fix(governance): preserve proposal branch create transition

[seonghobae]

Buyer-visible gap

ScopeWeave and independent canaries reproduced proposal-branch creation/update failures while organization ruleset 18156473 targeted ~ALL and enforced required workflows during ref creation. That made the normal pull-request transition impossible before the proposal ref could exist.

Refs #1200.

Change

• require exact default-branch scope: ref_name.include=["~DEFAULT_BRANCH"], ref_name.exclude=[];
• reject ~ALL, mixed scope, branch globs, string-shaped includes, and exclusions;
• require workflows.parameters.do_not_enforce_on_create=true;
• preserve all seven central workflows, exactly two approvals, stale-review dismissal, last-push approval, thread resolution, merge/squash methods, deletion protection, and non-fast-forward protection;
• keep stacked PRs review-only; final default-branch integration retains the complete ruleset gate;
• align the rollout ledger, ADR, README, and changelog with the corrected transition.

No consumer source or protected branch was changed.

Exact current identity

• head: 6bf0447388c08f699f9550e4ed4f71c84fb4c723;
• live base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39;
• merge-base equals the live base; ahead 19 and behind 0, with normal non-force commits;
• diff: 18 paths, 264 additions and 58 deletions; the unrelated pip lock remains owned by fix(security): repair pip audit and schedule orchestrator review #1198;
• the latest governance-owned hardening now preserves malformed/null condition structure so the audit reports structural drift instead of silently normalizing it;
• unresolved review threads: 0; exact-head formal verdicts: 0.

Test-first evidence

Evidence on predecessor b628e88871ecc845a46989bde48b15292a41690e remains source-relevant but is not exact-head hosted evidence:

• RED: 8 focused failures, including the false pass for ~ALL and missing create-transition validation;
• GREEN: 19 focused audit tests;
• full suite: 1,300 tests and 16 subtests;
• full central coverage: 8,126 statements and 3,146 branches, 100%;
• audit docstrings, compileall, and git diff --check: pass.

New exact-head quality/security runs are in progress or queued and remain non-passing until terminal success. No predecessor result is counted as current-head approval or hosted acceptance.

Integration acceptance

After normal reviewed protected-main integration:

1. refetch ruleset 18156473 and require the exact audited payload;
2. create and update a fresh non-default ScopeWeave proposal branch without bypass;
3. regenerate ScopeWeave fix(opencode): App 전용 review identity 계약을 통합 게이트와 일치 #523 exact-head Dependency Review and affected checks;
4. retain the complete required workflow/review gate on protected develop.

Merge only after terminal exact-head required Checks and qualifying independent formal approvals.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 25a3cb7d-639d-4a81-a779-32a19d9501fe

📝 Walkthrough

Walkthrough

Changes

에이전트 멘션 동시성

Layer / File(s)	Summary
인터랙티브 동시성 계약 .github/workflows/agent-mention-*.yml, docs/doctoring/agent-mention-concurrency-isolation.md, tests/test_agent_mention_*, CHANGELOG.md	인터랙티브 에이전트 멘션에서 로컬 concurrency와 지원되지 않는 queue: max를 제거했습니다. 예약 sweep은 취소하지 않는 별도 동시성 그룹을 유지합니다. 관련 문서와 테스트를 갱신했습니다.

중앙 required-workflow 적용 범위

Layer / File(s)	Summary
규칙셋 범위와 감사 검증 scripts/ci/audit_central_required_workflows.py, tests/test_central_required_workflow_ruleset_audit.py, docs/org-required-workflow-rollout.md, docs/adr/0001-central-review-stacked-pull-requests.md, README.md	중앙 규칙셋의 대상 범위를 ~DEFAULT_BRANCH에서 ~ALL로 변경했습니다. stacked pull request의 base branch 적용 내용을 문서화하고, 감사 스크립트와 회귀 테스트를 갱신했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to c18d8

