fix(governance): automate ruleset owner-plane reconciliation

[seonghobae]

Current authoritative execution receipt — 2026-09-12

• Exact head: 722fec9de67aece7500993ee2999b21df0fab83b; protected base: main@fb17ef556f94f673234aa557254ae52779e9a7b0; exact tree: 629fc3684bcfca48b66146ccda0f1b70956cdf4a.
• Noema's current-head masking finding was reproduced RED, then repaired by accumulating named central, owner-repository, and stacked-ruleset failures before one terminal fail-closed exit. Missing payloads are never audited as valid.
• Exact-tree verification: focused governance contracts 55 passed; full 3195 passed, 1 skipped, 36 subtests; warnings-as-errors, workflow syntax, and git diff --check PASS.
• State: Draft/Proposed while exact-head hosted Checks and a qualifying independent approval are reacquired. All predecessor hosted results and reviews are non-authoritative.

---

Buyer/control-plane outcome

This is the owner-plane writer for the live ruleset drift blocking Orgmetra's ordinary protected merge canary. Source integration alone does not mutate live settings: privileged apply remains disabled unless trusted protected main has CWL_RULESET_RECONCILE_ENABLED=true and the protected ruleset-governance-maintenance environment supplies a separately provisioned least-privilege CWL_RULESET_ADMIN_TOKEN with Administration write authority.

Reviewed implementation boundary

• config/ruleset-governance.json binds exactly repository ruleset 17921150 and organization ruleset 18156473.
• The canonical policy is the solo-maintainer contract: approval count 0, last-push and same-author CODEOWNER approval disabled, no synthetic required reviewers, stale-review dismissal and thread resolution retained, merge/squash only, deletion/non-fast-forward retained, and routine bypass actors forbidden.
• The reconciler validates exact live target identity and invokes the canonical ruleset auditors against projected and post-write live-shaped payloads so unmanaged scope/workflow/protection drift cannot be mislabeled as convergence.
• GitHub exposes no conditional unsafe PUT precondition for these ruleset updates. A second live read detects visible drift but is not represented as compare-and-swap.
• Privileged mutation samples immutable ruleset history before its final live read and binds both CLI and callable mutation paths to an exact protected-main SHA. Ambiguous mutation results are settled from live state plus immutable history rather than blindly retried.
• Collision recovery follows immutable predecessor evidence, preserves newer administrator state, settles ambiguous recovery writes across the bounded observation horizon before any subsequent PUT, and rechecks version state after settlement before trusting the restore.
• Visible current-state changes are checked before a recovery write; protected-main freshness is then checked immediately before that privileged write. Once an earlier PUT may already have been accepted, history settlement and lossless compensation finish without a stale-main veto so an overwritten administrator predecessor is not stranded.
• Privileged non-PR owner-plane runs share one serialized non-cancellable concurrency group; read-only PR validation may supersede itself.
• Pull-request validation uses pinned actions and hash-locked tooling, verifies exact checkout, executes the permanent governance/adversarial suites, and enforces 100% owned statement/branch/docstring gates without persisted checkout credentials.
• The source-derived two-target critical-section bound is 7,680 seconds / 128 minutes; the apply job uses GitHub's documented 360-minute hosted-job ceiling rather than inventing a smaller setup allowance.
• Doctoring records the REST/history authority boundary, timeout/collision semantics, current GitHub Actions execution limits, NIST SP 800-53 Rev. 5 AC-6/CM-3, and Sinan, Shahin, and Gondal (2025) in APA 7th form.

Live drift and acceptance boundary

Live settings must be re-read independently of source integration. The last verified state showed inherited organization ruleset 18156473 with required_approving_review_count=1 and routine OrganizationAdmin/always bypass, while .github repository ruleset 17921150 had approval 0/last-push false/CODEOWNER false but still permitted rebase and routine OrganizationAdmin/always bypass. This PR therefore has not completed settings reconciliation merely by changing source.

