[Fleet incident] Disable orphaned one-shot hardening and release-helper workflow identities

[seonghobae]

Live Actions registry drift

The repository's Actions API currently reports 23 workflow identities. Numerous historical one-shot hardening, dependency-lock, branch-normalization, review/merge, calendar-repair, and v0.8.0 release-helper records remain in state: active, including examples such as:

• one-shot-calendar-repair.yml;
• one-shot-commercial-hardening.yml and v2;
• one-shot-final-hardening-gate.yml;
• one-shot-fix-contract.yml;
• one-shot-format-verify.yml;
• one-shot-hardening-review-merge.yml;
• one-shot-httpx2-lock.yml and one-shot-lock-dependencies.yml;
• one-shot-normalize.yml, one-shot-review-and-merge.yml, and one-shot-verify.yml;
• v0.8.0 prepare/finalize/recover helpers.

Fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/one-shot-calendar-repair.yml. The source is absent, but GitHub continues to advertise the workflow identity as active.

The supported CI, Hourly NVIDIA NIM Product Development, Hourly Product Quality Loop, NVIDIA evaluation, and current release/security workflows must be preserved.

Root cause

Temporary hardening and release-helper workflows were removed from the protected-main tree after their bounded use, while their independent Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current source-level tests cannot detect orphaned control-plane identities after source removal.

Realistic remediation

Do not restore historical YAML and do not create another self-deleting cleanup workflow. Under the Four Pillars owner/operations loop:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected-main SHA and tree;
3. classify present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intended pending supported integrations, and unresolved records;
4. refetch exact branch/workflow state immediately before mutation;
5. disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
6. preserve all current supported CI, hourly development/quality, NIM evaluation, security, and release workflows;
7. retain immutable before/after evidence.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not introduce another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority into an untrusted scanner.

Acceptance criteria

• complete paginated inventory and exact protected-main binding;
• every reviewed active repository-path workflow absent from protected main disabled or explicitly justified;
• no current CI/hourly/NIM/release workflow disabled through name-only matching;
• no historical hardening or release-helper source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a currently present release helper still owned by an active release process;
• exact-head CI/security/review gates;
• normal protected-main integration;
• post-remediation live inventory proves orphan identities disabled while supported Hourly NVIDIA NIM Product Development and Product Quality Loop paths remain operational.

This issue belongs to the organization-wide Hourly Product Development fleet incident. The fleet audit remains read-only and tracks protected-main operational evidence.

[seonghobae]

Operational remediation completed against protected main cd4f4e6361238a1db43c28540640a407c7bf7c6e on 2026-08-31. Immediately before mutation, all 18 targeted repository-path workflow identities were active and each exact protected-main contents lookup returned 404. Those 18 identities are now disabled_manually, including the newly orphaned .github/workflows/repair-pr31-ci.yml identity. The five source-backed workflows (ci.yml, hourly-nim-product-development.yml, hourly-product-loop.yml, nim-eval.yml, release.yml) remain active, as do the two GitHub-owned dynamic CodeQL workflows. No source was restored and no token/workflow authority was added. The issue remains open because the organization-wide read-only recurrence detector and its adversarial acceptance suite are tracked by the linked central/AppGuardrail work and are not yet proven here.

[seonghobae]

Live registry inventory (read-only, 2026-09-13T13:54:15Z, protected main = 8c6a2fa76af1cb7f6bb7f56ceb4e7ce92d2f7897)

Paginated GET /repos/ContextualWisdomLab/four-pillars/actions/workflows?per_page=100 returned 25 identities, no further pages.

classification	count	identities
present on main, active	5	ci.yml, hourly-nim-product-development.yml, hourly-product-loop.yml, nim-eval.yml, release.yml
absent from main, disabled_manually	18	app-finalize-v0.8.0, complete-v0.8.0, finalize-v0.8.0-on-push, prepare-v0.8.0-on-push, recover-v0.8.0-release, repair-pr31-ci, one-shot-{calendar-repair, commercial-hardening, commercial-hardening-v2, final-hardening-gate, fix-contract, format-verify, hardening-review-merge, httpx2-lock, lock-dependencies, normalize, review-and-merge, verify}
GitHub-owned dynamic, active (expected)	2	dynamic/github-code-scanning/codeql (326312916), dynamic/github-code-quality/codeql (343204628)
absent from main, still active	0	—

Acceptance status: every repository-path identity absent from protected main is disabled; no supported CI/hourly/NIM/release workflow was touched. Still open from the acceptance list: the read-only recurrence detector with adversarial tests (pagination truncation, 403/404/5xx, renamed IDs, dynamic workflows) is not present in this repository (no script under scripts/ or tests/ references the Actions workflows API); central lifecycle owner is ContextualWisdomLab/.github#945.

[seonghobae]

Remaining acceptance item (read-only recurrence detector with adversarial tests) is implemented in #44: scripts/workflow_registry_audit.py runs in the minute-17 quality loop with actions: read, binds the inventory to the run SHA/time, records pagination receipts, exits 1 on active orphans and 2 on 403/404/5xx or duplicated id/path (never reported as clean). Live run @ 8c6a2fa: 25 identities, 0 orphans.

[seonghobae]

Post-remediation live inventory

The final acceptance criterion asks for a live inventory proving the orphan identities are disabled while the supported paths stay operational. Here it is, taken just now rather than quoted from an earlier run.

Registry paginated in full against ContextualWisdomLab/four-pillars, bound to protected-main SHA 8c6a2fa, observed at 2026-09-14T14:28:40Z.

classification	count
present on protected main, active	5
absent from main, still active (orphans)	0
absent from main, disabled	18
GitHub-owned dynamic	2

The five still-active identities are exactly the five workflow files on main: ci.yml, hourly-nim-product-development.yml, hourly-product-loop.yml, nim-eval.yml, release.yml. So the supported CI, hourly development, hourly quality, and NIM evaluation paths all remain operational and none were disabled by name-only matching.

Every identity this issue named is now disabled_manually, including all eleven one-shot-* records, the three v0.8.0 release helpers, app-finalize-v0.8.0.yml, recover-v0.8.0-release.yml, and repair-pr31-ci.yml. No historical YAML was restored to produce this state.

What remains

The remediation itself is done. The outstanding criterion is the read-only recurrence detector, which is PR #44. That PR carries the detector emitting workflow ID, path, state, default-branch SHA, observation time, and per-page receipts, plus adversarial cases for pagination truncation, 403/404/500/503, duplicate or reused workflow IDs, GitHub dynamic workflows, and exact path comparison including case variants.

The numbers above were produced by running that PR's script against the live registry, so the detector is verified on production data and not only on fixtures. It exits 0 today, which is the correct verdict.

PR #44 cannot merge yet. Its two failing checks come from a CodeQL PR run whose workflow .github/workflows/codeql-pr.yml is not on main and whose workflow ID 348967705 returns 404 and is absent from the paginated registry, so it cannot be edited or re-run from this repository. Details are on that PR.