This PR expands central governance reviews to stacked branches, but its validation currently permits malformed branch-scope configurations that could allow required review coverage to be missed without detection. The audit contract and regression tests should be tightened before merging.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 4 files. (5 skipped: 5 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	⚠️ Warning	제목은 제안 브랜치 생성 전환을 설명하지만, 변경사항의 핵심인 스택형 PR 거버넌스와 중앙 규칙셋 범위 변경을 반영하지 않습니다.	스택형 PR에 중앙 필수 워크플로를 적용하고 규칙셋 범위를 모든 브랜치로 확장한 변경을 제목에 명시하십시오.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stacked-pr-central-required-workflows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Current-head validation at c11fb657e1a71fabd8cdbf06d1e6a821163bd836:

• live CWL Central required workflows ruleset 18156473: active, repository_name.include=["~ALL"], ref_name.include=["~ALL"], seven central workflows, two approving reviews; audit script: PASS;
• tests/test_central_required_workflow_ruleset_audit.py: 16 passed;
• audit module: 130 statements / 66 branches, 100% coverage;
• interrogate 100%, compileall, and git diff --check passed.

The full central suite had prior 100% evidence on the unchanged main source; this PR adds only the scoped audit/docs/ADR/test contract. Hosted current-head Checks and two qualifying independent approvals remain required; no bypass or self-approval.

[seonghobae]

Successor current-head validation at ab65fcc7dd6547e84cca8a699430d06077dad022:

• live ruleset 18156473: active, repository_name.include=["~ALL"], ref_name.include=["~ALL"], seven central workflows, two approving reviews; audit script: PASS;
• focused audit tests: 16 passed; audit module coverage 100%; interrogate 100%; compileall and git diff --check passed.

The documentation-only successor preserves the implementation proof; stale predecessor-head review evidence does not count. A fresh exact-head independent review and current hosted Checks remain required before merge.

[seonghobae]

Exact current head is now bc2c93ac88599837555cb1ff3292bb49d245dc5a after the ledger timestamp refresh. Focused audit proof remains unchanged; hosted required Checks and fresh exact-head review must be evaluated on this successor.

[seonghobae]

Current-head validation for bc2c93a: verified the live organization ruleset 18156473 is active with ref_name.include=[~ALL], and the PR aligns the audit code, regression fixture, ADR, and operator rollout ledger with stacked pull-request coverage. Passed: 16 central ruleset audit tests, Ruff, compileall, and git diff --check. Please review this exact head; merge remains gated on an independent non-author approval and terminal protected checks.

[seonghobae]

@opencode-agent Please review the current PR head bc2c93a. Verify the live ruleset alignment, stacked-PR scope audit, changed-file evidence, current mergeability, and required checks. Do not approve a stale head.

[seonghobae]

@opencode-agent review exact current HEAD bc2c93a. Inspect the complete diff, validate security and regression behavior, and publish only evidence bound to this SHA. Do not transfer predecessor approval, modify the branch, or merge.

[seonghobae]

@opencode-agent please review exact current HEAD bc2c93ac88599837555cb1ff3292bb49d245dc5a against main; verify stacked-branch required-workflow scope, live ruleset audit, and protection invariants.

[seonghobae]

@cwl-noema-review please independently review exact current HEAD bc2c93ac88599837555cb1ff3292bb49d245dc5a against main; verify the all-branch ruleset audit and central workflow/protection invariants.

[seonghobae]

Reproduced and fixed the central router Check failure at exact HEAD 501fe541b725f611145d42672c66b3411287d36d: repository_dispatch was using a job token with actions: read, and the local concurrency block contained unsupported queue: max. The local router now has actions: write, valid native concurrency, and regression coverage. Tests: 8 passed; full actionlint and diff check pass. @opencode-agent please re-review this exact HEAD.

[seonghobae]

@cwl-noema-review independently re-review exact current HEAD 501fe541b725f611145d42672c66b3411287d36d against main; verify repository-dispatch permission, actionlint-valid concurrency, and central stacked-PR governance.