Require terminal successor-head security/review evidence before ordinary merge. After source reaches protected main, provision the distinct least-privilege owner-plane identity, enable reconciliation only for a controlled maintenance interval, require exact live payload plus immutable-history convergence, re-run the canonical audit, and prove unchanged deterministic-GREEN ContextualWisdomLab/Orgmetra#88@0dc4f09cc3c87829ea1e3a0e3dc0188df07ad8cd can take the ordinary protected merge path without synthetic approval or routine administrator bypass. Genuine failed/absent required workflows and unresolved required threads remain blocking.

Refs #772, #1176, #1340, #1351, #1669, #1728, #1731, #1734, ContextualWisdomLab/Orgmetra#89.

Summary by CodeRabbit

• 새 기능

  • 저장소 및 조직 규칙 세트를 선언적으로 관리하고 자동 검증·조정하는 거버넌스 기능이 추가되었습니다.
  • PR, 기본 브랜치 변경, 예약 실행 시 규칙 세트 검증이 자동 수행됩니다.
  • 기본 브랜치 보호와 필수 워크플로 정책이 강화되었습니다.
  • 규칙 세트 변경 충돌과 일시적 API 오류를 안전하게 확인하고 복구합니다.

• 문서

  • 필수 워크플로, 적용 범위, 검증 절차 및 운영 정책 문서가 최신화되었습니다.

• 품질 개선

  • 누락·비정상 규칙, 잘못된 병합 방식과 설정을 더 정확히 감지합니다.
  • 검증 결과를 누적해 모든 검사를 완료한 뒤 오류를 보고합니다.

[seonghobae]

Fresh Context Fabric dependency revalidation (2026-09-08 KST), owner-path evidence only; no central source/ref mutation from the product writer.

Protected .github/main is now exact 78a4937c684a54ca8e415822c913742f41c6efc4. #1644 remains Draft at exact 5f5d7a9e849984c052c72a08eba34f68cb694024, recorded base c9052e607e5f3cc76e73207e7786b21500721b79. Fresh compare 78a4937c...5f5d7a9e is diverged, ahead_by=246, behind_by=2, merge base exactly c9052e607e5f3cc76e73207e7786b21500721b79. The two protected-main commits after the recorded base must be adopted non-force before any old hosted evidence can authorize integration.

Exact current-head workflow reread for 5f5d7a9e...: Ruleset Governance Reconcile 34056427112 SUCCESS; SAST Semgrep 34056427200 SUCCESS; Python Security 34056427080 SUCCESS; Security Scan 34056427109 SUCCESS; CodeQL PR 34056427271 FAILURE. No predecessor result transfers after the required main adoption.

Context Fabric leaf state still requires the accepted owner sequence after this source reaches protected truth: reconcile #1644 non-force from current protected main and reacquire exact-head terminal gates; apply #772's canonical solo-maintainer ruleset repair through the separately authorized Administration-write maintenance path; then #1137 protects CGC/EA main first, switches each default to main, rereads effective ~DEFAULT_BRANCH, and hands fresh protected refs back for dependency-root-first stack reconstruction. Do not use the visible routine admin bypass and do not copy workflows back into obsolete develop merely to manufacture product evidence.

[seonghobae]

Exact-head execution receipt: ordinary parents 665adfbb220317daf8efae0124d7c2005fc5576b + protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, exact tree 8191b45cb3dbcc6a084107fc61e1c84afdf04f95. The protected #2028 CodeQL repair is preserved and the governance delta remains 21 paths. Local GREEN: governance focused 208 passed; owner reconciler 186 passed; full 3149 passed, 1 skipped, 21 subtests; diff check PASS. Hosted successor gates are nonterminal, so this COMMENT is evidence only and is not approval or merge authorization.

