organization ruleset 18156473 was renamed to CWL Central required workflows and required .github/workflows/strix.yml and .github/workflows/opencode-review.yml from .github@main SHA 6440d493816f8a4d66e32f2e5e8e6a9156d7f488.

  • .github PR #79 merged the central scheduler pull_request_target path and PR-scoped --pr-number lookup.

  • .github PR #79 second current-head proof passed coverage evidence in 10s, Strix in 8m33s, and OpenCode review in 8m57s on head 17c62f3809c57ca4b1a9a63e14f325c9f2a1acdb.

  • Organization ruleset 18156473 now requires .github/workflows/strix.yml, .github/workflows/opencode-review.yml, and .github/workflows/pr-review-merge-scheduler.yml from .github@main SHA 807254a04efafd5f806e0f70cb067ecf050cfd11.

  • .github PR #85 installed target repository requirements.txt before Python coverage evidence, so central coverage measurement can run repo tests that require project dependencies.

  • .github PR #88 hardened the OpenCode output normalizer so the Python normalizer is part of the trusted approval gate path.

  • .github PR #94 hardened the central OpenCode prompt and generated review DAG contract so Mermaid labels are quoted and render safely.

  • .github PR #95 blocks OpenCode approvals that claim no source, test, or executable changes when exact changed-file evidence lists workflow, script, source, or test files.

  • On 2026-06-28 20:09 KST, ruleset 18156473 was re-pinned to .github@main SHA 531482764986bf7da98c1317d59e6e51e7c61d02 for all three required workflow paths.

  • ContextualWisdomLab/naruon reports inherited active ruleset 18156473 with all three required workflow paths, proving target-repository inheritance after the scheduler ruleset update.

  • ContextualWisdomLab/ContextualWisdomLab.github.io PR #25 merged the thin central scheduler caller and repository-local bootstrap fixes. Its main Strix run 28217860369 passed.

  • The organization ruleset API reports the central required workflows ruleset as active and inherited by each public non-fork target repository.

  • .github PR #100 added required-workflow job rerun support and cancels older same-PR OpenCode runs before retrying the current head. Local verification on head 3c62c37a4deabdb0c6ed4ddf0951c1987f09866b: pytest -q passed 38 tests, coverage report --fail-under=100 reported 100%, interrogate --fail-under=100 . reported 100%.

  • .github PR #100 merged at 2026-06-29 05:45 KST with merge commit 81408f3dbe0a3c43dc4b76133f72a5e314df8a10. A follow-up admin check should verify organization ruleset 18156473 is no longer pinned to refs/heads/codex/rerun-required-opencode-job.

  • The earlier 2026-06-29 KST aFIPC PR #78 target-coverage gap is closed. A later current-head run on b1ddafced86302f461e95259699f1efde5ec87c9 produced central coverage-evidence, opencode-review, strix, and scan-pr-queue success before merge.

  • .github PR #136 changed approved stale PR handling so BEHIND branches are updated before failed-check or ACTION_REQUIRED decisions disable auto-merge.

  • .github PR #137 made the central PR Review Fix Scheduler target-repository aware through workflow_call, workflow_dispatch, schedule, and .github repository variables. .github variables currently target ContextualWisdomLab/pg-erd-cloud on main. The follow-up central autofix worker makes ContextualWisdomLab/.github the default autofix_repository, so target repositories no longer need to copy a full pr-review-autofix.yml worker to participate.

  • .github PR #138 added compare-API branch freshness evidence so approved PRs with auto-merge enabled can still receive update-branch when GitHub reports BLOCKED but the base branch is ahead. Local verification passed pytest -q, scheduler self-test, py_compile, 100% coverage, 100% docstring coverage, actionlint, bash -n, and git diff --check.

  • .github PR #140 extended update-branch handling to PRs where auto-merge is already enabled even if the scheduler cannot find a current-head OpenCode approval node, so queued auto-merge PRs with failed checks can still be refreshed when compare evidence shows the base branch is ahead. Local verification passed pytest -q, coverage report at 100%, interrogate at 100%, py_compile, bash -n, and git diff --check.

  • .github PR #145 treats compare API status: behind as branch-staleness evidence even when behind_by is missing or zero, so an auto-merge-enabled PR with failed checks and a visible GitHub "Update branch" action requests update_branch before disabling auto-merge. It merged at 2026-06-29 23:14 KST with merge commit 1ec0f3dcc7250fdf4a5a3ec6c26feaa98cce4f48.

  • Live dry runs on 2026-06-30 00:40 KST found update-branch candidates in .github PR #147 and naruon PR #803. The follow-up scheduler trigger change runs the central queue scan after base-branch pushes and auto_merge_enabled events, so those UI-visible stale-branch states are not left waiting only for the periodic schedule.

  • .github PR #151 added protected base-branch push triggers and the auto_merge_enabled PR event to the central scheduler, then merged at 2026-06-30 00:56 KST with merge commit 00018f7783522447a71acd08a946e3504e18ff74. The merge created push-triggered scheduler run 28385177585, proving the new trigger path is registered; the job remained queued because runner assignment was still pending.