[seonghobae]

Exact-head causal repair evidence for aa63517844476ad5d5cfac37f6126d640d5d5115:

• Current-head root cause: deleting unsupported concurrency.queue while retaining the local concurrency group permits only one pending run; a later trusted mention can replace an earlier pending mention before its durable claim exists. The same commit also expanded local Actions permission from read to write even though repository dispatch is authorized by the existing contents: write scope and artifact access is read-only.
• RED: four focused contract failures reproduced the replacing local queue and unused actions: write grant.
• Narrow fix: remove the local route's concurrency group entirely, preserve the scheduled sweep's separate single-flight group, restore actions: read, and converge the doctoring/changelog contract on GitHub's supported one-running/one-pending semantics.
• Focused GREEN: 8 passed.
• Full GREEN: 1,235 passed plus 16 subtests.
• compileall and git diff --check pass.
• All six exact GitHub blobs match the locally verified files.

Hosted exact-head workflows and independent formal review remain separate non-passing gates until terminal evidence exists.

[seonghobae]

Current-head validation for aa63517844476ad5d5cfac37f6126d640d5d5115: 27 focused agent-mention/ruleset tests passed; actionlint passed for .github/workflows/agent-mention-router.yml; compileall and git diff --check passed. The PR scope remains governance-only, with Figma File ID N/A. Review this exact head against the protected ruleset before merge.

[seonghobae]

@opencode-agent review\nHead SHA: aa63517\nReview current HEAD only; check ruleset scope, stacked-PR required workflows, workflow permissions, and all changed tests/docs. Re-run after any push.

[seonghobae]

Current-head validation for aa63517844476ad5d5cfac37f6126d640d5d5115: 24 focused governance/router tests passed; actionlint passed for .github/workflows/agent-mention-router.yml; compileall and git diff --check passed. The least-privilege route keeps Contents write for repository dispatch and Actions read for artifact reads; no Figma UI contract applies (Figma File ID: N/A).

[seonghobae]

@opencode-agent review\nHead SHA: aa63517\nReview this exact head only, including least-privilege permissions, repository-dispatch authorization, and all changed queue/idempotency contracts. Re-run after any push.

[seonghobae]

Exact-head verification for the stacked central workflow governance change.

Current pushed head: a7aeb5683b25d1f82fb4ac2f72685391f3bccf62

Root cause fixed: GitHub Actions rejects the unsupported concurrency.queue key in both agent-mention-noema-dispatch.yml and agent-mention-opencode-dispatch.yml, preventing the downstream dispatch workflows from starting. Removed only that key; exact invocation-key groups and cancel-in-progress: false remain unchanged. Updated the existing contract test to reject the unsupported key.

Verified at this exact head:

• RED: the updated contract test failed on the predecessor because both wrappers contained queue: max.
• uv run pytest -q tests/test_agent_mention_downstream_idempotency.py: 4 passed after the fix.
• uv run pytest -q tests/test_agent_mention_*.py: 84 passed.
• uv run coverage run -m pytest -q: 1235 passed, 16 subtests passed.
• coverage report: 100% statement and branch coverage; interrogate: 100%.
• actionlint on both downstream workflows, compileall, and git diff --check: passed.

@opencode-agent please perform the independent formal review for current head a7aeb5683b25d1f82fb4ac2f72685391f3bccf62. Review-only request: do not merge or enable auto-merge.

[seonghobae]

Correction to the previous evidence comment: the exact pushed/current PR head is a7aeb56804c043b97f837a82d9066dfc03eec938. The verification results and requested review apply to this exact head. @opencode-agent please review this SHA independently; do not merge or enable auto-merge.

[seonghobae]

Queued @opencode-agent for PR #1176 at head c18d8c03f6b7c09253e4f89b0741f24fdcfe96f2. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

Queued @cwl-noema-review for PR #1176 at head c18d8c03f6b7c09253e4f89b0741f24fdcfe96f2. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent @cwl-noema-review Exact-current-head formal review requested for cf94d18a2c8f637a44bd2210dfdf44004d86d02e on live base dd58a88391e44a32fb399f7407f508d8e73cc1c7.

