Restore exact-head documentation verification without reintroducing full CI queue load

[seonghobae]

Gap

Protected main@87c4daa1830bac5a5228b6036752ad5633232085 includes #284's queue/concurrency optimization and #286's Draft/closed native-job guards. The earlier documentation-verification safety repair remains intact in principle: a documentation-only exact head must still execute the applicable repository/documentation contracts and cannot be accepted from predecessor, skipped, cancelled, queued-only, synthetic, or status-only evidence.

The buyer/operability gap has two coupled control-plane parts:

1. genuinely prose-only changes still need a protected-base classifier and an authorized workflow partition so repository/documentation contracts run without materializing unnecessary Rust build/test/rustdoc/Clippy/coverage work; and
2. ci: stop draft PR jobs from occupying runners #286's PR lifecycle handling has an exercised ready_for_review defect: marking test(ci): stage protected docs-only classifier foundation #287 Ready on exact 7688798e4fd176450b32cb8188069418f67ccbd4 created native CI 33928039835 with conclusion skipped, while a later substantive synchronize on the already-Ready PR did materialize full native CI. A skipped ready transition is not GREEN.

This is protected-main CI ownership work. Scheduled product writers must not edit .github/** on leaf/product branches to work around either defect.

Current protected-main truth

Protected main #286 configures pull-request lifecycle events including ready_for_review, converted_to_draft, and closed, and guards native CI/MV3 jobs so Draft/closed PRs do not consume runners. This is useful capacity control, but the live #287 experiment proves that the Ready transition itself does not currently provide usable native exact-head verification. Do not weaken the Draft/closed guard merely to make the transition appear GREEN.

#284's separate optimization remains valid: PR cancellation is scoped to workflow/repository/PR, non-PR runs are preserved, the completed nightly materializer is gone, and the redundant standalone cargo check pass was removed. Those changes do not by themselves implement docs-only partitioning.

Protected classifier prerequisite

Ready PR #287 carries the workflow-free classifier foundation at exact af83c40dd2990a03064a92ca75430a9cc400f098, directly based on current protected main. Its first split incorrectly retained a test that read/asserted .github/workflows/ci.yml, making the prerequisite depend on the future activation it was supposed to precede. That test was removed at ab6d5d1a04a020f37727e2f5a6950c58feae8559; current af83c40d... additionally records the rename/copy similarity-to-blob-identity invariant without adding workflow authority.

The classifier consumes NUL-delimited non-combined git diff --raw -z --no-abbrev evidence and must prove ordinary prose-only blobs before permitting a lightweight lane. It must fail closed for workflow/classifier or instruction-authority changes, code-bearing paths, executable/symlink/gitlink/type-change surfaces, malformed/truncated/ambiguous records, non-canonical paths, unsupported status/mode/object-id combinations, or any evidence shape it cannot prove safe.

Exact-current #287 execution is terminal:

• CI 33931806137: success;
• Security Scan 33931806226: success;
• SAST Semgrep 33931806165: success;
• CodeQL PR 33931806139: failure.

The CodeQL failure is the same central dispatch/verdict control-plane signature independently observed on other OriginWeave heads, not an identified classifier-source finding. Detect-languages succeeded. Javascript-typescript job 101244865461, actions 101244865470, and python 101244865526 each successfully completed Request current-head CodeQL scan dispatch and then failed at Release runner or enforce current-head CodeQL verdict. Keep the prerequisite fail-closed and hand the central verdict problem to ContextualWisdomLab/.github#712; do not duplicate CodeQL locally or substitute the earlier skipped Ready-transition run.

