fix(governance): automate ruleset owner-plane reconciliation

[seonghobae]

Current authority / repair state — 2026-09-15

Canonical source head remains 722fec9de67aece7500993ee2999b21df0fab83b, but its historical base main@fb17ef556f94f673234aa557254ae52779e9a7b0 is no longer current. Fresh comparison against protected .github/main@91be6442906c7b6b4f600272c953699708394327 is diverged: 44 ahead / 252 behind, and the PR is currently non-mergeable. It has therefore been returned to Draft. Historical source-tree verification remains useful evidence for the retained delta, but it is not current-base acceptance and must not be transferred through reconciliation.

The Noema current-head masking finding on this source lineage was reproduced RED and repaired by accumulating named central, owner-repository, and stacked-ruleset failures before one terminal fail-closed exit; missing payloads are never audited as valid. Historical exact-tree verification on 722fec9... was focused governance contracts 55 passed; full 3195 passed, 1 skipped, 36 subtests; warnings-as-errors, workflow syntax, and git diff --check PASS.

Required next source action is an ordinary/non-force, conflict-aware reconciliation onto the then-current protected main, preserving the canonical solo-maintainer policy and all valid intervening central fixes. Do not force-push, destructively rebase, merge the stale head, or reuse historical Checks/reviews. After the reconciled descendant exists, reacquire all exact-head/current-base workflows, threads, and review evidence from zero before any Ready/merge decision.

---

Buyer/control-plane outcome

This is the canonical owner-plane writer for the live ruleset drift tracked by #772. Source integration alone does not mutate live settings: privileged apply remains disabled unless trusted protected main has CWL_RULESET_RECONCILE_ENABLED=true and the protected ruleset-governance-maintenance environment supplies a separately provisioned least-privilege CWL_RULESET_ADMIN_TOKEN with Administration write authority.

Fresh live drift

Live rulesets were re-read independently of this source head:

• inherited organization ruleset 18156473 remains active on default branches with required_approving_review_count=1, required_reviewers=[], CODEOWNER review disabled, last-push approval disabled, stale-review dismissal/thread resolution retained, central required workflows enforced, and OrganizationAdmin/always bypass still present;
• .github repository ruleset 17921150 remains active with approval count 0, last-push/CODEOWNER review disabled and thread resolution retained, but it still permits rebase in addition to merge/squash and still carries OrganizationAdmin/always bypass.

Therefore the live owner plane has not converged merely because this PR contains the desired policy source. The one-generic-approval organization rule remains structurally unsatisfiable for the accepted one-human-maintainer model without self-approval, fake humans, or treating bot/model review as human approval. Those workarounds remain forbidden.

Reviewed implementation boundary

• config/ruleset-governance.json binds exactly repository ruleset 17921150 and organization ruleset 18156473.
• The canonical policy is the solo-maintainer contract: approval count 0, last-push and same-author CODEOWNER approval disabled, no synthetic required reviewers, stale-review dismissal and thread resolution retained, merge/squash only, deletion/non-fast-forward retained, and routine bypass actors forbidden.
• The reconciler validates exact live target identity and invokes canonical ruleset auditors against projected and post-write live-shaped payloads so unmanaged scope/workflow/protection drift cannot be mislabeled as convergence.
• GitHub exposes no conditional unsafe PUT precondition for these ruleset updates. A second live read detects visible drift but is not represented as compare-and-swap.
• Privileged mutation samples immutable ruleset history before its final live read and binds CLI and callable mutation paths to an exact protected-main SHA. Ambiguous mutation results are settled from live state plus immutable history rather than blindly retried.
• Collision recovery follows immutable predecessor evidence, preserves newer administrator state, settles ambiguous recovery writes across the bounded observation horizon before any subsequent PUT, and rechecks version state after settlement before trusting the restore.
• Visible current-state changes are checked before a recovery write; protected-main freshness is then checked immediately before that privileged write. Once an earlier PUT may already have been accepted, history settlement and lossless compensation finish without a stale-main veto so an overwritten administrator predecessor is not stranded.
• Privileged non-PR owner-plane runs share one serialized non-cancellable concurrency group; read-only PR validation may supersede itself.
• Pull-request validation uses pinned actions and hash-locked tooling, verifies exact checkout, executes permanent governance/adversarial suites, and enforces 100% owned statement/branch/docstring gates without persisted checkout credentials.
• The source-derived two-target critical-section bound is 7,680 seconds / 128 minutes; the apply job uses GitHub's documented 360-minute hosted-job ceiling rather than inventing a smaller setup allowance.
• Doctoring records the REST/history authority boundary, timeout/collision semantics, current GitHub Actions execution limits, NIST SP 800-53 Rev. 5 AC-6/CM-3, and Sinan, Shahin, and Gondal (2025) in APA 7th form.

