fix(actions): retire stale Noema token-lifetime quality runs

.github/workflows/noema-token-lifetime-quality-ci.yml

@@ -8,12 +8,18 @@ on:
       - tests/test_noema_reviewer_token_lifetime.py
       - tests/test_noema_two_phase_handoff.py
       - tests/test_noema_refreshed_app_identity.py
+      - tests/test_noema_token_lifetime_stale_run_contract.py
       - docs/doctoring/noema-review-token-lifetime.md
       - docs/product-technical-gap-baseline.md
       - CHANGELOG.md
       - requirements-opencode-review-ci-hashes.txt
       - .github/workflows/noema-token-lifetime-quality-ci.yml
 
+# Deterministic quality CI: a synchronize supersedes older work for this PR.
+concurrency:
+  group: noema-token-lifetime-quality-${{ github.event.pull_request.base.repo.full_name }}-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -36,10 +42,12 @@ jobs:
           PYTHONPATH=. python3 -m pytest -q \
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
-            tests/test_noema_refreshed_app_identity.py
+            tests/test_noema_refreshed_app_identity.py \
+            tests/test_noema_token_lifetime_stale_run_contract.py
           python3 -m compileall -q \
             .github/actions/noema-review/two_phase.py \
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
-            tests/test_noema_refreshed_app_identity.py
+            tests/test_noema_refreshed_app_identity.py \
+            tests/test_noema_token_lifetime_stale_run_contract.py
           git diff --check

docs/doctoring/noema-token-lifetime-stale-run-retirement.md

@@ -0,0 +1,39 @@
+# Noema token-lifetime quality stale-run retirement
+
+## Status
+
+Proposed on the repair branch pending exact-current-head protected review and Checks. This document is evidence/doctoring, not merge authority.
+
+## Incident and root cause
+
+On 2026-09-02, pushing `ContextualWisdomLab/.github#1717` from predecessor head `5b8badc3b9088a5845abc447ed75bf2d9a99031d` to current-main reconciliation head `aeae0c681b66c2e6e9b98d13e47d684eb350b0a8` correctly retired the predecessor runs for Security Scan, OSV-Scanner PR, Semgrep, CodeQL, Strix Changed Path Quality CI, contextual-orchestrator review-repair quality, Python Security, organization commercial readiness, Secret Scan, Scorecard, SBOM, OpenCode Rust coverage, and exact-artifact SBOM quality. The predecessor `Noema Reviewer Token Lifetime CI` run `33621482031`, however, remained queued while the new-head run `33622618082` was also queued.
+
+The owner workflow `.github/workflows/noema-token-lifetime-quality-ci.yml` had no `concurrency` contract at all. A PR synchronize therefore created a new expensive validation without retiring the obsolete queued/in-progress run for the same repository + PR lineage. This directly violated the control-plane stale-Actions contract and consumed scarce shared Actions capacity.
+
+## RED → repair contract
+
+A regression was committed first at `181889f260d3c0f5a048a52f58e470bfb9090b64`. It requires this pull-request workflow to use a repository + PR stable concurrency group, deliberately excludes both `github.event.pull_request.head.sha` and `github.sha`, and requires `cancel-in-progress: true`. The unmodified protected-main workflow fails immediately because it contains no `concurrency:` block.
+
+The production repair adds only the missing PR-stable concurrency boundary:
+
+- repository identity: `github.event.pull_request.base.repo.full_name`;
+- PR identity: `github.event.pull_request.number`;
+- no head SHA in the group;
+- `cancel-in-progress: true`.
+
+This quality gate executes deterministic token-lifetime tests rather than a long semantic reviewer, so preserving superseded in-progress work has no safety benefit. Native GitHub concurrency cancellation is the least-privilege mechanism: it needs no `actions: write`, privileged cancellation token, untrusted-head execution, or custom stale-run API code.
+
+## Invariants preserved
+
+The workflow remains `pull_request`-scoped with the same path filter, `contents: read`, `ubuntu-24.04`, exact source checkout, hash-locked CI dependency installation, token-lifetime/two-phase/App-identity pytest targets, compile verification, and `git diff --check`. This change does not alter Noema verdict semantics, contextual-orchestrator routing, provider/model selection, protected branch requirements, or review authority.
+
+## Live repair-PR evidence
+
+`ContextualWisdomLab/.github#1726` was opened from repair head `3751cd3b82e48f0131689ab18fbea16ff741f37d`. GitHub admitted `Noema Reviewer Token Lifetime CI` run `33622880158` for that head. This doctoring update intentionally advances the same PR once more so the repaired native concurrency contract can be observed retiring that predecessor run rather than merely asserted from YAML.
+
+## Verification required before merge
+
+1. Re-read the exact PR head and workflow text.
+2. Prove the regression is GREEN on that exact head.
+3. Confirm this synchronize retires predecessor `Noema Reviewer Token Lifetime CI` run `33622880158` and leaves only the current-head authoritative lineage.
+4. Re-fetch reviews, unresolved threads, and required/security Checks; merge only through ordinary protection unless the strict independently verified `QUEUE_SATURATION_CHICKEN_EGG` boundary is freshly satisfied.

tests/test_noema_token_lifetime_stale_run_contract.py

@@ -0,0 +1,22 @@
+"""Regression contract for Noema token-lifetime PR run retirement."""
+
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW_PATH = REPO_ROOT / ".github" / "workflows" / "noema-token-lifetime-quality-ci.yml"
+
+
+def test_noema_token_lifetime_quality_ci_retires_superseded_pr_runs() -> None:
+    """Keep one authoritative PR/head lineage for the token-lifetime quality gate."""
+    workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
+
+    assert "concurrency:" in workflow
+    concurrency_contract = workflow.split("concurrency:", 1)[1].split(
+        "permissions:", 1
+    )[0]
+    assert "github.event.pull_request.base.repo.full_name" in concurrency_contract
+    assert "github.event.pull_request.number" in concurrency_contract
+    assert "github.event.pull_request.head.sha" not in concurrency_contract
+    assert "github.sha" not in concurrency_contract
+    assert "cancel-in-progress: true" in concurrency_contract