Repair order and acceptance

1. Get test(ci): stage protected docs-only classifier foundation #287's workflow-free classifier foundation through exact-head required central verdict, review/thread gates and normal protected-main promotion. Current leaf CI/Security/Semgrep success does not override the failed required CodeQL verdict or one-approval rule.
2. After that classifier is immutable on protected main, use the authorized .github workflow-owner path to reconstruct/adopt test(ci): define fail-closed docs-only partition contract #282's valid workflow/config delta against the protected classifier. Keep test(ci): define fail-closed docs-only partition contract #282 open until its valid delta is actually adopted; do not close it merely to reduce PR count.
3. In the same authorized owner lane, repair ci: stop draft PR jobs from occupying runners #286's Ready lifecycle so ready_for_review for a non-draft PR materializes the required native jobs instead of an all-skipped workflow. Preserve converted_to_draft/closed capacity handling and fail closed on uncertain event state.
4. Run docs(ci): exercise prose-only CI partition #283 or a verified successor as the realistic prose-only canary. Acceptance requires the applicable Python repository/documentation contracts to execute on the exact head while Rust build/test/rustdoc/Clippy and Production coverage jobs are absent rather than cancelled/skipped.
5. Run a code-bearing exact-head control proving normal Rust and coverage lanes still materialize and execute.
6. Keep runner admission/provider/platform incidents distinct from trigger partitioning. A queued, runner-less, startup-failed, cancelled, skipped, or central-verdict-missing job is not GREEN.
7. Preserve active ruleset 18156473: one counted approval, stale-review dismissal after push, required resolved threads, extra approval for unattributed changes, seven central required workflows, and deletion/non-fast-forward prohibitions. Do not self-approve or bypass.

Exact evidence

• protected main: 87c4daa1830bac5a5228b6036752ad5633232085 (ci: stop draft PR jobs from occupying runners #286), validly signed;
• test(ci): stage protected docs-only classifier foundation #287 current exact classifier foundation: af83c40dd2990a03064a92ca75430a9cc400f098;
• test(ci): stage protected docs-only classifier foundation #287 predecessor Ready-transition native CI: 33928039835, terminal skipped and therefore not GREEN;
• test(ci): stage protected docs-only classifier foundation #287 current synchronize CI/Security/Semgrep: terminal success; CodeQL 33931806139: terminal central-verdict failure;
• test(ci): define fail-closed docs-only partition contract #282 remains the valid authorized-workflow successor delta; docs(ci): exercise prose-only CI partition #283 remains the prose-only canary after protected classifier + workflow activation;
• active ruleset 18156473: 1 approval, stale-review dismissal, resolved threads, extra unattributed-change approval, seven central required workflows, deletion/non-fast-forward prohibited.

Keep this issue open until the protected-main CI has both an exercised docs-only exact-head partition and a working Ready-transition verification path, with no gate weakening.

[seonghobae]

Fresh exercised evidence from docs-only PR #238 now confirms the remaining partitioning gap on an exact current head.

• docs: refresh live product gap baseline #238 head 74be6f5c73f4b77ade02c3e7d40e7405b8863402 changes only the volatile delivery-state section of docs/product-technical-gap-baseline.md; commit diff leaves ## Observed snapshot: 2026-08-29 and all dated history below it unchanged.
• [QUEUE_SATURATION_CHICKEN_EGG] fix(ci): revert docs paths-ignore — closes doc-content contract test gap #280 correctly causes this docs-only head to materialize repository-native CI again.
• CI run 33731861692 nevertheless creates both Rust contracts job 100573405642 and Production coverage job 100573405261 for this prose-only delta. At the latest exact read both are queued, steps=[], runner_id=0, runner/group unassigned.

This is not a source RED/GREEN verdict and runner admission remains a separate incident class. It is direct trigger-shape evidence for #279 acceptance: the canonical workflow owner should retain the Python documentation/traceability/product-gap contracts on docs-only heads while avoiding unnecessary Rust build/test/coverage work. Do not reintroduce #278's docs skip, and do not repair this from a product leaf by editing .github/**.

