ci(ops): add hourly read-only gap freshness audit

[seonghobae]

Buyer-visible gap and ownership boundary

Orgmetra needs a quiet-period audit that detects stale buyer-facing product/technical gap truth without creating a second PR/review mutation writer. The central .github scheduler already owns review dispatch, branch updates and protected integration on its established cadence; this Orgmetra lane stays strictly read-only.

Verified defects and repairs

Fresh review of the canonical branch identified and repaired the following Orgmetra-owned defects:

1. Invalid reusable-workflow syntax / duplicate writer. The original design invoked the central scheduler incorrectly and would have created a competing writer. The current workflow has no central scheduler call, write/OIDC permission, inherited secrets, review dispatch, branch update or merge mutation.
2. Incomplete live queue truth. Open PR/issue counts use gh api --paginate --slurp, validate every page shape and flatten all pages before counting.
3. Permanent red before baseline integration. A genuinely absent docs/product-technical-gap-baseline.md is a nonfatal pre-integration state; malformed or unreadable existing evidence remains fail-closed.
4. Hard-coded repository identity. Live reads derive the executing repository from validated GITHUB_REPOSITORY.
5. Same-day false staleness. Regression 4bd72889c50205590a67c5e4bc626819e588a50d requires the date-only baseline to be interpreted in Asia/Seoul; root repair 77e726521fd879e18f169b3d44bf0d2ab1c378c5 compares Korea calendar dates rather than a midnight-UTC timestamp.
6. Fail-open live-state fetch. GitHub read/payload failure now returns exit code 2 with explicit failed live-state evidence instead of silently passing.
7. Future-dated inventory evidence. Current head documents and tests the fail-closed rule that an inventory date later than the current Asia/Seoul calendar date is internally impossible evidence and must fail before a live-state result can be reported current.

No central .github source, ref, workflow or PR state is mutated by this lane.

Exact-current-head evidence

• live base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df
• exact head: ece19f3e36939457b2901dd3a55b7be7c6cc52be
• GitHub live state: open · Draft · mergeable
• Foundation CI 32853304524: terminal GREEN
• Recovery Rehearsal Quality 32853304852: terminal GREEN
• SAST Semgrep 32853303959: terminal GREEN
• Security Scan 32853303976: terminal GREEN
• submitted reviews are COMMENTED only; no qualifying independent APPROVE or CHANGES_REQUESTED
• all current inline review threads are resolved; the earlier refresh-candidate-frequency observation is an explicitly documented advisory-semantics choice rather than a mutation/security defect

The current exact head is technically GREEN. The live Draft state is intentionally not flipped by this loop because GitHub event history shows another same-repository lifecycle writer toggling this PR between Ready and Draft; racing that writer would violate SINGLE-WRITER discipline.

Merge governance

Keep the live lifecycle state authoritative. Fresh effective organization ruleset 18156473 — CWL Central required workflows is active on ~DEFAULT_BRANCH, but its current live review policy is weaker than Orgmetra's acquisition-grade acceptance: it requires one approving review, dismisses stale approvals on push, does not require last-push approval, requires conversation resolution and central required workflows, blocks deletion/non-fast-forward updates, and permits OrganizationAdmin bypass_mode=always with current_user_can_bypass=always.

Issue #89 owns the stricter commercial-control gap: at least two qualifying independent non-author approvals, approval after the last push, routine administrator bypass removed or separately governed as emergency-only, and direct proof that every applicable Orgmetra-local gate composes fail-closed into the real merge control plane. It also tracks the separate lifecycle-writer collision.

Immediately before any future lifecycle or merge transition, refetch the unchanged head/base, reviews, threads, exact-current-head workflows, effective rules and active writer state. Do not self-approve, race another writer, use routine admin bypass, transfer predecessor evidence or mutate the foreign central owner.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 new potential issues.