fix(autofix): enroll ConceptWeave in bounded review repair

[seonghobae]

Scope

Enroll ContextualWisdomLab/ConceptWeave in the existing central bounded review-repair path without adding a product-local duplicate writer or widening model-provider permissions. Product/governance repairs completed by their canonical owners are not retroactive execution evidence and must never be recreated merely to exercise this worker.

Current ConceptWeave authority — 2026-09-23 KST

Source Observation #46 remains exact e35de25355cb4aa4bc75d5900a6e09803d80ff41, OPEN / Draft / mechanically mergeable. Its PostgreSQL semantic findings remain source-repaired but execution-gated review threads stay unresolved until unchanged-head Product/Rust/PostgreSQL execution.

Canonical Product bootstrap #35 is exact d7b7e30b278ec2f27096b4d313c7d5eaf5387ddc, OPEN / Draft / mechanically mergeable. Its trusted ${{ github.workflow_sha }} control-plane checkout is separated from candidate workload, and Product validation is non-cancellable. Protected ConceptWeave main@f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425 still lacks Product, so repository-owned Product cannot self-execute on this bootstrap head. Current exact central runs remain nonterminal; predecessor evidence does not transfer.

Governance split and Product enforcement

Generic solo-maintainer approval/bypass governance remains #772/#1351/#1644-owned. ConceptWeave-specific Product enforcement is #2348-owned with dependent Draft implementation #2350 exact 28246b1e77ac387273aad63a8bb6746c331d633b on #1644.

The accepted enforcement is a dedicated organization branch/workflows ruleset scoped only to ConceptWeave repository id 1353201939 and protected/default main, with an exact workflow binding to repository id 1353201939, .github/workflows/product.yml, refs/heads/main. Repository required_status_checks fallback and Product injection into global ruleset 18156473 are prohibited; bypass actors remain empty.

Review 5287728521 adds the current owner-plane P1: the workflow source ref is mutable during bootstrap. #2350 now has an intentional contract RED requiring a nullable immutable product_workflow_blob_sha. Null must fail closed for bootstrap/activation. The PR-candidate Product blob is not authority; only after #35 lands normally may .github re-read protected ConceptWeave main and adopt the exact Product Git blob coordinate through ordinary review. Product YAML/domain/control truth remains ConceptWeave-owned.

Correct staged order is: #1644 generic governance convergence → close #2350 immutable-coordinate RED, reacquire exact-head owner/central evidence and land source without live Product mutation → #35 terminal current-head central evidence and normal producer landing → ordinary-reviewed protected Product blob adoption → create/adopt the dedicated Product ruleset in evaluate → Foundation #1 ordinary/non-force Product/Rust reconciliation and real current-base required-workflow canaries, including base-retarget behavior → guarded evaluate -> active promotion after fresh .github/main, ConceptWeave main/canary-base, immutable Product blob, target-condition, state/history and concurrent-drift revalidation → real blocked/allowed merge proof → Foundation merge → #5/#6/#45/#46 propagation and #46 native semantic execution.

#2298 source / deployment boundary

Exact #2298 source head remains 309a59daa4413c593b93ce625901471a0ca701dc; OPEN / Draft / mechanically mergeable. Existing hosted evidence is historical unless freshly re-read on this exact/current base. Shared dependency/runtime owners #2278/#2291 and queue/admission owner #712 remain upstream prerequisites.

The reusable scheduler remains product-neutral. The source-controlled dispatch-target mirror is deployment evidence only; live OPENCODE_REPOSITORY_DISPATCH_TARGETS admission must still be updated and re-read after protected integration. This worker may edit only sealed reviewed paths associated with a fresh actionable finding under the single-writer boundary. It cannot approve, merge, release, mutate protection, widen provider access, or synthesize queued/cancelled/failed checks as success. Model routing remains contextual-orchestrator orchestrator/free; no provider/model/group hard-code or paid fallback is permitted.

Keep Draft. No force push, destructive rebase, self-approval, gate weakening, product-local duplicate writer, source-neutral wake/no-op commit, blind rerun, predecessor-evidence transfer, live ruleset mutation, merge or release is authorized. Refs #2295, #2278, #2291, #2333, #712, #1644, #772, #1351, #2348, #2350.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review at 309a59daa4413c593b93ce625901471a0ca701dc: the effective delta stays within the central owner boundary—one consolidated caller target, the dispatch-target mirror, executable coverage contracts, and doctoring. No product-local writer or reusable-scheduler product hard-code is introduced. The shared 59 16 * * * trigger still gives ConceptWeave an independent concurrency lease and max_dispatches=1 remains unchanged.

