From 181889f260d3c0f5a048a52f58e470bfb9090b64 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:05:06 +0900 Subject: [PATCH 1/6] test(actions): reproduce stale Noema token-lifetime quality runs --- ...noema_token_lifetime_stale_run_contract.py | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 tests/test_noema_token_lifetime_stale_run_contract.py diff --git a/tests/test_noema_token_lifetime_stale_run_contract.py b/tests/test_noema_token_lifetime_stale_run_contract.py new file mode 100644 index 0000000000..8ff74006ec --- /dev/null +++ b/tests/test_noema_token_lifetime_stale_run_contract.py @@ -0,0 +1,22 @@ +"""Regression contract for Noema token-lifetime PR run retirement.""" + +from pathlib import Path + + +REPO_ROOT = Path(__file__).resolve().parents[1] +WORKFLOW_PATH = REPO_ROOT / ".github" / "workflows" / "noema-token-lifetime-quality-ci.yml" + + +def test_noema_token_lifetime_quality_ci_retires_superseded_pr_runs() -> None: + """Keep one authoritative PR/head lineage for the token-lifetime quality gate.""" + workflow = WORKFLOW_PATH.read_text(encoding="utf-8") + + assert "concurrency:" in workflow + concurrency_contract = workflow.split("concurrency:", 1)[1].split( + "permissions:", 1 + )[0] + assert "github.event.pull_request.base.repo.full_name" in concurrency_contract + assert "github.event.pull_request.number" in concurrency_contract + assert "github.event.pull_request.head.sha" not in concurrency_contract + assert "github.sha" not in concurrency_contract + assert "cancel-in-progress: true" in concurrency_contract From abb7b9936bab8cc5f1628263fe615c6a5c09bc42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:05:24 +0900 Subject: [PATCH 2/6] fix(actions): retire superseded Noema token-lifetime quality runs --- .github/workflows/noema-token-lifetime-quality-ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/noema-token-lifetime-quality-ci.yml b/.github/workflows/noema-token-lifetime-quality-ci.yml index cfcd722ee4..e79de26bb2 100644 --- a/.github/workflows/noema-token-lifetime-quality-ci.yml +++ b/.github/workflows/noema-token-lifetime-quality-ci.yml @@ -14,6 +14,10 @@ on: - requirements-opencode-review-ci-hashes.txt - .github/workflows/noema-token-lifetime-quality-ci.yml +concurrency: + group: noema-token-lifetime-quality-${{ github.event.pull_request.base.repo.full_name }}-pr-${{ github.event.pull_request.number }} + cancel-in-progress: true + permissions: contents: read From 3751cd3b82e48f0131689ab18fbea16ff741f37d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:05:58 +0900 Subject: [PATCH 3/6] docs(actions): record Noema token-lifetime stale-run RCA --- ...ema-token-lifetime-stale-run-retirement.md | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 docs/doctoring/noema-token-lifetime-stale-run-retirement.md diff --git a/docs/doctoring/noema-token-lifetime-stale-run-retirement.md b/docs/doctoring/noema-token-lifetime-stale-run-retirement.md new file mode 100644 index 0000000000..37abf5847e --- /dev/null +++ b/docs/doctoring/noema-token-lifetime-stale-run-retirement.md @@ -0,0 +1,35 @@ +# Noema token-lifetime quality stale-run retirement + +## Status + +Proposed on the repair branch pending exact-current-head protected review and Checks. This document is evidence/doctoring, not merge authority. + +## Incident and root cause + +On 2026-09-02, pushing `ContextualWisdomLab/.github#1717` from predecessor head `5b8badc3b9088a5845abc447ed75bf2d9a99031d` to current-main reconciliation head `aeae0c681b66c2e6e9b98d13e47d684eb350b0a8` correctly retired the predecessor runs for Security Scan, OSV-Scanner PR, Semgrep, CodeQL, Strix Changed Path Quality CI, contextual-orchestrator review-repair quality, Python Security, organization commercial readiness, Secret Scan, Scorecard, SBOM, OpenCode Rust coverage, and exact-artifact SBOM quality. The predecessor `Noema Reviewer Token Lifetime CI` run `33621482031`, however, remained queued while the new-head run `33622618082` was also queued. + +The owner workflow `.github/workflows/noema-token-lifetime-quality-ci.yml` had no `concurrency` contract at all. A PR synchronize therefore created a new expensive validation without retiring the obsolete queued/in-progress run for the same repository + PR lineage. This directly violated the control-plane stale-Actions contract and consumed scarce shared Actions capacity. + +## RED → repair contract + +A regression was committed first at `181889f260d3c0f5a048a52f58e470bfb9090b64`. It requires this pull-request workflow to use a repository + PR stable concurrency group, deliberately excludes both `github.event.pull_request.head.sha` and `github.sha`, and requires `cancel-in-progress: true`. The unmodified protected-main workflow fails immediately because it contains no `concurrency:` block. + +The production repair adds only the missing PR-stable concurrency boundary: + +- repository identity: `github.event.pull_request.base.repo.full_name`; +- PR identity: `github.event.pull_request.number`; +- no head SHA in the group; +- `cancel-in-progress: true`. + +This quality gate executes deterministic token-lifetime tests rather than a long semantic reviewer, so preserving superseded in-progress work has no safety benefit. Native GitHub concurrency cancellation is the least-privilege mechanism: it needs no `actions: write`, privileged cancellation token, untrusted-head execution, or custom stale-run API code. + +## Invariants preserved + +The workflow remains `pull_request`-scoped with the same path