[seonghobae]

Fresh trigger-shape evidence from docs-only PR #238 after the #70 sandbox evidence refresh:

• docs: refresh live product gap baseline #238 exact head 53ab9fa8ec2e930072c67e1cee4e6fb3971d6f1f changes only docs/product-technical-gap-baseline.md relative to predecessor 74be6f5c73f4b77ade02c3e7d40e7405b8863402; GitHub compare reports one file, 2 additions / 2 deletions. The historical ## Observed snapshot: 2026-08-29 section was preserved; only the volatile observation timestamp and test(browser): execute controlled Agent Task on pinned Chrome #70 live-evidence row moved.
• Despite that prose-only delta, CI run 33739008046 materialized both Production coverage job 100596280444 and Rust contracts job 100596281039; both are currently queued with no steps.
• SAST 33739007929, Security 33739008059, OSV 33739008449, and Scorecard 33739007936 also materialized; this comment does not propose weakening central security gates.

This is direct current-head evidence for #279's partitioning problem: #280 correctly restored fail-closed documentation verification, but the local CI job shape still couples docs contracts to Rust-heavy work. The canonical repair should preserve an exact-head documentation/traceability/product-gap contract path while preventing prose-only deltas from scheduling unnecessary Rust build/test/coverage. A runner-less queued job remains non-GREEN and is a separate admission/capacity incident, not proof that trigger partitioning is solved.

[seonghobae]

Canonical owner repair is now open as Draft PR #282, exact head 52285e5ec173208674dd4ad051684129b45779de on protected main@c789b802fc98a8d7fd8c09d9327f36828054d2a1.

The causal split is implemented without restoring #278's docs skip: exact-head Python repository/documentation contracts move to an always-executed Repository and documentation contracts job; a fail-closed exact changed-path classifier gates only the Rust/coverage jobs. docs/** and root *.md are the sole lightweight surface; mixed/code/test/script/workflow/config changes, empty evidence, malformed path input, and push-to-main all require the Rust-heavy path. Renames are classified with --no-renames so code→docs movement cannot hide a deleted code path.

Test-first lineage is c8c898b013ef4260725d92e7ce9828f665b5879c (new workflow-contract regression while the old coupled workflow still existed) followed by causal workflow repair 52285e5ec173208674dd4ad051684129b45779de. Hosted RED/GREEN is not synthesized. #282 itself is code-bearing and therefore must exercise the full path. Keep #279 open until unchanged-head CI/security/review evidence is terminal and a real prose-only exact-head canary proves the documentation contract runs while Rust contracts and Production coverage are absent/skipped. Runner admission remains a separate incident class.

[seonghobae]

A real prose-only stacked canary is now open as Draft #283, exact 710b00e6c8c7744b877bc5e1075859e32a193adb, base fix/docs-only-ci-partition@52285e5ec173208674dd4ad051684129b45779de. Its effective delta is one new docs/doctoring/ci-docs-only-partition-canary.md file and no workflow/script/test/Rust change. This gives #279 a direct GitHub Actions acceptance target rather than relying only on unit/source inspection. Keep #283 Draft until the unchanged head actually runs the parent classifier and documentation-contract job and proves the Rust/coverage lanes do not execute.

[seonghobae]

Authority correction after fresh protected-main AGENTS.md read: scheduled agents are explicitly allowed to open bounded reviewed PRs but are not allowed to alter workflows. The transient workflow implementation on #282 predecessor 52285e5ec173208674dd4ad051684129b45779de therefore exceeded this writer's authority and has been neutralized on current head 044cd294bddd737433da7f37756b5b71d5fe8c39. Exact compare to protected main now contains no .github/** delta—only scripts/ci/classify_ci_change_scope.py and tests/test_ci_change_scope.py remain as a fail-closed candidate classifier plus intentional RED workflow contract.

#283 was non-force-restacked onto the repaired parent and is now exact f01aab7eafa37ed8bdf8f582f735d25da23f33fc; compare to parent is again exactly one docs/** file. Any CI run created from the transient predecessor workflow tree is superseded and not acceptance evidence.

