fix(scheduler): bind central run revalidation to central authority

[seonghobae]

Root cause

After ContextualWisdomLab/.github#1669 landed live-state revalidation before destructive stale-review cancellation, _fresh_active_run_for_cancellation() still read every Actions run through the target-repository read credential. Organization-wide OpenCode/Strix repository_dispatch runs live in the configured central workflow repository, so a target-only credential can fail to read a genuinely stale central run. The scheduler then fails closed by preserving that run, which is safe for cancellation but blocks replacement current-head review dispatch.

Materialized repair

Current exact head: bb39db3ad36416206a5fe8c655a8cdbc0693211c on fix/scheduler-central-run-read-authority-20260902, with protected main@b4eec000d21084accb736d289eb64cfd78e7a91a integrated as the second parent of the current non-force merge commit.

The production helper uses the already-existing gh_api_json_via_dispatch_token() only when run_repo exactly equals validated SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY; target-repository runs retain gh_api_json(). Missing central configuration does not invent elevated authority. No review semantics, cancellation criteria, model/provider selection, merge authority, or leaf source changed. The one-shot workflow/transformer removed themselves from the successor.

Exact-head history and reconciliation

Run 33620821629 verified and published the predecessor source-complete successor through a separate sealed-patch path:

• exact writer/protected-main identity guards passed;
• the central-credential regression was RED for the intended reason;
• the production repair materialized successfully;
• focused scheduler tests passed;
• the complete repository test/coverage/docstring/syntax gate passed after dead PR fix(autofix): remove leaf model-compute and evidence heuristics #1714/fix(noema-review): bound both jobs to a job-level timeout-minutes #1715 source-fix drivers were isolated from production coverage measurement and restored before patch sealing;
• successor scope and SHA-256 seal passed;
• the publish job revalidated unchanged authority and fast-forwarded the exact sealed successor successfully.

Protected main subsequently advanced through the completed #1726 stale-Noema-quality-run repair and the prior model-job-timeout cleanup. Before writing the current merge, the branch and protected main were compared from their common ancestor: the #1717 delta touched only CHANGELOG.md, docs/doctoring/scheduler-central-run-read-authority.md, scripts/ci/pr_review_merge_scheduler.py, and tests/test_scheduler_central_run_read_authority.py; the protected-main delta touched distinct Noema/autofix workflow, doctoring, and regression files. The current commit therefore carries both histories with two parents and no force push/destructive rebase. The branch was re-fetched immediately before the fast-forward ref update to preserve concurrent writer work.

Fresh exact-head workflows are now materialized on bb39db3..., including Noema Reviewer Token Lifetime CI 33626025378, Security Scan 33626025276, SAST 33626025255, CodeQL 33626025172, OSV 33626025793, SBOM 33626025277, Python Security 33626025303, Scorecard 33626025182, Secret Scan 33626025221, Strix quality 33626025258, Contextual Orchestrator review-repair quality 33626025283, OpenCode Rust coverage 33626025275, exact-artifact SBOM quality 33626025270, and organization commercial-readiness quality 33626025279. They are queued/pending and therefore non-passing; predecessor evidence is not promoted.

No force push, destructive rebase, self-approval, gate weakening, or substantive finding dismissal was used.

Merge boundary

Keep Draft until this exact head has terminal protected checks, substantive-clean current-head reviews/threads, and ordinary protection permits integration. The connector Ready-for-review convenience mutation remains unusable because its GraphQL selection references nonexistent Repository.fullDatabaseId; Draft state is therefore intentionally retained rather than bypassed through another mutation surface.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 92d764ab-fe27-4640-b13f-5f3493bce0f8

📥 Commits

Reviewing files that changed from the base of the PR and between 7f4c5e3 and 14d4075.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/doctoring/scheduler-central-run-read-authority.md
• scripts/ci/pr_review_merge_scheduler_core.py
• tests/test_scheduler_central_run_read_authority.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Marked ready for review (host 1 session, 2026-09-06 KST), on head 14d40755 — the main merge that resolved the CHANGELOG conflict; delta against main is still the same four files, +105/−2, and the full gate passed on the merged tree (2896 passed, coverage 100 %, interrogate 100 %).

Why the draft boundary in the body could not do what it was meant to do. The body says: "Keep Draft until this exact head has terminal protected checks, substantive-clean current-head reviews/threads, and ordinary protection permits integration." On main at 7f4c5e3e, three gates skip drafts outright — scripts/ci/opencode_review_receipt_gate.py:137-138 (draft must never receive bot APPROVE), scripts/ci/noema_review_gate.py:1781-1782 (PR is draft; Noema review skipped.), scripts/ci/pr_auto_rebase.py:255-256 (draft PR) — and CodeRabbit does not review drafts either (.github#1913, signature 11). A draft therefore never receives the current-head reviews the boundary waits for; the scheduler's first post-#1937 run on this PR already logged skip: draft PR (run 33971916754). The condition was unsatisfiable while draft.

The intent behind it — no merge before terminal checks and clean reviews — is enforced by branch protection on main regardless of draft state, so nothing is bypassed by flipping: the PR still needs every required context and an independent current-head approval. The body also records that the ready-for-review mutation was unusable at the time (Repository.fullDatabaseId); gh pr ready works today and is what was used here.

If the original author intended draft as a work-in-progress marker rather than a review boundary, convert it back and say so — nothing here assumes otherwise.

[seonghobae]

Converted back to draft (host 1 session, 2026-09-06 KST). My ready-for-review flip above was wrong to make: the body's "Keep Draft until this exact head has terminal protected checks, substantive-clean current-head reviews/threads…" is a standing per-PR hold, and the repository owner's revealed preference is that such holds stand — noema#552 was returned to draft by the owner 27 minutes after a peer flipped it, and contextual-orchestrator#1070 carries the owner's own "Left as Draft per your instructions — no self-approval, no ready-for-review flip" (.github#1912, .github#1913 signature 11). Whether the hold's condition can be satisfied while draft is the owner's call, not mine.

The finding itself stands for the owner to weigh, unchanged from the comment above: while draft, opencode_review_receipt_gate.py:137, noema_review_gate.py:1781, pr_auto_rebase.py:255 and CodeRabbit all skip this PR, so the "clean current-head reviews" the hold waits for will not arrive on their own. Head is still 14d40755 (main merged, four-file delta unchanged, gate green); nothing else was touched.