Conflicting sibling candidate

#1861 remains a blocked sibling candidate because its current proposal hard-codes two approving reviews plus last-push approval, which contradicts #772 and this canonical policy and would deepen the solo-maintainer deadlock. Its early-preflight mechanism may be retained only if a future ordinary descendant derives expected review settings from the canonical policy/config; the hard-coded two-human policy must not be merged or applied.

Acceptance boundary

After an ordinary/non-force current-main reconciliation, require terminal successor-head deterministic security/review evidence before normal protected integration. After source reaches protected main, provision the distinct least-privilege owner-plane identity, enable reconciliation only for a controlled maintenance interval, require exact live payload plus immutable-history convergence, re-run the canonical audit, and prove an unchanged deterministic-GREEN protected-PR can take the ordinary merge path without synthetic approval or routine administrator bypass. Genuine failed/absent required workflows and unresolved required threads remain blocking.

Do not mark Ready merely because the historical head tested clean. Do not self-approve, fabricate reviewers, count bots/models as humans, force-update, destructively rebase, use no-op wake commits, weaken required workflows/security/SAST/coverage/package/SBOM/provenance/thread/deletion/non-fast-forward controls, or use routine administrator bypass.

Refs #772, #1176, #1340, #1351, #1669, #1728, #1731, #1734, #1861, ContextualWisdomLab/Orgmetra#89.

[seonghobae]

Exact-head execution receipt: ordinary parents 665adfbb220317daf8efae0124d7c2005fc5576b + protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, exact tree 8191b45cb3dbcc6a084107fc61e1c84afdf04f95. The protected #2028 CodeQL repair is preserved and the governance delta remains 21 paths. Local GREEN: governance focused 208 passed; owner reconciler 186 passed; full 3149 passed, 1 skipped, 21 subtests; diff check PASS. Hosted successor gates are nonterminal, so this COMMENT is evidence only and is not approval or merge authorization.

[seonghobae]

2026-09-12 current-main reconciliation receipt

• Protected main re-fetched immediately before mutation: cb0872c9a20d5584703dffacca65c096fc034c6c, tree 37ee29906af20396506b6d70b77bfe7cfb2ad154.
• Writer re-fetched unchanged: e35cdc5d6527dfa8634654719a6c3681f16ed82a.
• Protected-main changes since the prior merge base and this PR's effective 21 governance paths are disjoint.
• Created ordinary two-parent merge commit 702446b51691db0460e87729e7250b99853026b1 with parents e35cdc5d... and protected main@cb0872c...; branch update used force=false.
• Fresh compare reports behind_by=0; protected-main-relative diff remains exactly the same 21 governance owner paths. No concurrent protected-main delta was discarded.
• Fresh successor-head hosted evidence is reset: immediately after publication no workflow runs had materialized. Predecessor checks/reviews are not transferred; PR remains Draft.
• Live ruleset settings were not mutated. Source integration still must reach protected truth and then the separately provisioned least-privilege reconciliation identity must prove live convergence before GOV-01 can close.