#279 therefore remains open with a concrete external authority requirement: an authorized non-scheduled workflow writer must satisfy #282's RED contract. Do not work around this by editing AGENTS, weakening the rule, reusing predecessor statuses, or moving the workflow mutation into another scheduled leaf.

[seonghobae]

Current-head RED is now directly observed without any scheduled workflow mutation. On prose-only canary #283 exact f01aab7eafa37ed8bdf8f582f735d25da23f33fc, compare to current parent 044cd294bddd737433da7f37756b5b71d5fe8c39 is exactly one docs/doctoring/ci-docs-only-partition-canary.md file. Nevertheless CI run 33794987681 immediately materialized both Rust contracts job 100780409062 and Production coverage job 100780409480; both are currently queued with steps=[] and runner_id 0.

That is the exact #279 trigger-shape RED: the prose-only delta schedules both heavy lanes before any runner admission. Runner starvation is a second, separate fact and is not the reason those jobs exist. #282 current head 044cd294... retains the fail-closed classifier candidate and regression contract, while .github/workflows/ci.yml is byte-identical to protected main. An authorized workflow writer can now repair against a concrete current-head RED rather than inferred queue behavior.

[seonghobae]

Current contract/canary identities after the latest safe increment: #282 is 077704efbdd7431ab123d675db76dc47948600ba with exactly two non-workflow files; #283 is a066671a62599b81cafcade84769ded474708f2d and compares to its parent as exactly one docs file. Current canary CI 33795440390 again materialized Rust contracts 100781887315 plus Production coverage 100781887642 before runner admission. This confirms the trigger-shape RED survives the authority correction and parent test hardening.

#282 now also covers the classifier CLI boundary, absolute/parent-relative rejection, nested Markdown outside the reviewed docs surface, invalid UTF-8, empty evidence, mixed/code-bearing deltas, and deterministic output. Its current .github/workflows/ci.yml is still identical to protected main. The only missing causal implementation is the workflow change that live AGENTS.md reserves to an authorized non-scheduled writer.

[seonghobae]

Fresh owner-path evidence from #282/#283: the classifier contract had a second fail-open edge beyond rename/copy preimage loss. A non-empty git diff --name-status -z stream without its terminal NUL (for example M\0docs/PRD.md) was accepted as complete docs-only evidence, so truncation could hide a later code-bearing record and incorrectly suppress Rust-heavy verification. Review 5107434963 records the finding. Test-only 910fd12481eba541b98f738ae3977a318621a1c3 adds parser/CLI RED contracts; causal e08f68614ca21a9a751461f9e642d2a66b4fe8ff now requires terminal NUL on every non-empty path/status stream and fails closed with no scope outputs. #282 still contains no .github/** delta.

#283 was non-force reconciled onto that parent at d27f00580f3d54355f21167453e67a9648383acc; exact parent→child compare remains one prose-only docs canary (+7/-0). Fresh exact-head CI run 33813551801 still materializes both Production coverage 100840591085 and Rust contracts 100840591337; both are runner-less/queued, so this is trigger-shape RED rather than runtime GREEN/RED. Authorized workflow acceptance should therefore consume complete status-aware NUL framing, preserve repository/documentation contracts, skip Rust-heavy work only on a valid prose-only decision, and fail closed to the full path on malformed/truncated input. Scheduled OriginWeave writer did not mutate .github/**.

