fix(ci): cover stacked Python and runtime reviews

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -2,7 +2,7 @@ name: Agent Review Runtime Quality CI
 
 on:
   pull_request:
-    branches: [main]
+    # Scan every PR base ref, including stacked feature branches.
     paths:
       - ".github/workflows/agent-review-runtime-quality-ci.yml"
       - ".github/workflows/noema-review.yml"

.github/workflows/python-security.yml

@@ -24,8 +24,8 @@ name: Python Security
 
 on:
   pull_request:
+    # Scan every PR base ref, including stacked feature branches.
     types: [opened, synchronize, reopened, ready_for_review, closed]
-    branches: [main, master, develop]
   push:
     branches: [main, master, develop]
   # Periodic full-repo coverage so non-PR drift is caught (the removed local

CHANGELOG.md

@@ -162,6 +162,11 @@
 
 ## Proposed
 
+- Run Python Security and Agent Review Runtime Quality CI for stacked pull
+  requests by removing their pull-request base-branch filters. Extend the
+  permanent stacked-workflow contract so all four owner review workflows
+  continue covering feature-branch bases.
+
 - Prove that the scheduler's selected head-mutation credential is present and
   distinct from the workflow `github.token`, even when its declared source is
   allowlisted. Missing comparison evidence and same-token fallback now fail

docs/doctoring/stacked-python-runtime-review-coverage.md

@@ -0,0 +1,36 @@
+# Stacked Python and runtime review coverage
+
+Decision date: **2026-09-07**
+
+## Incident
+
+A pull request targeting the feature branch for `ContextualWisdomLab/.github#2002`
+created Security Scan, SAST Semgrep, and CodeQL PR runs, but no Python Security
+or Agent Review Runtime Quality CI run. Both missing workflows restricted the
+`pull_request` base branch, while the existing stacked-PR regression covered
+only Security Scan and SAST Semgrep.
+
+## Decision
+
+All four owner review workflows run for every pull-request base ref. Python
+Security retains its event-type filter and Runtime Quality retains its path
+filter; only the base-branch filters are removed. Push and schedule behavior is
+unchanged. The single permanent contract enumerates all four workflow files.
+
+## Failure scenes
+
+- A dependent PR targets a feature branch and edits scheduler Python: Python
+  Security and Runtime Quality must both be created.
+- A PR does not touch Runtime Quality paths: its existing path filter still
+  prevents irrelevant work.
+- Closing a Python PR: the existing event/action guards continue to apply.
+
+## Evidence and follow-up
+
+RED commit: `890bac2f69ff1a51f774ddf5d6c5d819afed4ac9`.
+Fresh exact-head hosted runs and independent review remain required.
+
+## Reference
+
+GitHub. (2026). *Workflow syntax for GitHub Actions: on.pull_request.branches*.
+https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax

docs/product-technical-gap-baseline.md

@@ -3386,3 +3386,18 @@ same name in another file can carry the opposite safety property.**
 - **Evidence:** RED commit
   `ebcc6715e68d6bd4dc78f1ce6c3e473a2dfef899`; fresh exact-head hosted checks
   remain required before integration.
+
+
+### Stacked Python and runtime review coverage
+
+- **Status:** Proposed
+- **Owner:** `ContextualWisdomLab/.github`
+- **Problem:** Python Security and Agent Review Runtime Quality CI filtered
+  `pull_request` events to default-like base branches, so a valid stacked PR
+  received Security/SAST/CodeQL but silently missed two owner checks.
+- **Action:** Remove only the pull-request base filters and extend the existing
+  stacked-PR workflow regression to all four review workflows.
+- **Evidence:** `ContextualWisdomLab/.github#2003` generated only three hosted
+  workflows at exact head `e2204eeb1ec2789ff791036140ba1672995d25f5`;
+  RED commit `890bac2f69ff1a51f774ddf5d6c5d819afed4ac9`; fresh exact-head
+  hosted checks remain required.

tests/test_stacked_pr_security_workflow_contract.py

@@ -8,7 +8,12 @@
 
 def test_security_workflows_run_for_stacked_pull_requests() -> None:
     """Required PR security workflows must not filter out feature bases."""
-    for workflow_name in ("security-scan.yml", "sast-semgrep.yml"):
+    for workflow_name in (
+        "security-scan.yml",
+        "sast-semgrep.yml",
+        "python-security.yml",
+        "agent-review-runtime-quality-ci.yml",
+    ):
         workflow = (REPO_ROOT / ".github" / "workflows" / workflow_name).read_text(
             encoding="utf-8"
         )