[seonghobae]

REVIEW ADMISSION — unchanged exact head 702446b51691db0460e87729e7250b99853026b1 was moved from Draft to Ready after terminal SUCCESS of Ruleset Governance Reconcile 34681934901, Security 34681934913, SAST 34681934900, Python Security 34681934910, and CodeQL 34681934948, with unresolved thread count 0 and mergeable=true. The PR body’s stale 2026-09-08 authoritative receipt was replaced with the current 2026-09-12 head/base/tree/parent and Ready-generation run IDs. Ready is review admission only: fresh Security/SAST/Python Security/CodeQL runs are queued/in progress, qualifying current-head approval is absent, and source integration still does not prove live ruleset convergence or Orgmetra canary admission. No merge, auto-merge, settings apply, bypass, self-approval, rerun, empty commit, or source change was performed.

[seonghobae]

SOURCE WRITER RELEASE — ordinary non-force descendant 4d775cd1918177886b6303d4f807c5c098acb366 adopts protected main@691fb78932eff5fbe52db69077848134b0b4e053 with parents 702446b51691db0460e87729e7250b99853026b1 and 691fb78932eff5fbe52db69077848134b0b4e053; exact tree 62f32414dddf0b6c52c7cfccf48429bf903bb895. The only path overlap was CHANGELOG.md, which merged automatically while preserving the README-standard entry and all governance entries. Fresh merge-result evidence: governance-focused 189 passed; GITHUB_ACTIONS=true python -m pytest -q tests 3,193 passed, 1 skipped, 36 subtests; git diff --check PASS. Fresh compare is ahead 250 / behind 0 with the same 21 effective governance paths. New exact-head hosted runs are queued, unresolved threads are 0, and independent approval is absent. No predecessor Checks/reviews transfer; no settings mutation or merge is claimed.

[seonghobae]

Exact-head CodeQL RCA

Run 34685614235 is terminal FAILURE on unchanged head 4d775cd1918177886b6303d4f807c5c098acb366. Both required language shards ended with DISPATCH_OUTCOME=success and VERDICT_STATE=pending; the coordinator succeeded after binding the exact repository, protected base 691fb78932…, PR head, required run, required job IDs, and actions/python matrix. Jobs: python 103532524249, actions 103532524321, coordinator 103533306308.

All other current-head required workflows are SUCCESS. This remains a central authenticated terminal-settlement defect under active owner .github#2040; it is not bypassed, manually rerun, or substituted with predecessor evidence.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 4d775cd1918177886b6303d4f807c5c098acb366.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34685614235/job/103534058894)
• CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34685614235/job/103534058894)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: audit-central-ruleset.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: audit-central-ruleset.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Workflow: ruleset-governance-reconcile.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: ruleset-governance-reconcile.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Repository file: CHANGELOG.md"]
  S3 --> I3["repository behavior"]
  I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
  R3 --> V3["required checks"]
  Evidence --> S4["Repository file: ruleset-governance.json"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: ruleset-governance.json"]
  R4 --> V4["required checks"]
  Evidence --> S5["Docs: ruleset-owner-plane-reconciliation.md (2 files)"]
  S5 --> I5["operator or user guidance"]
  I5 --> R5["Review risk: Docs: ruleset-owner-plane-reconciliation.md (2 files)"]
  R5 --> V5["docs review"]
  Evidence --> S6["CI script: audit_central_required_workflows.py"]
  S6 --> I6["review and security gate shell path"]
  I6 --> R6["Review risk: CI script: audit_central_required_workflows.py"]
  R6 --> V6["bash -n plus Strix self-test"]
  Evidence --> S7["CI script: reconcile_ruleset_governance.py"]
  S7 --> I7["review and security gate shell path"]
  I7 --> R7["Review risk: CI script: reconcile_ruleset_governance.py"]
  R7 --> V7["bash -n plus Strix self-test"]
  Evidence --> S8["Test: test_central_required_workflow_exact_inventory.py (13 files)"]
  S8 --> I8["regression suite"]
  I8 --> R8["Review risk: Test: test_central_required_workflow_exact_inventory.py (13 files)"]
  R8 --> V8["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 4d775cd1918177886b6303d4f807c5c098acb366
• Workflow run: 34686099200
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: fix(governance): automate ruleset owner-plane reconciliation #1644 (review)

[seonghobae]

Protected-main restack receipt — 2026-09-12

Exact head 02d76fa76a9772e4abd506845aa3d383a45efaf5 is an ordinary two-parent child of prior owner head 4d775cd1918177886b6303d4f807c5c098acb366 and protected .github/main@fb17ef556f94f673234aa557254ae52779e9a7b0. Exact tree: fef52715d12039c223f40565342e50fb0e756c8e.

