[Infra] Close runner admission and dependency-review availability gaps

[seonghobae]

Current incident — 2026-09-06 fresh owner read

ConceptWeave does not own central GitHub Actions admission, organization required-workflow scheduling, Dependency Review availability, or the organization review ruleset. Keep those control-plane concerns separate from repository-owned semantic REDs and preserve exact product heads unless a real ConceptWeave finding requires a causal change.

Current ConceptWeave stack

• protected main@f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425; GitHub Releases remain empty;
• Foundation feat: establish ConceptWeave foundation #1 b538470c963e6524ddc0c3f652a46a4fc8265150, Draft/open/mergeable. Its body now carries current central machine-principal admission evidence plus the Source Observation trusted resource-envelope prerequisite;
• Product-CI bootstrap chore(ci): bootstrap Product pull-request workflow #35 a31ae0c2df920f2794f7ddb456795b04797ab472, open/non-Draft/mergeable. Security Scan 33938445660 and SAST Semgrep 33938445673 are terminal success; CodeQL PR 33938445642, Required OpenCode Review 33938445067, and Strix 33938445050 are terminal failure. Noema CHANGES_REQUESTED remains blocking and a fresh review sweep still finds no qualifying independent APPROVE;
• Client feat(client): add offline semantic release admission contract #5 fcf36c8a99f015b963c9f812787df127ac2e2f9e, Draft/open/mergeable;
• Source Observation feat(observation): define immutable PostgreSQL schema snapshot contract #6 9f1154906f7424610edd313dfecc14132b7bee8a, Draft/open/mergeable. Non-resetting operation budget, exact source+schema authorization, immutable connection-policy binding, stale-binding fail-closed fixtures, exact-schema snapshot containment and binding-preserving receipt provenance are source-present but not exact-head runtime GREEN. Fresh review 5123894287 identifies an additional prerequisite: caller-selected resource ceilings still need trusted local policy admission.

The Zotero #13→#38 full-text/write-admission lineage remains separately single-writer coordinated and is not an infra-lane mutation target.

CodeQL matrix defect is repaired; central dispatch identity remains a machine-principal migration problem

The original #35 dispatch failed because array-valued client_payload.matrix was bound directly to env:. .github#1926 repaired that normally as merge 3f88e13af9dcde4b9da6958c02a78ce3b5c85800; old #35 failures are not retroactive GREEN.

Current protected central owner head is .github/main@efb8926923de45245338159a489a1b227e81945f. A post-#1932 current-workflow CodeQL dispatch, run 33997332726, acquired a hosted ubuntu-24.04 runner, exchanged the OpenCode app token, then failed Bind workflow inputs to live organization pull request metadata; downstream scan was skipped. Later owner measurements recorded 83/83 app-token OpenCode dispatches in the measured window failing the same identity gate.

.github#1929 now has stronger producer inventory than the earlier two-bot model. OpenCode/CodeQL app-token dispatches use opencode-agent[bot]; a legacy/scheduler path has emitted github-actions[bot]; and measured pr-review-fix-scheduler.yml dispatches use the human account seonghobae. The least-widening repair is not a three-entry allowlist. The central owner must migrate review-fix off the user PAT identity to the repository-scoped App identity or another dedicated least-privilege machine principal, then reconcile OPENCODE_REPOSITORY_DISPATCH_ACTOR only to intentionally retained machine identities. Preserve actor==sender, target repository, live PR/base/head and wake binding. Acceptance requires fresh current-central-head canaries from OpenCode, CodeQL and review-fix to reach substantive jobs, while an otherwise identical human-account dispatch remains rejected. ConceptWeave cannot read/write that Actions variable and does not broaden the gate.

.github#1931 separately owns queue-time base drift; strict exact head_sha binding remains mandatory. Do not conflate it with actor/admission.

Noema review owner

.github#1924 remains open. The #35 CHANGES_REQUESTED premise that cargo generate-lockfile --locked is unsupported is contradicted by official Cargo documentation and recorded Cargo 1.98.0 help output. Merged #1944 improves failed Noema stderr/preflight artifact capture but does not fix contradicted external-capability adjudication. ConceptWeave will not change valid Cargo usage, dismiss the review, or fabricate approval.

Strix / contextual-orchestrator owner

The historical #35 Strix run remains failed, but the owner path advanced materially after that run. contextual-orchestrator#1081 merged as protected main@414f22973658c4ddc3d4320fcf7acd9b4e8ba991, reproducing six real transport attempts against one flaky candidate before the fix and reducing that to at most two before _invoke advances to the next candidate. Central .github#1951 then advanced the review-sidecar pin to that exact owner commit, producing current central head efb8926923de45245338159a489a1b227e81945f.