[seonghobae]

Owner-path acceptance update from #282/#283: status/path-only evidence is insufficient for a safe docs-only Rust skip because git diff --name-status -z drops file modes. In an actual Git repo, converting docs/guide.md from a regular blob to a symlink produces T\0docs/guide.md\0; editing an existing docs symlink produces M\0docs/guide.md\0. The current mode-aware contract is #282 exact 67460f0f0b45603243fce14c7007f1d698cb4e62: test-only a28270781244192b0f5bb57b2f58d8b5322c7870 / 149c15c03b0d130d534882fc87308c73dfd90d2a, causal raw parser 67460f.... Lightweight authority now requires complete git diff --raw -z evidence and ordinary 100644 blobs (with 000000 only on the absent side); symlink 120000, gitlink 160000, executable 100755, type-change, malformed/truncated evidence, and code-bearing rename/copy preimages remain full-Rust/fail-closed. Legacy name/status evidence always yields rust_required=true.

#283 has been non-force restacked onto that exact parent at 247b9e81c7bfbc286c6afcbced0b4904c4459865; parent→child compare remains one prose canary file (+7/-0). Fresh CI run 33816040229 nevertheless materializes Rust contracts job 100848292357 and Production coverage job 100848292745, both queued with no runner/steps. Job existence is the current trigger-shape RED; runner admission is separate.

Authorized workflow-owner acceptance therefore changes from --name-status -z to complete mode-aware git diff --raw -z (or an equivalent representation retaining src/dst modes and both rename/copy paths), while exact-head repository/documentation contracts remain always-on and only Rust-heavy jobs are gated. Scheduled writer did not mutate .github/**.

[seonghobae]

Owner-path acceptance update from #282/#283: the mode-aware raw parser still had a malformed-evidence fail-open edge because object IDs were syntax-checked and discarded. Git raw format couples absent modes to all-zero object IDs; predecessor #282 accepted impossible input such as :000000 100644 1111111 2222222 A\0README.md\0 and classified it as documentation-only. Review 5107922663 records the finding. Test-only ccbf987dd10b50ffafd8a0766917afaaeca1aed7 adds A/D/M regressions; causal #282 head 75d1432e8a0d2f83ed8780bc0a7f2300cee7bdc8 now requires equal abbreviated OID widths and exact mode/OID presence coupling before any lightweight decision. Current-head review 5107936141 records focused source verification; .github/** remains unchanged.

#283 was non-force reconciled onto that parent at 0b096721bad18f0e5d75e601826cfb730ee55380; exact parent→child compare is still one prose canary file (+7/-0), merge base exactly the current parent, 0 behind. Fresh CI 33820228681 nevertheless materializes Rust contracts 100861121978 and Production coverage 100861122055, both queued with no steps/runner. Job existence remains the trigger-shape RED; runner admission is separate.

Authorized workflow-owner acceptance therefore requires a complete two-tree git diff --raw -z (or equivalent) integrity envelope: src/dst modes, src/dst object IDs, status/score, NUL framing, and both rename/copy paths. Mode/status/path-only, truncated/malformed, impossible mode/OID, symlink/gitlink/executable/type-change, and code-bearing rename/copy evidence must fail closed to the full Rust path, while exact-head repository/documentation contracts remain always-on. Scheduled OriginWeave writer did not mutate workflows.

[seonghobae]

Additional owner-path security finding after the raw-object integrity repair: the classifier implementation itself must be a trusted input. Protected-main CI currently checks out the PR head. If the future partition then invokes python3 scripts/ci/classify_ci_change_scope.py from that checkout, a code-bearing PR can replace the program that decides whether its own Rust/coverage jobs run and return rust_required=false. Raw-path/mode/OID validation cannot defend against a tampered validator.

Review 5107962287 records the finding on #282 exact 75d1432e8a0d2f83ed8780bc0a7f2300cee7bdc8. Authorized owner acceptance must therefore anchor classification code in protected-base content or an immutable exact-SHA reusable .github workflow/tool, then feed it the exact PR base/head two-tree raw diff. A PR change to the classifier or its CI plumbing must itself take the Rust-heavy path. Do not source the skip decision from mutable PR-head code, and do not solve this by weakening AGENTS.md or moving self-authorizing logic into another leaf script. The scheduled OriginWeave writer has not altered workflows.