The five new protected-main commits touched six paths disjoint from this PR's 21 governance paths. Git Data construction reproduced the locally merged tree byte-for-byte, then the ref advanced with force=false.

Exact-tree verification: focused governance plus new protected-main contracts 114 passed; complete GITHUB_ACTIONS=true python -m pytest -q tests 3195 passed, 1 skipped, 36 subtests passed; git diff --check PASS.

All predecessor hosted results are invalidated. Keep Draft until new exact-head checks are terminal and a qualifying independent approval exists; source integration does not claim live ruleset convergence.

[cwl-noema-review]

Noema LLM review

The PR introduces a ruleset governance reconciler and extends the central audit to also validate the owner repository ruleset. The core reconciler logic is well-reasoned with strong collision recovery, but the audit workflow's error handling can mask a central ruleset drift. When the central ruleset audit fails, audit_status=1 is set but the workflow continues; if a subsequent repository or stacked ruleset fetch fails, the job exits immediately with a non-audit error before the final audit_status check, so a scheduled owner-plane audit can fail without surfacing the compliance drift. The final error message is also misleading when only the central audit failed.

Reviewed changed lines

• .github/workflows/audit-central-ruleset.yml:97 (RIGHT): Central ruleset audit result is captured into audit_status rather than failing immediately, which is the root cause of the masking issue.
• .github/workflows/audit-central-ruleset.yml:104 (RIGHT): Repository ruleset fetch failure exits the job without checking audit_status, bypassing the final failure check.
• .github/workflows/audit-central-ruleset.yml:111 (RIGHT): Stacked ruleset fetch failure has the same early-exit behavior, also bypassing the final audit_status check.
• .github/workflows/audit-central-ruleset.yml:124 (RIGHT): Final error message is unconditional and references 'fetched rulesets' even when only the central audit failed.

Adversarial validation

• .github/workflows/audit-central-ruleset.yml:104 (RIGHT) confirmed: A central ruleset audit failure will still be surfaced even if a later repository ruleset fetch fails. — Static flow: the central audit sets audit_status=1, then the repository fetch if ! gh api ... is false and triggers exit 1 at line 104. The final audit_status check at line 123 is never reached, so the central drift is masked by an unrelated fetch error.
• .github/workflows/audit-central-ruleset.yml:124 (RIGHT) confirmed: The final error message accurately describes the set of drifted rulesets when only the central audit failed. — The final message unconditionally states 'One or more fetched rulesets drift...' even though no repository/stacked ruleset was fetched, misleading operators about which ruleset actually failed.
• Residual risk: After fixing the early-exit masking, ensure the scheduled audit surfaces a central ruleset drift even if all later fetches succeed; the current design also needs a dedicated annotation for the central audit failure.

Findings

• [medium] .github/workflows/audit-central-ruleset.yml:104 (RIGHT): Central ruleset audit failure can be masked: when audit_status is set, the workflow continues and a subsequent repository ruleset fetch failure exits the job at line 104 before the final audit_status check at line 123. On the scheduled owner-plane audit, a central ruleset drift would not be reported, defeating the fail-closed drift detection.
• [low] .github/workflows/audit-central-ruleset.yml:124 (RIGHT): The final error message says 'One or more fetched rulesets drift' even when only the central ruleset audit failed and no repository/stacked ruleset was fetched, which misleads operators about the actual drift source.

• Result: REQUEST_CHANGES
• Head SHA: 02d76fa76a9772e4abd506845aa3d383a45efaf5
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Exact-head repair receipt for 722fec9de67aece7500993ee2999b21df0fab83b / tree 629fc3684bcfca48b66146ccda0f1b70956cdf4a.