No merge recommendation yet. Source acceptance is nonterminal and runtime acceptance additionally depends on the live OPENCODE_REPOSITORY_DISPATCH_TARGETS variable containing the exact ConceptWeave target plus post-protection unchanged-head/stale-head canaries. Those conditions are not transferable from the mirror or from predecessor runs.

[seonghobae]

Fresh ConceptWeave consumer finding for the enrollment acceptance path: ConceptWeave #46 advanced to cc66dfc8fdea6b8f1cff298187eea7668c9b6fe5 after review 5261275111 and structural RED cd785e46e7cd06313381004f54441d040d849616. The RED covers inverse PostgreSQL catalog coherence: an observed pg_index.indisprimary=true index must not be publishable without the same relation's PRIMARY KEY constraint (pg_constraint.contype='p', supporting conindid). Focused doctoring is docs/doctoring/postgresql-primary-index-constraint-reciprocity.md.

This is a real bounded future-repair candidate once #2298 itself is accepted and the live dispatch-target enrollment is proven. Do not treat this comment as permission to bypass #2298's queued exact-head gates, mutate the live allowlist before protected-source integration, or introduce a Product-local duplicate writer. The consumer branch remains the ConceptWeave single writer until the central path is operationally accepted.

[seonghobae]

ConceptWeave consumer authority advanced ordinary-forward to #46 de1895e1c12d3a567adccb328a4f6f056f7248bf. Current actionable P1 is primary-index/PRIMARY KEY reciprocity; exact-current COMMENT review is 5261567427. The focused contract now also pins that coherent base reciprocity must remain admissible when index ready/valid/live are unobserved, preventing a future bounded repair from reusing the lifecycle-aware timing/PERIOD helper at the base snapshot seam. This is a useful real consumer canary for the central path once #2298 itself is accepted and the live dispatch-target/canary prerequisites are satisfied. Do not dispatch or claim runtime acceptance from this comment; #2298's five hosted lanes are still queued at the latest fresh read.

[seonghobae]

Exact-current hosted-state correction on 309a59daa4413c593b93ce625901471a0ca701dc: Python Security run 35514875944 is terminal failure, not queued. Job 106163338404 completed setup/install and failed in Audit dependencies (hard gate). Runtime Quality 35514875940 and SAST 35514875958 remain success; Security Scan 35514875971 and CodeQL PR 35514875933 remain queued.

This PR does not change any requirements/lock file; its effective paths are the ConceptWeave target mirror/caller/doctoring/contracts only. The exact shared lock still contains requirements-strix-ci-hashes.txt with anyio==4.14.0. A fresh owner sweep found existing canonical dependency owner #2278 (chore(deps): bump anyio from 4.14.0 to 4.14.2, exact 8a5251bf409fe84b3dd0cba1e48992f5b8d9eda5, one-file +3/-3 lock delta) and duplicate issue #2321, which records the same current Python Security class on #2291 and the three AnyIO advisories (CVE-2026-63374, CVE-2026-64847, CVE-2026-63349). Do not create a second dependency-fix lane here.

The connector exposes the failing step but not the uploaded pip-audit-enforcement-evidence artifact/log payload for run 35514875944, so this review does not assert that #2298's specific failing record has been independently decoded to AnyIO. The exact-root classification is: hosted Python Security RED on a head with no dependency delta, while the shared base lock contains the already-owned vulnerable AnyIO 4.14.0 coordinate. Treat #2278 as the canonical likely dependency prerequisite and preserve fail-closed status until either the artifact becomes readable or #2278 lands and a fresh unchanged #2298-equivalent head proves the RED gone.

No blind rerun, no-op wake, dependency copy, gate weakening, or predecessor GREEN transfer is authorized.

[seonghobae]

Product-authority supersession for the ConceptWeave enrollment boundary: canonical ConceptWeave #35 advanced ordinary-forward from 7e4dc30... to a19b6c79773883c6eea2ea635a85a994c69c1506. Exact-current review 5277595437 found the remaining mutable Node/npm runtime in the lockfile-pinned JSON-contract path; contract-first 1134aec... and production a19b6c... pin setup-node exact SHA 820762786026740c76f36085b0efc47a31fe5020, Node 24.21.0 LTS, disable package-manager cache and verify the runtime before npm ci. Fresh ConceptWeave #35 Security/CodeQL/SAST runs are nonterminal. This is canonical Product owner work and is retired as a #2298 canary exactly like the earlier dynamic-validator defect; the bounded worker must not recreate or independently repair it. Existing enrollment acceptance/live-target gates are unchanged.