[seonghobae]

Fresh owner-path evidence: #282 advanced to 49f94d4cef45cf861e2de73abf3ab7c39d265211 after review 5108215398 found the shared raw-diff test fixture was stale against the new mode/OID invariant. The fixture now emits all-zero OIDs exactly for 000000 absent sides; production validation was not weakened. #283 was non-force restacked to a037da66e175be1c97e1364496e4abcf1cbb378a, with exact parent→child compare still one prose file (+7/-0). Fresh CI 33824265448 nevertheless materializes Production coverage 100873441456 and Rust contracts 100873441577, both runner-less/queued. Thus #279 remains a trigger-shape RED: the authorized workflow owner still needs trusted-base/immutable classifier authority, exact base/head raw-diff evidence, always-on documentation contracts, and Rust-heavy jobs gated only when rust_required=true. No scheduled-writer .github/** mutation was made.

[seonghobae]

Fresh #282/#283 owner-path evidence adds one more fail-closed requirement.

Review 5108483511 found that the candidate classifier treated every regular 100644 blob under docs/** as prose. That would let a code/config-bearing change such as docs/browser_fixture.js, docs/generate.py, docs/runtime.rs, or docs/package.json return documentation_only=true and suppress Rust/coverage after workflow integration, contrary to #279's requirement that code-bearing PRs retain the normal Rust path.

Test-only RED is 4f604fe55f7a63c30f637c7a2c91060d5638f213; causal fix is #282 exact 7c87bc30b38572eb392f9317e91eb8cfce5e69dd, which restricts lightweight authority to Markdown under docs/** or root-level Markdown while unknown/non-prose docs artifacts fail closed to Rust. Protected-main compare is 17 ahead / 0 behind, merge base exactly main@c789b802..., with five classifier/test files and no .github/** delta.

The stacked positive canary #283 was non-force reconciled to exact a8baf85f62f47b3fafe287e2a163414544b1ee1f; parent→child semantic delta remains only docs/doctoring/ci-docs-only-partition-canary.md (+7/-0), merge base exactly the current #282 head, 0 behind. Exact CI 33827986843 still materializes Production coverage 100884643624 and Rust contracts 100884643842; both are queued with no runner/steps. Job existence remains current trigger-shape RED; runner admission remains separate.

Final workflow-owner acceptance therefore must preserve not only raw mode/OID/status/path integrity and a trusted classifier source, but also a reviewed prose-only path surface. docs/** must not be a generic regular-blob skip prefix. Keep #279 open until an unchanged Markdown canary runs the exact-head repository/documentation contracts while Rust-heavy jobs are absent, and a non-prose docs/** canary still takes the Rust path.

[seonghobae]

Fresh owner-path acceptance update. Review 5108814282 found one more control-plane false-lightweight case in #282: protected-main AGENTS.md explicitly governs automated-contributor permissions/gates, and CLAUDE.md is also root instruction authority, but the predecessor predicate treated both as ordinary root Markdown. Test-only RED c01c703c911b1d36dde3577d7f96db71f20fe969 now proves those authority files must require the full Rust lane; causal source repair dc429da3318cdc14740317bed702497fe62dd562 deny-lists exactly AGENTS.md and CLAUDE.md while preserving ordinary reviewed prose eligibility. Current-head review is 5108827392. #283 was non-force restacked onto that parent at 13837acb4de37759ce26852f807bba4e3b78b3ad; exact parent→child semantic diff remains one Markdown canary file (+7/-0), but fresh CI 33832194240 still materializes Rust contracts 100897346680 and Production coverage 100897346799, both queued with no runner/steps. Therefore the workflow-shape RED remains. Authorized workflow repair must keep the trusted-classifier/exact-base-head raw-evidence design and must force full-Rust on classifier, workflow, and agent-instruction authority changes; AGENTS.md/CLAUDE.md are not lightweight prose.