[seonghobae]

2026-09-12 current-main reconciliation receipt

• Protected main re-fetched immediately before mutation: cb0872c9a20d5584703dffacca65c096fc034c6c, tree 37ee29906af20396506b6d70b77bfe7cfb2ad154.
• Writer re-fetched unchanged: e35cdc5d6527dfa8634654719a6c3681f16ed82a.
• Protected-main changes since the prior merge base and this PR's effective 21 governance paths are disjoint.
• Created ordinary two-parent merge commit 702446b51691db0460e87729e7250b99853026b1 with parents e35cdc5d... and protected main@cb0872c...; branch update used force=false.
• Fresh compare reports behind_by=0; protected-main-relative diff remains exactly the same 21 governance owner paths. No concurrent protected-main delta was discarded.
• Fresh successor-head hosted evidence is reset: immediately after publication no workflow runs had materialized. Predecessor checks/reviews are not transferred; PR remains Draft.
• Live ruleset settings were not mutated. Source integration still must reach protected truth and then the separately provisioned least-privilege reconciliation identity must prove live convergence before GOV-01 can close.

[seonghobae]

REVIEW ADMISSION — unchanged exact head 702446b51691db0460e87729e7250b99853026b1 was moved from Draft to Ready after terminal SUCCESS of Ruleset Governance Reconcile 34681934901, Security 34681934913, SAST 34681934900, Python Security 34681934910, and CodeQL 34681934948, with unresolved thread count 0 and mergeable=true. The PR body’s stale 2026-09-08 authoritative receipt was replaced with the current 2026-09-12 head/base/tree/parent and Ready-generation run IDs. Ready is review admission only: fresh Security/SAST/Python Security/CodeQL runs are queued/in progress, qualifying current-head approval is absent, and source integration still does not prove live ruleset convergence or Orgmetra canary admission. No merge, auto-merge, settings apply, bypass, self-approval, rerun, empty commit, or source change was performed.

[seonghobae]

SOURCE WRITER RELEASE — ordinary non-force descendant 4d775cd1918177886b6303d4f807c5c098acb366 adopts protected main@691fb78932eff5fbe52db69077848134b0b4e053 with parents 702446b51691db0460e87729e7250b99853026b1 and 691fb78932eff5fbe52db69077848134b0b4e053; exact tree 62f32414dddf0b6c52c7cfccf48429bf903bb895. The only path overlap was CHANGELOG.md, which merged automatically while preserving the README-standard entry and all governance entries. Fresh merge-result evidence: governance-focused 189 passed; GITHUB_ACTIONS=true python -m pytest -q tests 3,193 passed, 1 skipped, 36 subtests; git diff --check PASS. Fresh compare is ahead 250 / behind 0 with the same 21 effective governance paths. New exact-head hosted runs are queued, unresolved threads are 0, and independent approval is absent. No predecessor Checks/reviews transfer; no settings mutation or merge is claimed.

[seonghobae]

Exact-head CodeQL RCA

Run 34685614235 is terminal FAILURE on unchanged head 4d775cd1918177886b6303d4f807c5c098acb366. Both required language shards ended with DISPATCH_OUTCOME=success and VERDICT_STATE=pending; the coordinator succeeded after binding the exact repository, protected base 691fb78932…, PR head, required run, required job IDs, and actions/python matrix. Jobs: python 103532524249, actions 103532524321, coordinator 103533306308.

All other current-head required workflows are SUCCESS. This remains a central authenticated terminal-settlement defect under active owner .github#2040; it is not bypassed, manually rerun, or substituted with predecessor evidence.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4d775cd1918177886b6303d4f807c5c098acb366.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34685614235/job/103534058894)
• CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34685614235/job/103534058894)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: audit-central-ruleset.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: audit-central-ruleset.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: ruleset-governance-reconcile.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: ruleset-governance-reconcile.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Repository file: CHANGELOG.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Repository file: ruleset-governance.json"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: ruleset-governance.json"]
  R4 --> V4["required checks"]
  Evidence --> S5["Docs: ruleset-owner-plane-reconciliation.md (2 files)"]
  S5 --> I5["operator or user guidance"]
  I5 --> R5["Review risk: Docs: ruleset-owner-plane-reconciliation.md (2 files)"]
  R5 --> V5["docs review"]
  Evidence --> S6["CI script: audit_central_required_workflows.py"]
  S6 --> I6["review and security gate shell path"]
  I6 --> R6["Review risk: CI script: audit_central_required_workflows.py"]
  R6 --> V6["bash -n plus Strix self-test"]
  Evidence --> S7["CI script: reconcile_ruleset_governance.py"]
  S7 --> I7["review and security gate shell path"]
  I7 --> R7["Review risk: CI script: reconcile_ruleset_governance.py"]
  R7 --> V7["bash -n plus Strix self-test"]
  Evidence --> S8["Test: test_central_required_workflow_exact_inventory.py (13 files)"]
  S8 --> I8["regression suite"]
  I8 --> R8["Review risk: Test: test_central_required_workflow_exact_inventory.py (13 files)"]
  R8 --> V8["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 4d775cd1918177886b6303d4f807c5c098acb366
• Workflow run: 34686099200
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: fix(governance): automate ruleset owner-plane reconciliation #1644 (review)

