[Fleet incident] Disable orphaned commercial-readiness and PR repair workflow identities

[seonghobae]

Live Actions registry drift

The repository's GitHub Actions API currently reports 32 workflow identities. Numerous historical bootstrap, one-shot production verification, attachment repair, PR-specific repair/finalizer, and bot-reopen records remain in state: active, including examples such as:

• bootstrap-opencode-commercial-readiness.yml;
• finalize-419-as-bot.yml;
• one-shot-clearfolio-production-boundary.yml;
• one-shot-oidc-production-verification.yml;
• one-shot-orchestrator-production-boundary.yml;
• one-shot-secure-stripe-webhook.yml;
• one-shot-session-auth-repair.yml;
• attachment repair/reopen workflows;
• PR 386, 397, and 419 repair workflows.

Fresh protected-default-branch contents lookup returns 404 Not Found for sampled active path .github/workflows/one-shot-session-auth-repair.yml. The source file is absent from current develop, but GitHub continues to advertise its workflow identity as active.

The supported Hourly OpenCode Commercial Readiness, Fuzz, OpenCode Review, dependency/security, Pages, release, and current product workflows must be preserved.

Root cause

Temporary commercial-readiness, production-boundary, and PR repair workflows were removed from the repository tree after their bounded purpose, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level checks cannot detect orphaned control-plane identities after source removal.

Realistic remediation

Do not restore historical YAML and do not create another self-deleting cleanup workflow. Under ScopeWeave's dedicated writer/operations loop:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected develop SHA and tree;
3. distinguish present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intentionally pending supported integrations, and unresolved records;
4. refetch exact branch/workflow state immediately before mutation;
5. disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
6. preserve all current scheduled, review, CI/security, release, and product workflows;
7. retain immutable before/after evidence.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not add another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority to an untrusted scanner.

Acceptance criteria

• complete paginated inventory with exact protected-default-branch binding;
• every reviewed active repository-path workflow absent from current develop disabled or explicitly justified;
• no current Hourly OpenCode Commercial Readiness or supported production workflow disabled by name-only matching;
• no historical bootstrap/repair source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a legitimate present one-shot-like production verification still owned by an active PR;
• exact-head CI/security/review gates;
• normal protected-default-branch integration;
• post-remediation live inventory proves orphan identities disabled while supported ScopeWeave automation remains operational.

This issue is part of the organization-wide GitHub Actions fleet incident. The fleet audit remains read-only and tracks protected-branch operational evidence.

[seonghobae]

Fresh control-plane reconciliation on protected develop@b88e66e81e9701404d29a0f5de4f58573ceee14f confirms the Actions registry still has 32 workflow identities while the protected tree contains only six repository workflow files: codeql.yml, dependency-review.yml, fuzz.yml, osvscanner.yml, pages.yml, and server-tests.yml.

The following 17 active repository-path workflow identities are absent from the protected tree and have no current supported-source exception; these are confirmed orphan-disable candidates by exact workflow ID/path, not by name pattern:

• 327039258 — .github/workflows/bootstrap-opencode-commercial-readiness.yml
• 326827683 — .github/workflows/finalize-419-as-bot.yml
• 330443260 — .github/workflows/one-shot-clearfolio-production-boundary.yml
• 330448496 — .github/workflows/one-shot-oidc-production-verification.yml
• 330444460 — .github/workflows/one-shot-orchestrator-production-boundary.yml
• 330429017 — .github/workflows/one-shot-secure-stripe-webhook.yml
• 326109288 — .github/workflows/one-shot-session-auth-repair.yml
• 326780724 — .github/workflows/patch-attachment-repair-browser.yml
• 326793408 — .github/workflows/reopen-attachment-refresh-as-bot.yml
• 326745301 — .github/workflows/repair-attachment-status-refresh.yml
• 327396952 — .github/workflows/repair-attachment-upload-redaction.yml
• 326217657 — .github/workflows/repair-pr-386.yml
• 326221973 — .github/workflows/repair-pr-397-session-auth.yml
• 326919387 — .github/workflows/repair-pr-419-coverage.yml
• 326921328 — .github/workflows/repair-pr-419-ready.yml
• 327052085 — .github/workflows/run-current-commercial-readiness-20260804.yml
• 327059121 — .github/workflows/wait-dispatch-opencode-20260804.yml

Explicit non-candidates on this evidence:

• 329983499 hourly OpenCode path is absent from protected develop but is currently owned by live PR ci: add hourly OpenCode commercial-readiness loop #444; preserve pending that PR's disposition.
• 293923988 OpenCode Review is explicitly preserved by protected AGENTS.md as organization-level required review authority; do not disable merely because the local YAML is absent.
• GitHub dynamic/* identities remain GitHub-owned and are not repository-path orphan candidates.
• repository codeql.yml and strix-selftest.yml identities are already disabled_manually; no mutation is needed.
• 298254954 Scorecard Security Scan is absent from protected develop, but its current governance ownership is not established by the tree alone; leave it unresolved rather than disable by inference.