This does not retroactively make #35 GREEN. contextual-orchestrator#1049 remains open for passthrough retryable 502/network failover with typed attempt evidence, and a fresh Strix execution using the current central trusted workflow is required to determine whether the old repeated-HTTP-500 specimen is closed by current retry/failover behavior or whether a narrower status-classification/attempt-evidence defect remains. ConceptWeave does not copy provider/model fallback policy into the leaf.

Source Observation trusted resource-envelope admission

#6 already moved source authority away from caller-selected source/schema trust: source key resolution yields an immutable opaque policy binding, exact schema scope is authorized against that same binding, and snapshots fail closed when local observed schema escapes the authorization envelope. The remaining resource admission is inconsistent with that trust model. ObservationLimits and ObservationRequestBudget are caller-selected positive values; current constructors reject zero but do not require an owner ceiling. A caller can therefore request effectively unbounded timeout/row/byte/concurrency/schema-metadata values while still presenting an otherwise authorized source/schema request.

Acceptance before a concrete PostgreSQL adapter: the same trusted local policy must explicitly admit/cap the complete provider-independent resource envelope against the exact ResolvedSourceConnection, default deny, and reject wider-than-policy requests before adapter/source/snapshot side effects. Equal/narrower controls must proceed; policy evaluation consumes the same non-resetting operation budget. Do not solve this with arbitrary PostgreSQL-specific constants, source credentials, DSNs or runtime objects in the port. PR review 5123894287; Issue #2 handoff 5556511220.

Dependency Review owner

The earlier authenticated exact-range HTTP 403 was traced to an uninitialized repository dependency graph, not retry/backoff. Initializing the graph made the same compare endpoint available, so the proposed retry repair remained unmerged. That RCA is not consumer GREEN: a dependency-changing current ConceptWeave head still needs the authoritative pinned Dependency Review action to execute successfully. Alternative scanners or 403-as-success shims are not substitutes.

Repository-owned next work

1. Keep chore(ci): bootstrap Product pull-request workflow #35 exact head stable. Complete central machine-principal producer migration/admission, obtain newly emitted current-workflow CodeQL/OpenCode results for unchanged chore(ci): bootstrap Product pull-request workflow #35, correct/re-evaluate Noema, obtain fresh Strix on the current CO #1081/.github #1951 path and a qualifying independent approval, then merge normally only after every exact-head gate is satisfied.
2. After chore(ci): bootstrap Product pull-request workflow #35 integration, apply the same no-op-event queue-conservation repair to Foundation feat: establish ConceptWeave foundation #1, refresh docs/product-technical-gap-baseline.md, and obtain repository-owned Product plus applicable central evidence on one unchanged exact Foundation head.
3. Source Observation feat(observation): define immutable PostgreSQL schema snapshot contract #6: make the complete resource envelope trusted-policy-admitted against the immutable source binding; obtain exact-head Rust/Product/coverage/rustdoc evidence and repair only observed failures; only then add the bounded read-only Rust PostgreSQL adapter/replay fixture.
4. Client feat(client): add offline semantic release admission contract #5: re-establish exact-head Product/security/review evidence after Foundation integration, then continue generic client-consumption/alignment/query-plan gaps without a foreign-domain public-model fork.
5. Restack dependents non-force only after their direct prerequisite actually moves; predecessor evidence never transfers as GREEN.

Acceptance

• current exact heads obtain real runner identity, exact checkout and terminal authoritative evidence;
• repository-owned failures follow realistic RED → minimum causal repair → unchanged exact-head GREEN;
• central dispatch authorization/base-drift/queue concerns remain at .github rather than being copied into ConceptWeave;
• Dependency Review executes authoritatively on a dependency-changing current ConceptWeave consumer head;
• review governance remains satisfiable without self-approval, synthetic identities, review dismissal or required-context weakening;
• Source Observation keeps credentials/DSNs outside domain contracts, policy-authorizes exact schema scope and the complete resource envelope against an immutable opaque connection-policy revision, and returns no partial immutable snapshot on timeout/cancellation/source disappearance;
• no force push, destructive rebase, routine admin bypass, predecessor-evidence transfer, no-op retrigger, scanner substitution, mutable foreign dependency or premature release.

[seonghobae]

Fresh admission evidence — 2026-09-01 17:44 KST run

The blocker is broader than the repository Product workflow. Exact PR head 1c982f246f0b13c814d463ae2911e1049f9c253d currently has 18 check runs. Repository Product run 33485782056 / rust-quality job 99785397728 is still queued with no steps. On the same exact SHA, repository Security Scan 33485781993 and SAST Semgrep 33485781967 are also still queued. Check-run inspection shows substantive Security jobs such as dependency-review, scorecard, and osv-scan queued with no execution; only control/helper jobs such as cancel-closed-pr-runs have completed as skipped.