[seonghobae]

Protected-main restack receipt — 2026-09-12

Exact head 02d76fa76a9772e4abd506845aa3d383a45efaf5 is an ordinary two-parent child of prior owner head 4d775cd1918177886b6303d4f807c5c098acb366 and protected .github/main@fb17ef556f94f673234aa557254ae52779e9a7b0. Exact tree: fef52715d12039c223f40565342e50fb0e756c8e.

The five new protected-main commits touched six paths disjoint from this PR's 21 governance paths. Git Data construction reproduced the locally merged tree byte-for-byte, then the ref advanced with force=false.

Exact-tree verification: focused governance plus new protected-main contracts 114 passed; complete GITHUB_ACTIONS=true python -m pytest -q tests 3195 passed, 1 skipped, 36 subtests passed; git diff --check PASS.

All predecessor hosted results are invalidated. Keep Draft until new exact-head checks are terminal and a qualifying independent approval exists; source integration does not claim live ruleset convergence.

[cwl-noema-review]

Noema LLM review

The PR introduces a ruleset governance reconciler and extends the central audit to also validate the owner repository ruleset. The core reconciler logic is well-reasoned with strong collision recovery, but the audit workflow's error handling can mask a central ruleset drift. When the central ruleset audit fails, audit_status=1 is set but the workflow continues; if a subsequent repository or stacked ruleset fetch fails, the job exits immediately with a non-audit error before the final audit_status check, so a scheduled owner-plane audit can fail without surfacing the compliance drift. The final error message is also misleading when only the central audit failed.

Reviewed changed lines

• .github/workflows/audit-central-ruleset.yml:97 (RIGHT): Central ruleset audit result is captured into audit_status rather than failing immediately, which is the root cause of the masking issue.
• .github/workflows/audit-central-ruleset.yml:104 (RIGHT): Repository ruleset fetch failure exits the job without checking audit_status, bypassing the final failure check.
• .github/workflows/audit-central-ruleset.yml:111 (RIGHT): Stacked ruleset fetch failure has the same early-exit behavior, also bypassing the final audit_status check.
• .github/workflows/audit-central-ruleset.yml:124 (RIGHT): Final error message is unconditional and references 'fetched rulesets' even when only the central audit failed.

Adversarial validation

• .github/workflows/audit-central-ruleset.yml:104 (RIGHT) confirmed: A central ruleset audit failure will still be surfaced even if a later repository ruleset fetch fails. — Static flow: the central audit sets audit_status=1, then the repository fetch if ! gh api ... is false and triggers exit 1 at line 104. The final audit_status check at line 123 is never reached, so the central drift is masked by an unrelated fetch error.
• .github/workflows/audit-central-ruleset.yml:124 (RIGHT) confirmed: The final error message accurately describes the set of drifted rulesets when only the central audit failed. — The final message unconditionally states 'One or more fetched rulesets drift...' even though no repository/stacked ruleset was fetched, misleading operators about which ruleset actually failed.
• Residual risk: After fixing the early-exit masking, ensure the scheduled audit surfaces a central ruleset drift even if all later fetches succeed; the current design also needs a dedicated annotation for the central audit failure.