This is review-only. The head advanced by a normal non-force two-parent synchronization that preserves protected main's two disjoint router files byte-for-byte; the governance diff remains the same 17 paths. Predecessor verdicts and queued checks are not accepted as current-head evidence. Please publish a substantive Reviews API verdict tied to this exact SHA after inspecting the current tree.

[seonghobae]

Exact-head hosted evidence

• Exact head: cf94d18a2c8f637a44bd2210dfdf44004d86d02e
• Exact live base: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• Agent Mention Router quality run 32496439983: checked out cf94d18, 1,300 tests and 16 subtests passed; total coverage 100%.
• Organization policy run 32496439810: checked out cf94d18, 34 tests passed.
• SBOM contract run 32496439762: exact SHA assertion passed; 49 tests and 100% coverage.
• Strix remains in progress and eight required security/supply-chain runs remain queued. They are non-passing until terminal exact-head conclusions.
• Reviews API formal verdict count for this exact head remains zero. No merge, bypass, or consumer-source mutation is authorized.

[seonghobae]

Maintainer exact-head finding disposition

• Exact head: cf94d18a2c8f637a44bd2210dfdf44004d86d02e
• The current workflow removes the unsupported queue: max control and the current doctoring record explicitly documents that decision:
  • tests/test_agent_mention_queue_isolation.py requires no replacing local concurrency group;
  • docs/doctoring/agent-mention-concurrency-isolation.md states the same policy in its Test-first repair, Decision, and Rollback sections.
• The Devin comment alleging that the governance record still requires queue: max is therefore stale/false against the current tree and is dispositioned without a source change.
• The separate reviewer-token observation is informational: durable exact-name artifact claims remain the idempotency authority, and changing the existing receipt actor policy would broaden the trust boundary without a demonstrated current-head defect.
• Exact-head review state: no qualifying approval; PR remains blocked.
• Hosted exact-head checks are still pending with no completed source failure.
• Decision: WAIT_AND_REMEDIATE; no bypass merge.

[seonghobae]

Current-head maintenance audit

• Exact head SHA: cf94d18a2c8f637a44bd2210dfdf44004d86d02e
• Exact base SHA: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• Scope: central default-branch ruleset/create-transition contract, trusted mention dispatch durability, established reviewer-token acknowledgement, and bounded Caido sandbox-startup fallback evidence.
• Local verification at this exact head: 1300 passed, 16 subtests; statement coverage 8130/8130, branch coverage 3146/3146; focused tests 41 passed plus router regressions 29 passed; production docstrings 100%; Ruff, compileall, actionlint, and git diff --check passed.
• Live ruleset recheck: ruleset 18156473 is active, exact default-branch scope, existing repository exclusions, seven central workflows, do_not_enforce_on_create=true, and existing review/deletion/non-fast-forward protections.
• Review disposition: current GraphQL review threads are all resolved; no qualifying approval is present yet.
• Hosted Checks: no completed failure observed; Strix is in progress and CodeQL, coverage, and pip-audit remain queued. They must reach terminal success before protected merge.
• Decision: keep normal auto-merge enabled; no bypass or force merge.

[seonghobae]

Exact-head security gate update

• Exact head: cf94d18a2c8f637a44bd2210dfdf44004d86d02e
• Exact base: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• The current completed pip-audit failure is a real shared source/security failure: requirements-pip-audit-ci-hashes.txt contains pip==26.1.2, affected by PYSEC-2026-3721, fixed in 26.2.
• PR fix(osv): preserve immutable direct-source provenance #1158 is the canonical bounded fix, pinning both the direct audit requirement and hash lock to pip==26.2.1. This PR should consume that fix rather than duplicate the lock edit.
• The previously verified queue-removal governance finding remains resolved on this exact head; the new pip failure is independent.