Noema's source finding was valid. RED pinned the missing failure ledger, subject-specific central/owner/stacked attribution, absence of early exits before the next audit, and the terminal named receipt. The workflow now records a failed API read as a named failure, skips auditing the unavailable payload, continues collecting any remaining subject evidence, and exits nonzero once with every proven failure subject. A later owner/stacked fetch error can no longer hide an already-observed central governance drift.

Verification on the exact tree:

• focused ruleset contracts: 55 passed
• full repository: 3195 passed, 1 skipped, 36 subtests passed
• GITHUB_ACTIONS=true, Deprecation Warnings as errors, workflow syntax, and git diff --check: PASS
• protected-base compare: 252 ahead / 0 behind, mergeable

The PR is Draft/Proposed while the new hosted runs and qualifying independent review are reacquired. This does not claim live ruleset convergence or authorize bypass/merge.

[seonghobae]

Exact-head CodeQL RCA for 722fec9de67aece7500993ee2999b21df0fab83b:

• Required run 34690754218 is now terminal FAILURE. Python attempt 1 dispatched successfully and ended VERDICT_STATE=pending; Actions later entered attempt 2 and failed closed because no authenticated terminal verdict existed (Exact CodeQL job was rerun without an authenticated terminal verdict). The coordinator dispatch job succeeded.
• Ruleset Governance Reconcile, Runtime Quality, Security, SAST, and Python Security are terminal GREEN. This CodeQL state is the shared protected-handler settlement defect, not a ruleset-reconciler source finding.
• Canonical bootstrap remains fix(codeql): bootstrap versioned dispatch handler #2106 at 24bb6591ab7df23558cb793b4af60c567ff9da97; protected-handler run 34692405217 is still pre-runner queued.

Draft/Proposed remains correct. Do not manually rerun, synthesize status, transfer successor evidence, or merge until exact-head CodeQL converges and a qualifying independent approval exists.

[seonghobae]

Ready transition preserved exact head 722fec9de67aece7500993ee2999b21df0fab83b and produced a fresh review-admission generation. Current-head Security 34694804912, SAST 34694804913, Python Security 34694804932, and CodeQL 34694804935 are now terminal SUCCESS. Ruleset Governance 34690754225 and Runtime Quality 34690754262 remain same-head SUCCESS; review threads are 0.

Noema's source finding is bound to predecessor 02d76fa7… and is repaired by current 722fec9d…, but its formal CHANGES_REQUESTED has not yet been replaced by a qualifying current-head approval. OpenCode's earlier check-only request is likewise not dismissed here. Therefore Ready remains review admission only; no merge/auto-merge authorization is inferred.

[seonghobae]

@opencode-agent Revalidate unchanged exact head 722fec9de67aece7500993ee2999b21df0fab83b against its fresh Ready-generation evidence. Ruleset Governance 34690754225, Runtime Quality 34690754262, Security 34694804912, SAST 34694804913, Python Security 34694804932, and CodeQL 34694804935 are terminal SUCCESS; the branch is mergeable, unresolved review threads are zero, and the predecessor-head Noema finding is repaired by this head but does not transfer as approval. Use only the contextual-orchestrator gateway with fixed orchestrator/free; no provider/model/group override or paid fallback.

[seonghobae]

Fresh consumer canary for the governance owner: ContextualWisdomLab/TEPP#523@b733492c5ff9f108bc8f52e78da53ba7927a575d is Ready/mergeable, 0-behind protected main, all three inline review threads are resolved, and combined statuses currently include Devin Review=success and CodeRabbit=success. Formal review submissions still contain no APPROVED review, so organization ruleset 18156473's required_approving_review_count=1 remains an independent landing blocker under the no-self-approval/no-bot-as-human policy documented here. I requested an exact-head CodeRabbit evaluation only; I am not counting it as human approval or weakening the gate. This TEPP canary therefore supports #1644's existing conclusion that source-level ruleset reconciliation, not leaf bypass/self-approval, is the correct owner path.