test(review): lock split target and central mention authority

[seonghobae]

Verified review-evaluation case

A current-head Devin review correctly identified that this branch had crossed two distinct authority domains: the organization sweep needs a cross-repository credential to read and acknowledge sibling PRs, but agent_mention_router.dispatch_request() always publishes wrapper events to ContextualWisdomLab/.github. Replacing the central job token with the target/App credential can therefore make the installation-fallback path unable to dispatch the central workflow.

The original branch hypothesis was falsified. Protected current main@4ae90e18b03a3a455e13e501628010cabc5c37a8 already has the correct split: target reads use the selected organization/App credential while central artifact lookup and repository_dispatch use the .github job-scoped github.token with job-scoped contents: write.

Finding-to-fix closure

• Re-fetched the writer branch before mutation and preserved concurrent commits.
• Reverted the unsafe production/config change and the contradictory documentation back to the protected-main contract.
• Replaced the RED assertions that demanded credential aliasing with permanent assertions that require AGENT_DISPATCH_TOKEN: ${{ github.token }} in the sweep and reject export AGENT_DISPATCH_TOKEN="$TARGET_REPOSITORY_TOKEN".
• Preserved the existing executable router regression where separate fake target and central clients prove wrapper dispatches go only to repos/ContextualWisdomLab/.github/dispatches while acknowledgements mutate only the target repository.
• Joined current protected main without force-push; the effective current-main delta is only the two regression-test files.

This converts a demonstrated external-review finding into a durable Noema/OpenCode false-negative/false-positive evaluation case for internal-vs-external authority-boundary overreach, instead of shipping the initially proposed fix.

Scope and acceptance

This PR no longer claims that the target/dispatch credential split caused semantic-data-portal#81 to miss an OpenCode verdict. That incident remains a separate causal investigation and must not be 'fixed' by broadening or conflating credential authority.

Current exact head: e30ccae6f0fc8c16f7b67650d0523d1639f10281.

Require fresh exact-head checks/review evidence and ordinary protected-branch admission. No gate, approval, merge authority, or external-write scope is expanded.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 5ff00835-0daf-429b-bd05-c271429f0470

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

2026-09-20 protected-base admission correction for fd553ce0399274d0ebcb64771aae6131a2ea40af.

GitHub reports this Ready PR mechanically non-mergeable. Exact comparison with protected main is diverged and 362 commits behind; CodeQL is terminal failure and no approval exists. Historical receipts cannot authorize the current protected-base merge.

Moving the PR to Draft / Proposed preserves every commit, review, thread, and valid delta. This is not closure or abandonment. Reconcile protected main through an ordinary non-force merge, repair valid findings, run terminal exact-head protection, and obtain qualifying independent current-head approval before returning to Ready. No review dismissal, synthetic status, manual rerun, bypass, Force Push, merge, or Close is authorized.