  • The earlier compare API behind handling is superseded by the current immediate-action order: CLEAN and current-head approved PRs merge before update-branch, failed or ACTION_REQUIRED checks are surfaced before any update attempt, and only approved BEHIND PRs without current-head check blockers request update-branch through the configured scheduler mutation credential.

  • .github PR #146 taught central OpenCode coverage-evidence to discover nested requirements-only Python test projects such as backend/requirements.txt plus backend/tests, install those requirements, and run tests from that project directory. It merged at 2026-06-29 23:24 KST with merge commit 0393bc1c48b80597d6d35c336aca43aee18e22b9.

  • .github PR #149 tightened the central OpenCode model-failure path and merged at 2026-06-30 00:26 KST with merge commit 919b83faf29237803cfdd0cfd6febbe5ae1a8a3c. The follow-up commit 6fdffe43b50a2246b3db2790a0ab532618a89c2b fixed the fallback approval path so pending-check and human-thread evidence are written to real temporary files instead of empty paths. Local verification passed pytest -q, coverage report --fail-under=100, interrogate --fail-under=100, actionlint -shellcheck=, targeted OpenCode quick-gate assertions, bash -n, and git diff --check; the full quick-gate script exceeded the local 300s timeout in this environment.

  • Organization ruleset 18156473 previously targeted all live non-fork repositories, including private aFIPC, linux-cluster-ops, and xtrmLLMBatchPython; this has been superseded by the all-repository ~ALL condition above.

  • ContextualWisdomLab/semantic-data-portal PR #3 removed repo-local OpenCode, Strix, and scheduler workflows; the default branch now has no .github/workflows directory.

  • ContextualWisdomLab/pg-erd-cloud PR #361 removed the repo-local pr-review-fix-scheduler.yml wrapper after central .github gained target repository support. It merged at 2026-06-29 22:40 KST with merge commit 21cbc14b21d59ac28ac789de58502816cc8df6ad; live default-branch content lookup returned 404 for that wrapper path after merge.

  • ContextualWisdomLab/naruon classic branch protection no longer requires direct strix or opencode-review status checks on develop; after deletion, branches/develop/protection/required_status_checks returns 404 Required status checks not enabled, while org ruleset 18156473 remains active and still targets naruon.

  • ContextualWisdomLab/naruon PR #852 rewrites backend/tests/test_release_governance.py and docs/development/merge-gate-policy.md to make the central scheduler the contract, then deletes the repo-local pr-review-merge-scheduler.yml. The first current-head central coverage-evidence failed because nested backend/requirements.txt was not installed; .github PR #146 fixed that central path. PR #852 was pushed to head 2c8257ce0d02838b80650997d65e85569f4ab27f to generate fresh required workflows from the updated central main. The stale OpenCode CHANGES_REQUESTED review 4592643416 on previous head 0f103836f15d9055c4ed85152f925a6e9514adb2 was dismissed on 2026-06-30 00:25 KST; the PR now requires fresh current-head OpenCode/coverage evidence and still has queued coverage-evidence.

  • 2026-09-03 KST runner-admission repair (queue-congestion investigation: 9,368 checks queued organization-wide, roughly 3 in-progress, queue depth roughly equal to open-PR-count times required-workflow-count): live re-verification confirmed ruleset 18156473 (fetched via gh api orgs/ContextualWisdomLab/rulesets/18156473) covers exactly the same 10 workflows with repository_name.exclude=["noema",".github","IRT-bibliography-set"], .github's classic protection (fetched via gh api repos/ContextualWisdomLab/.github/branches/main/protection) requires exactly the same 14 named contexts with strict: true/enforce_admins: false, and bandscope's live workflow directory has no local codeql-pr.yml/strix.yml/security-scan.yml while ruleset-injected runs of all three exist there -- proving a trigger-level paths/paths-ignore filter on a required workflow is inert in 40+ repositories and would leave .github's classic contexts Pending forever. Decision: trigger-level path filtering on a required workflow is a no-go; job-level if: gating is the safe mechanism. A changed-scope job (byte-identical apart from one if: line) was added as the first job in security-scan.yml, sast-semgrep.yml, strix.yml, scorecard-pr.yml, and osv-scanner-pr.yml; downstream jobs gained needs: changed-scope plus an output-gated if:. codeql-pr.yml's detect-languages job gained the same classifier as a step, but analyze-head is gated at STEP level (not job level) because run 33708209086 proved a job-level skip on a job whose matrix comes from another job's output publishes the unexpanded ${{ matrix.language }} check-run name instead of the required CodeQL compatibility analysis (actions|python) contexts; analyze-merge (required nowhere) keeps a job-level guard. strix.yml keeps its existing paths-ignore: (the one documented exception -- verified via a live run-event census that its runs are native, not ruleset-injected, in the three excluded repositories) with corrected comments. sbom-generation.yml dropped its pull_request trigger for push+release only, since nothing gated on the PR-scoped SBOM artifact and its dependency-snapshot: true submission is the only feeder of the dependency graph sbom-inventory-scheduler.yml reads hourly -- a PR-head snapshot was polluting that graph. Every ruleset-injected CodeQL PR run observed in every covered repository (bandscope, naruon, aFIPC, pg-erd-cloud, xtrmLLMBatchPython) is startup_failure with zero check runs created; that is an independent, pre-existing, higher-priority blocker this repair does not fix (see docs/doctoring/required-workflow-path-filter-boundary.md, which also has the full live evidence and the doc/image pattern-list fix that replaced LICENSE.* -- it matches the executable LICENSE.py -- with explicit LICENSE/LICENSE.txt/COPYING/COPYING.txt/NOTICE/NOTICE.txt names). tests/test_docs_only_pr_runner_admission.py is the RED-first contract.