The repository is covered by active organization ruleset 18156473 (CWL Central required workflows) on ~DEFAULT_BRANCH, requiring one approval, thread resolution, and centrally owned close-empty/OpenCode/scheduler/security/Strix/SAST/Noema workflows. No rule weakening or bypass is justified.

This pattern makes a single malformed Product YAML materially less likely: multiple independently defined repository/central lanes on the same new repository are waiting for runner admission. Continue investigating organization Actions capacity/concurrency, new-repository Actions policy/bootstrap, billing/spending, or runner-group admission. Until a runner executes the exact RED SHA, do not commit the publication-invariant production repair and do not transfer any predecessor check evidence.

[seonghobae]

Fresh exact-head queue evidence — 2026-09-01

Revalidated the live foundation lane without using predecessor evidence.

• Protected/default base remains main@f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425.
• PR feat: establish ConceptWeave foundation #1 is open, Ready, mechanically mergeable, exact head ec9b8125f86ab9b7545ba501f7b7c7c7d31c6783.
• Product run 33491678897, job 99804362735 (rust-quality) is still queued; the job has no execution steps, so exact-revision verification, fmt, Clippy, tests, rustdoc, coverage, schema validation, lock freshness, and clean-tree validation have not executed.
• SAST run 33491679017, job 99804366548 (Semgrep (multi-language SAST)) is queued with no execution evidence.
• Security run 33491678932 remains queued; current exact-head jobs 99804366871 (osv-scan), 99804367009 (scorecard), 99804367217 (dependency-review), and 99804367227 (trivy-fs) are queued.
• Central current-head lanes are also non-passing: required-workflow-bootstrap job 99804362864, close-empty 99804360382, noema-review 99804361237, and scan-pr-queue 99804413731 are queued; strix job 99804358861 is pending.
• Organization ruleset 18156473 remains active on the default branch and still requires one approval, thread resolution, the seven central workflows, deletion protection, and non-fast-forward protection. No bypass or gate weakening is acceptable.
• GitHub's public status currently reports Actions operational with no September 1 incident, so a public platform outage is not being asserted as the cause.

The same organization-level class is already owned by ContextualWisdomLab/.github#712. This issue is the ConceptWeave-local blocker/acceptance ledger while .github#712 owns capacity/billing/policy/concurrency RCA. Do not churn PR #1 or create no-op commits merely to retrigger the sole exact-current-head evidence; doing so would discard the current diagnostic coordinate and increase queue pressure.

The earlier SemanticCandidate publication invariant is repaired on the current PR #1 source and is not the current blocker. GREEN here remains infrastructure-specific: a fresh/current exact ConceptWeave head actually acquires a runner and executes exact-revision verification before tests/security gates, followed by terminal current-head results and normal review. Until then, queued/pending evidence remains incomplete.

[seonghobae]

Current-head admission evidence — supersedes earlier run IDs

Fresh leaf state now binds this incident to PR #1 exact head 7cc16b7eef6a6ac6465f39e8795388758031907d over main@f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425.

• Product 33502572630 → rust-quality 99839064519: queued, no steps materialized. The current leaf workflow is a single ubuntu-latest job with no matrix, custom label, environment gate, reusable-workflow call, or concurrency group, so the first non-progress boundary is before exact-SHA checkout/source execution.
• Security Scan 33502572716 → dependency-review 99839068988, osv-scan 99839069511, scorecard 99839069518, trivy-fs 99839069595: all queued/no steps. These are organization-required workflow jobs; ConceptWeave has no local Security Scan workflow to patch.
• SAST Semgrep 33502572814 → Semgrep 99839069892: queued/no steps. ConceptWeave has no local SAST workflow to patch.

The repository-owned publication/evidence encapsulation findings are source-addressed on this head; there is still no executed exact-head Product failure from which to justify additional leaf source churn. The central owner path .github#712 has been refreshed with these exact coordinates and linked to the broader queue-health path (#1150/current successor). Existing central evidence has already falsified a blanket Actions-disablement explanation and an enforcing Actions alert budget; deeper selective hosted-runner scheduling/payment-account/provider capacity remains to be distinguished by the central owner or GitHub billing/support surface.

Do not cancel or duplicate-rerun these sole current-head lanes merely to create activity. Acceptance remains real runner assignment/execution on the unchanged exact head (with actual checkout SHA), or a deterministic exact external prerequisite from the central control plane, followed by fresh ConceptWeave revalidation.

[seonghobae]

Current-head refinement: PR #1 is now 971ddcbd27328e9f6d53c61bb16f7d5a05c97435. The additional leaf change replaces deprecated Node-20-era actions/checkout v4 with the same immutable actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (v7.0.0) already used by protected central workflows; the predecessor executable log explicitly warned that checkout v4 targeted deprecated Node 20.

