fix(scheduler): prove workflow-starting mutation token

[seonghobae]

Root cause

An allowlisted mutation credential source did not prove that the selected GH_TOKEN was present and distinct from the workflow github.token. GitHub suppresses new workflow runs for events produced by GITHUB_TOKEN, so an empty App/PAT secret could fall back to that token while the source label still authorized a head mutation. The moved head would then require checks that its mutation credential cannot start.

This is a bounded successor for a second valid delta preserved in historical Draft #1231. It is stacked on #2002 because both touch the scheduler credential boundary.

RED → GREEN

• RED: ebcc6715e68d6bd4dc78f1ce6c3e473a2dfef899
  • rejects missing selected-token evidence, missing workflow-token comparison evidence, and selected-token equality with github.token
  • requires later guidance to preserve the originally recorded decision reason
• GREEN: e2204eeb1ec2789ff791036140ba1672995d25f5
  • validates actual token evidence at the final head-mutation boundary
  • passes SCHEDULER_WORKFLOW_TOKEN only to the scheduler mutation job
  • makes self-test credential fixtures coherent and restores all affected environment values
  • updates CHANGELOG, APA-style doctoring, and docs/product-technical-gap-baseline.md

Authority and safety

• Base: fix/scheduler-central-actions-credential-routing@7bf3451a47768dbda903115a393b1da1d98e1dba
• Both commits are normal fast-forwards; no force push or rebase
• No reviewer, status, ruleset, timeout, provider, or cross-repository permission is weakened
• Missing capability fails closed
• Status remains Proposed until the parent lands and this exact head has terminal clean checks plus independent review

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Baseline reproduction confirms credential/fixture failure exists before #2005

Independent clean-detached reproduction was completed at parent stack head 14f7c85ca56be3297fa4d090d39d487d7be9bf14 using the existing .venv and no source mutation.

.venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=short

Result: 4 failed, 330 deselected / 13.60s / terminal 1.

For #2003 ownership specifically, workflow_starting_credentials_allow_head_mutations is already false at this parent head. Treat this as a regression/fixture-contract mismatch inside the #2002→#2003 credential stack until proven otherwise, not as a #2005 child-delta effect.

Required repair boundary:

• Keep fix(scheduler): prove workflow-starting mutation token #2003's real safety invariant intact: a workflow-starting mutation credential must be actually present and proven distinct from the workflow GITHUB_TOKEN; missing comparison evidence or same-token fallback must still fail closed.
• Determine whether this test's synthetic environment failed to supply coherent selected-token/workflow-token evidence, or whether production logic incorrectly rejects a valid workflow-starting credential.
• If fixture drift: repair the fixture/expectation to model the intended present/distinct-token state. If production behavior is wrong: repair implementation test-first. Do not relax head_mutation_credential_problem() or bypass the proof.
• Re-run this exact focused baseline and then the broader review-repair suite on the combined parent stack.

The other three focused failures are cancellation mocks that reject the new stdin= kwarg and belong primarily to the #2002 host-scoped Actions callable boundary. The remaining 11 failures seen on #2005 hosted run 34082563712 are not declared to share this root cause without separate reproduction.