filter, `contents: read`, `ubuntu-24.04`, exact source checkout, hash-locked CI dependency installation, token-lifetime/two-phase/App-identity pytest targets, compile verification, and `git diff --check`. This change does not alter Noema verdict semantics, contextual-orchestrator routing, provider/model selection, protected branch requirements, or review authority. + +## Verification required before merge + +1. Re-read the exact PR head and workflow text. +2. Prove the regression is GREEN on that exact head. +3. Confirm a subsequent synchronize retires the older `Noema Reviewer Token Lifetime CI` queued/in-progress run and leaves only the current-head authoritative lineage. +4. Re-fetch reviews, unresolved threads, and required/security Checks; merge only through ordinary protection unless the strict independently verified `QUEUE_SATURATION_CHICKEN_EGG` boundary is freshly satisfied. From a360529d399db2906341e6f16f0a64ff47575b40 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:06:49 +0900 Subject: [PATCH 4/6] docs(actions): bind stale-run proof to repair PR evidence --- docs/doctoring/noema-token-lifetime-stale-run-retirement.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/doctoring/noema-token-lifetime-stale-run-retirement.md b/docs/doctoring/noema-token-lifetime-stale-run-retirement.md index 37abf5847e..03de6a5198 100644 --- a/docs/doctoring/noema-token-lifetime-stale-run-retirement.md +++ b/docs/doctoring/noema-token-lifetime-stale-run-retirement.md @@ -27,9 +27,13 @@ This quality gate executes deterministic token-lifetime tests rather than a long The workflow remains `pull_request`-scoped with the same path filter, `contents: read`, `ubuntu-24.04`, exact source checkout, hash-locked CI dependency installation, token-lifetime/two-phase/App-identity pytest targets, compile verification, and `git diff --check`. This change does not alter Noema verdict semantics, contextual-orchestrator routing, provider/model selection, protected branch requirements, or review authority. +## Live repair-PR evidence + +`ContextualWisdomLab/.github#1726` was opened from repair head `3751cd3b82e48f0131689ab18fbea16ff741f37d`. GitHub admitted `Noema Reviewer Token Lifetime CI` run `33622880158` for that head. This doctoring update intentionally advances the same PR once more so the repaired native concurrency contract can be observed retiring that predecessor run rather than merely asserted from YAML. + ## Verification required before merge 1. Re-read the exact PR head and workflow text. 2. Prove the regression is GREEN on that exact head. -3. Confirm a subsequent synchronize retires the older `Noema Reviewer Token Lifetime CI` queued/in-progress run and leaves only the current-head authoritative lineage. +3. Confirm this synchronize retires predecessor `Noema Reviewer Token Lifetime CI` run `33622880158` and leaves only the current-head authoritative lineage. 4. Re-fetch reviews, unresolved threads, and required/security Checks; merge only through ordinary protection unless the strict independently verified `QUEUE_SATURATION_CHICKEN_EGG` boundary is freshly satisfied. From 3dfe006a35a238c92f603c62ee7e127e51cc1e63 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:07:06 +0900 Subject: [PATCH 5/6] docs(actions): explain PR-stable Noema quality concurrency --- .github/workflows/noema-token-lifetime-quality-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/noema-token-lifetime-quality-ci.yml b/.github/workflows/noema-token-lifetime-quality-ci.yml index e79de26bb2..05f0322e31 100644 --- a/.github/workflows/noema-token-lifetime-quality-ci.yml +++ b/.github/workflows/noema-token-lifetime-quality-ci.yml @@ -14,6 +14,7 @@ on: - requirements-opencode-review-ci-hashes.txt - .github/workflows/noema-token-lifetime-quality-ci.yml +# Deterministic quality CI: a synchronize supersedes older work for this PR. concurrency: group: noema-token-lifetime-quality-${{ github.event.pull_request.base.repo.full_name }}-pr-${{ github.event.pull_request.number }} cancel-in-progress: true From c129a5ff1c4bfaf8ca4ce936f1823060086bc441 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:15:58 +0900 Subject: [PATCH 6/6] fix(actions): execute stale-run contract in Noema quality gate --- .github/workflows/noema-token-lifetime-quality-ci.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/noema-token-lifetime-quality-ci.yml b/.github/workflows/noema-token-lifetime-quality-ci.yml index 05f0322e31..ef663df16f 100644 --- a/.github/workflows/noema-token-lifetime-quality-ci.yml +++ b/.github/workflows/noema-token-lifetime-quality-ci.yml @@ -8,6 +8,7 @@ on: - tests/test_noema_reviewer_token_lifetime.py - tests/test_noema_two_phase_handoff.py - tests/test_noema_refreshed_app_identity.py + - tests/test_noema_token_lifetime_stale_run_contract.py - docs/doctoring/noema-review-token-lifetime.md - docs/product-technical-gap-baseline.md - CHANGELOG.md @@ -41,10 +42,12 @@ jobs: PYTHONPATH=. python3 -m pytest -q \ tests/test_noema_reviewer_token_lifetime.py \ tests/test_noema_two_phase_handoff.py \ - tests/test_noema_refreshed_app_identity.py + tests/test_noema_refreshed_app_identity.py \ + tests/test_noema_token_lifetime_stale_run_contract.py python3 -m compileall -q \ .github/actions/noema-review/two_phase.py \ tests/test_noema_reviewer_token_lifetime.py \ tests/test_noema_two_phase_handoff.py \ - tests/test_noema_refreshed_app_identity.py + tests/test_noema_refreshed_app_identity.py \ + tests/test_noema_token_lifetime_stale_run_contract.py git diff --check