Decision: WAIT_AND_REMEDIATE — merge the protected shared security fix first, then rerun this PR on a fresh exact head. No bypass or merge performed.

[seonghobae]

Current-head audit

• Exact head: f0bef61ba0898ae118d0262ffd6fbf4b8bf4a256
• Exact base: 6a79f075d62b5f8dcfef6145960f1c42c147f273
• Review threads: 0 unresolved; no qualifying approval is currently recorded.
• Local exact-head verification: focused 43 passed; full suite 1302 passed with 16 subtests; changed governance source statement/branch coverage 100%; interrogate, actionlint, compileall, and diff check passed.
• Hosted exact-head-path-policy failed only on the inherited scheduler contract assertions for repository-dispatch run-id isolation/cancellation. This is a central scheduler defect already isolated to root repair PR fix(actions): deduplicate workflow-run scheduler scans #1203, not a source finding in this governance diff. pip-audit independently reports inherited pip 26.1.2 / PYSEC-2026-3721, owned by PR fix(security): repair pip audit and schedule orchestrator review #1198.
• Decision: WAIT_AND_REMEDIATE; normal auto-merge remains enabled; no force merge.

[seonghobae]

Exact-head audit update\n\nObserved hosted CI failure on the prior head: pip-audit lock and stale scheduler assertion refresh.\nRoot-cause fix: updated the hash-locked pip dependency to pip 26.2.1 with both package hashes and aligned the scheduler contract assertion with the current repository-dispatch scope.\n\nExact head: 8923bad\nExact base: 6a79f07\nLocal verification: 52 required-workflow queue contract tests passed; pip-audit clean; shell syntax and diff checks passed.\nGitHub mergeability: behind. Required checks and exact-head approval remain pending; decision remains WAIT_AND_REMEDIATE.

[seonghobae]

@claude Please review exact current head c6e1ba3cee48edd233e0c63b05d1f3785e307f98 against protected main@fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39. The unrelated pip 26.2.1 lock was restored to protected main and remains owned by #1198; this PR now has 18 intended governance/transition paths. Verify exact default-only ruleset scope, do_not_enforce_on_create=true, retained default-branch protections, current checks, and leave a formal verdict only for this SHA.

[seonghobae]

Current-head verification record

• Exact head SHA: 6bf0447388c08f699f9550e4ed4f71c84fb4c723
• Exact base SHA: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• State: OPEN, non-draft, MERGEABLE, normal squash auto-merge enabled.
• Review finding fixed: multi-workflow-rule payloads no longer receive a misleading branch-create diagnostic; the structural audit now reports only evidence supported by a unique workflow rule.
• Local verification at this exact head:
  • central ruleset audit tests — 20 passed
  • prior exact-head validation before the final two-file fix — 151 coordinator/agent/ruleset/Strix tests plus 85 agent-mention tests passed
  • changed-workflow actionlint — passed before the final Python-only fix
  • python -m compileall — passed
  • interrogate --fail-under 100 scripts/ci — 100%
  • git diff --check — passed
• Unresolved non-outdated review threads: 0.
• The final push invalidated all predecessor hosted checks; current-head required checks and approval remain pending.
• Decision: WAIT_AND_REMEDIATE pending current-head required checks and qualifying approval. No force-merge criteria are present.

[seonghobae]

@claude Please review exact current head 6bf0447388c08f699f9550e4ed4f71c84fb4c723 against protected main@fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39. The latest governance-owned change preserves malformed/null condition structure so ruleset drift fails closed; exact Strix, readiness, SBOM, and agent-router quality jobs are terminal success. Verify default-only/create-transition semantics and leave a formal verdict only for this SHA.

[seonghobae]

pip-audit reported PYSEC-2026-3721 against pip 26.1.2. Updated the exact pinned lock to pip 26.2.1 with both release hashes. Local validation passed: 52 queue-contract tests, locked pip-audit, and diff checks. Hosted Checks and an exact-head independent approval remain required.

[devin-ai-integration]

Devin Review found 1 new potential issue.