The Product concurrency repair is now empirically proven: run 33509921965 for predecessor 6520478… was automatically cancelled at 2026-09-01T12:54:08Z when 971ddcbd… synchronized. Central SAST run 33509921992 and Security run 33509922026 for that same predecessor were also cancelled by their central concurrency contracts. This removes three provably obsolete queue lanes without cancelling the sole current-head evidence.

Current sole Product evidence is run 33510237873, job 99863874307, exact head 971ddcbd…, ordinary ubuntu-latest, still pre-checkout/runner-unassigned at the latest read. Current Security 33510237886 and SAST 33510237814 are likewise non-passing while queued. Keep this head stable unless an executed current-head failure produces a real source repair.

[seonghobae]

Fresh control-plane refinement, 2026-09-01: the runner-admission RCA is now selector-specific rather than generic saturation.

• ConceptWeave feat: establish ConceptWeave foundation #1 unchanged head 5cd7d1de742fe34aa99900641cc8b124e7c65f9e remains Product GREEN.
• Its organization-required Security/SAST jobs still request ubuntu-latest, remain pre-execution, and expose runner_id=0/steps=[].
• Central .github#1588 provided a same-repository control: head a502dc5d4e909e2e088947de038e0d3840d4d76c, Strix Changed Path Quality CI 33521385880 / job 99901247530 requested explicit ubuntu-24.04, acquired hosted runner 1001591835, completed exact checkout/setup, and executed tests; the same head's central Security Scan 33521385765 jobs requested ubuntu-latest and remained queued without runner assignment.
• .github#712 has been updated with these exact ConceptWeave and central canary coordinates. The existing CWL .github Commercial Loop was also tightened to make explicit supported-image migration from the starving ubuntu-latest surface its immediate P0, using .github#1588 or a live successor rather than creating a competing writer.

ConceptWeave-side acceptance remains unchanged: do not move the clean source head to retrigger. After the central selector repair reaches protected truth, rerun/revalidate the unchanged current ConceptWeave head and require actual checkout SHAs for Security/SAST. If explicit ubuntu-24.04 later also stops acquiring runners, reopen billing/quota/org-policy/platform capacity as the primary competing cause.

[seonghobae]

Fresh runner-admission recurrence while advancing Client P0, not a source blocker conclusion: PR #5 test-only head de083fba1a257ed66935c9ff52963c8f397e7783 (adds only the resolve_concept RED) has Product run 33545538986, job 99981981775 queued with steps=null at repeated reads. Parent and predecessor PR #5 heads have acquired Ubuntu 24.04 hosted runners and exact checkout, so this is not enough evidence for an invalid leaf selector. Exact canary was added to central .github#712; do not mutate/retrigger the source merely for admission. This issue remains open for both queue-health recurrence and the separate foundation Security/dependency-review 403 tracked by .github#810.

[seonghobae]

Current-head correction — 2026-09-02

The Client lane has advanced since the issue body snapshot. PR #5 test-only head 827080d101b3d057b4626d845f51d7d575f773f1 did acquire Ubuntu 24.04 runner job 100002392979 in Product run 33551686430; exact checkout and fmt succeeded, then Clippy produced the intended TDD RED with five E0599 failures because SemanticReleaseClient::resolve_concept was absent. The smallest deterministic implementation was then pushed non-destructively on the same writer branch; current head is 4b4c47f363f46ad6d2923ea076e12b34cbf15eaf. It validates nonblank input, reuses authoritative-release admission, and performs exact identifier lookup only—no fuzzy/case-folded match, model/provider call, source access, or authority promotion. Fresh Product run 33558403542 / job 100024764227 is currently queued with no executed steps, so GREEN is not yet claimed.

A separate Issue #2 Source Observation lane now exists as stacked Draft PR #6. Its current exact head is 4c1cfa23ae168394f2b1629217cfe56b274cc7ac; test-first lineage starts at c9b98dec13631d72a3616e99e73d59ced2ed0559, followed by the immutable Rust PostgreSQL schema-observation contract and code-current PRD/architecture/changelog/product-gap baseline. Product run 33558198185 / job 100024091488 is currently queued with no executed steps. No live database adapter or production database access is claimed.

Foundation PR #1 control-plane ownership is unchanged: Product and SAST are terminal success; Security run 33527150445 still has sibling OSV/Scorecard/Trivy success while dependency-review job 100008469220 remains queued/pre-checkout. .github#712, .github#810, and .github#772 remain the causal runner, Dependency Review availability, and solo-maintainer approval owners respectively. No leaf bypass or substitute-scanner promotion was used.