Good patterns to keep

  • naruon: separates PR Governance, OpenCode review, Strix evidence, and application CI into explicit checks.
  • .github: centralizes reusable workflow logic and review/merge scheduler code.
  • pg-erd-cloud: its previous repo-local autofix worker was folded into the central PR Review Autofix worker and removed from the repository by ContextualWisdomLab/pg-erd-cloud#393; keep only repository-specific application and security checks locally.
  • ContextualWisdomLab.github.io: thin caller pattern is acceptable for repository-local workflows only when GitHub does not offer an organization-level control. It should not be the default rollout mechanism.

Risks and follow-up

  • Existing open PRs may need a new push or base update before the latest required workflow SHA appears on their current head.
  • The central OpenCode workflow now routes model-backed review through the canonical contextual-orchestrator contract; model/provider selection and fallback belong to that owner boundary, not workflow-local heuristics or paid fallback.
  • The central OpenCode config includes a read-only code-reviewer subagent for focused review passes. The subagent may read, grep, glob, and run safe local verification commands, but it must not edit files, stage changes, commit, push, install dependencies, mutate branches, or touch production state.
  • OpenCode execution evidence must be sandboxed in the CI workspace or an isolated temporary directory, with a credential-scrubbed environment by default and no persistent mutation outside test caches or scratch files. Prefer python3 scripts/ci/sandboxed_verify.py --repo-root <reviewed worktree> -- <verification command> when the central helper is available, and cite its SANDBOXED_VERIFY_RESULT line. When repo-native verification legitimately needs network access or GitHub Secrets, pass only the needed names with --allow-env, record --network required, and explain it with --evidence-note without printing secret values. The helper does not replace existing bash, task, webfetch, websearch, lsp, CodeGraph, DeepWiki, Context7, or web_search review policy. If a verification cannot be sandboxed without changing the result, the review must say so instead of presenting an unsafe run as evidence.
  • Web application reviews should run backend, frontend, and repository-native E2E checks together through python3 scripts/ci/sandboxed_web_e2e.py --repo-root <reviewed worktree> --backend-cmd <backend command> --frontend-cmd <frontend command> --e2e-cmd <e2e command> when those contracts exist, then cite SANDBOXED_WEB_E2E_RESULT. If backend/frontend/E2E/readiness contracts are missing, the review must name the gap instead of treating unit or lint evidence as full E2E proof.
  • Bounded OpenCode evidence includes Review execution contracts, which inventories runtime matrices, package manifests, test, coverage, docstring, E2E, lint, security, Docker, and unpackaged-source gaps before the model chooses verification commands.
  • Generated OpenCode review DAGs must use quoted Mermaid labels such as A["text"]; unquoted labels with spaces, punctuation, parentheses, or file counts can fail to render.
  • OpenCode approval summaries must not contradict exact changed-file evidence by saying no source, test, or executable files changed when workflow, script, source, or test files are present.
  • OpenCode approval reasons must not trivialize material workflow, script/source, or test changes as docs-only, typo-only, or string-only changes. The normalizer now rejects those approvals before publication.
  • Same-repository post-approval merge/update follow-up should use the workflow github.token first so the mechanical actor is github-actions[bot]; cross-repository manual dispatch may still fall back to configured secrets or the OpenCode app token when the workflow token cannot mutate the target repository.
  • Do not copy central Strix, OpenCode, merge scheduler, fix scheduler, or autofix worker workflows into repositories. Repository-local application CI and security CI may remain when they are not substitutes for the central workflows.
  • The central autofix worker is for source-actionable current-head review findings. It must not treat model-pool exhaustion, missing approval evidence, unresolved human threads, failed checks, coverage-evidence, Strix failures, DIRTY, or CONFLICTING merge states as code-autofix requests; those states need retry, failed-check explanation, branch update, or conflict guidance instead.
  • pg-erd-cloud no longer has a repository-local pr-review-autofix.yml worker on its default branch. Live default-branch workflows after ContextualWisdomLab/pg-erd-cloud#393 are ci.yml, codeql-backfill.yml, codeql.yml, dependency-review.yml, and scorecard.yml.
  • Some repositories use classic branch protection while others use rulesets. Normalize branch protection into rulesets without removing repository-specific required application checks.
  • Existing PRs may not show newly inherited required workflows until a new PR event or branch update occurs, even though the org ruleset now uses the all-repository condition.