No workflow state was changed in this pass: the connected GitHub action surface exposes workflow reads/logs/reruns but no enable/disable-workflow mutation. This is a control-plane capability boundary, not evidence that the orphan states are acceptable. Before any authorized disable operation, refetch the protected tip and each exact workflow ID/state again, then disable only the confirmed candidates whose identity/path classification is unchanged.

[seonghobae]

Executable detection slice is now in PR #497 at current head 93da50410eeff698fa942cb40c67f9bb6554d8db, based directly on protected develop@b88e66e81e9701404d29a0f5de4f58573ceee14f.

The detector is deliberately read-only: it requires complete pagination, unique workflow IDs, documented workflow states, an existing protected workflow directory, canonical explicit preserve paths, an unchanged protected SHA, same-origin pagination, and bounded 5xx retries. It exposes no disable/write mode and is registered in the normal unit suite. The current conservative operator example preserves PR #444's hourly workflow, organization-authoritative OpenCode Review, and Scorecard while ownership remains unresolved.

#478 remains open. Actual orphan disable + exact post-disable registry/tree verification still require a GitHub Actions-write control surface; the connected GitHub app available to this maintainer still exposes workflow reads/logs/reruns but no enable/disable mutation. PR #497 must also complete its own exact-head CI/security and independent review gates before it is integration evidence.

[seonghobae]

Fresh exact-state incident delta on protected develop@b88e66e81e9701404d29a0f5de4f58573ceee14f: the GitHub Actions registry has increased from the previously recorded 32 identities to 33, while the protected tree still contains only the same six repository workflow files (codeql.yml, dependency-review.yml, fuzz.yml, osvscanner.yml, pages.yml, server-tests.yml).

Newly observed active absent identity:

• 335021802 — .github/workflows/apply-adaptive-orchestrator-default.yml — state: active, created/updated 2026-08-15T22:04:17+09:00.

This path is absent from the exact protected tree, so it is new evidence that registry drift is still occurring after the prior 32-identity reconciliation. It was not included in the earlier 17-candidate inventory because it did not exist then. Do not disable it by name-pattern inference: before any authorized mutation, refetch this exact workflow ID/state, protected develop, and current source ownership/PR provenance, then classify it under the detector contract. Existing preserve/unresolved exceptions remain unchanged until independently revalidated.

No workflow state was changed here. The connected GitHub mutation surface still exposes workflow reads/logs/reruns but no supported workflow-disable operation, so the actual cleanup remains an authorized control-plane action rather than a scanner or temporary workflow responsibility.

[seonghobae]

Fresh control-plane evidence on protected develop@ffeffde83d62a3c0710c446a43f89aed495ae0a8 expands the incident beyond the 32-identity snapshot in the issue body:

• the paginated Actions registry now reports 34 workflow identities;
• newly registered CodeQL Required workflow identity 335384625 is an intentional active PR fix(ci): execute Server Tests on exact PR heads #523 control and must be preserved;
• historical CodeQL identity 310400876 remains disabled_manually while its superseded source is being removed by fix(ci): execute Server Tests on exact PR heads #523;
• active orphan-style identities such as apply-adaptive-orchestrator-default.yml (335021802), bootstrap-opencode-commercial-readiness.yml (327039258), hourly-opencode-commercial-readiness.yml (329983499), one-shot verification, attachment repair, and PR-specific repair identities remain advertised in the registry even where the current protected tree has no corresponding source.

A related code-scanning lifecycle symptom is now reproducible on exact PR #523 head 89db19ebab052b4cf0f98d6241324ff3d18e4ec0: GitHub Advanced Security emits neutral / configuration-not-found comparison checks for historical protected-base configurations scorecard-analysis.yml (supply-chain/branch-protection) and trivy.yml (trivy). Exact Contents reads confirm both workflow paths are absent from protected develop and the PR head. These neutral records are not being promoted to passing evidence.

The connected repository writer can read the Actions registry but does not expose a supported workflow-disable / code-scanning-configuration cleanup mutation; the code-scanning analyses endpoint is also inaccessible to the integration. Do not restore stale scanner YAML merely to silence comparison metadata. Remediation still belongs to an authorized GitHub control-plane cleanup that preserves current required/review/security workflows and retains before/after identity evidence.