Findings

• [medium] .github/workflows/audit-central-ruleset.yml:104 (RIGHT): Central ruleset audit failure can be masked: when audit_status is set, the workflow continues and a subsequent repository ruleset fetch failure exits the job at line 104 before the final audit_status check at line 123. On the scheduled owner-plane audit, a central ruleset drift would not be reported, defeating the fail-closed drift detection.
• [low] .github/workflows/audit-central-ruleset.yml:124 (RIGHT): The final error message says 'One or more fetched rulesets drift' even when only the central ruleset audit failed and no repository/stacked ruleset was fetched, which misleads operators about the actual drift source.

• Result: REQUEST_CHANGES
• Head SHA: 02d76fa76a9772e4abd506845aa3d383a45efaf5
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Exact-head repair receipt for 722fec9de67aece7500993ee2999b21df0fab83b / tree 629fc3684bcfca48b66146ccda0f1b70956cdf4a.

Noema's source finding was valid. RED pinned the missing failure ledger, subject-specific central/owner/stacked attribution, absence of early exits before the next audit, and the terminal named receipt. The workflow now records a failed API read as a named failure, skips auditing the unavailable payload, continues collecting any remaining subject evidence, and exits nonzero once with every proven failure subject. A later owner/stacked fetch error can no longer hide an already-observed central governance drift.

Verification on the exact tree:

• focused ruleset contracts: 55 passed
• full repository: 3195 passed, 1 skipped, 36 subtests passed
• GITHUB_ACTIONS=true, Deprecation Warnings as errors, workflow syntax, and git diff --check: PASS
• protected-base compare: 252 ahead / 0 behind, mergeable

The PR is Draft/Proposed while the new hosted runs and qualifying independent review are reacquired. This does not claim live ruleset convergence or authorize bypass/merge.

[seonghobae]

Exact-head CodeQL RCA for 722fec9de67aece7500993ee2999b21df0fab83b:

• Required run 34690754218 is now terminal FAILURE. Python attempt 1 dispatched successfully and ended VERDICT_STATE=pending; Actions later entered attempt 2 and failed closed because no authenticated terminal verdict existed (Exact CodeQL job was rerun without an authenticated terminal verdict). The coordinator dispatch job succeeded.
• Ruleset Governance Reconcile, Runtime Quality, Security, SAST, and Python Security are terminal GREEN. This CodeQL state is the shared protected-handler settlement defect, not a ruleset-reconciler source finding.
• Canonical bootstrap remains fix(codeql): bootstrap versioned dispatch handler #2106 at 24bb6591ab7df23558cb793b4af60c567ff9da97; protected-handler run 34692405217 is still pre-runner queued.

Draft/Proposed remains correct. Do not manually rerun, synthesize status, transfer successor evidence, or merge until exact-head CodeQL converges and a qualifying independent approval exists.

[seonghobae]

Ready transition preserved exact head 722fec9de67aece7500993ee2999b21df0fab83b and produced a fresh review-admission generation. Current-head Security 34694804912, SAST 34694804913, Python Security 34694804932, and CodeQL 34694804935 are now terminal SUCCESS. Ruleset Governance 34690754225 and Runtime Quality 34690754262 remain same-head SUCCESS; review threads are 0.

Noema's source finding is bound to predecessor 02d76fa7… and is repaired by current 722fec9d…, but its formal CHANGES_REQUESTED has not yet been replaced by a qualifying current-head approval. OpenCode's earlier check-only request is likewise not dismissed here. Therefore Ready remains review admission only; no merge/auto-merge authorization is inferred.

[seonghobae]

@opencode-agent Revalidate unchanged exact head 722fec9de67aece7500993ee2999b21df0fab83b against its fresh Ready-generation evidence. Ruleset Governance 34690754225, Runtime Quality 34690754262, Security 34694804912, SAST 34694804913, Python Security 34694804932, and CodeQL 34694804935 are terminal SUCCESS; the branch is mergeable, unresolved review threads are zero, and the predecessor-head Noema finding is repaired by this head but does not transfer as approval. Use only the contextual-orchestrator gateway with fixed orchestrator/free; no provider/model/group override or paid fallback.