[seonghobae]

ConceptWeave product-authority supersession: canonical Product #35 is now exact 6593dadd4cdbc05864a3967be8f0a0e87528585a, not 7b1b20f.... Review 5279675828 proved 7b1b20f... referenced a missing scripts/check_coverage.sh; owner-local RED/fix sequence is a4011c1... (CI contract requires tracked helper + portable invocation) -> 5e3a1d6... (locked exact 100% coverage helper) -> 6593dadd... (workflow invokes helper via bash). Fresh #35 CodeQL 35742556865, Security 35742556910, Semgrep 35742557183 are queued; no exact-current independent approval. This defect is now retired as a central canary: #2298 must not recreate it. Product path remains #35 terminal acceptance/normal landing -> Foundation/Source-stack ordinary reconciliation -> fresh #46 Product/native semantic execution.

[seonghobae]

ConceptWeave Product authority advanced ordinary-forward to #35 exact 9ef8ebbba8765e0c712a8196662d2b8340fb22d2. Owner review 5280357244 found the remaining deterministic-lock boundary: Clippy/test/rustdoc lacked --locked; contract 84521528... and production 9ef8ebb... repair only Product workflow/checker. Fresh #35 SAST/CodeQL are pending and Security is queued, so this is source repair, not acceptance. Retire this lockfile-closure defect as a future central canary just like the prior Product findings; #2298 must wait for protected/live admission before generating any fresh current actionable ConceptWeave finding.

[seonghobae]

ConceptWeave Product owner supersession: canonical ConceptWeave#35 is now c4b304fd5b0d8934f7c9f05ef6d54e1a4ef21e0d. Review 5283557899 -> contract-first e2e86f5c... -> production c4b304fd... fixes a Product-local concurrency defect where metadata-only pull_request: edited events could cancel/replace exact validation before their job-level skip. The owner now separates metadata-only and validation concurrency; base-retarget edits retain stale-base invalidation. Treat this finding as retired at the canonical Product owner and do not recreate it as a central canary. Fresh ConceptWeave exact-head Security/SAST/CodeQL runs are queued; no acceptance transfer.

[seonghobae]

ConceptWeave governance handoff update: #2348 now has dependent implementation PR #2350 (bf14f6942bcd106d8f80db94f1dfe83f9ff966bd) on #1644. The prior acceptance ordering is corrected: repository-specific Product enforcement must be evaluate, not active, before ConceptWeave#35 because protected ConceptWeave main has no Product producer and exact #35 currently emits no Product run. Correct path is #1644/#2350 source convergence → evaluate ruleset + reviewed ID adoption → generic approval/bypass convergence → normal #35 producer landing → current-base Foundation/Product canary → observed GitHub Actions app binding → active Product promotion and blocking proof. This worker must not synthesize Product status or regenerate already-fixed #35 Product findings.

[seonghobae]

ConceptWeave owner-path currentization; do not recreate these findings in the central worker. Canonical Product #35 is now exact db9e5474996e1ba93a64955f4f49373188817d3b: review 5286664040 → contract bf4121ca... → production makes ruleset-required Product non-cancellable. Product enforcement #2348/#2350 has a superseding P1: review 5286658440 proves repository required_status_checks + GitHub Actions integration ID does not bind workflow identity and is same-App/check-name spoofable. #2350 current b6074c741333d10a494de4eab5df6b50385f21c1 intentionally REDs until the owner-plane reconciler becomes a ConceptWeave-only organization workflows ruleset binding exact repository id 1353201939, path .github/workflows/product.yml, ref refs/heads/main; global ruleset 18156473 must not be polluted with ConceptWeave-only Product. Central bounded repair remains product-neutral and must not regenerate the retired repository-status architecture. Current #35 central lanes and #2350 owner/CodeQL/Security/SAST lanes are nonterminal; no predecessor evidence transfers.

[seonghobae]

Bounded-writer authority correction: ConceptWeave Product enforcement owner #2350 is now exact 7a627f3e9c564bcf7ce2f826b57c1b6ef8d1ebae, not 28246b1e.... Its predecessor immutable-coordinate RED executed terminally; current parser/comparer repair is not yet acceptance-ready because review 5289945740 found bootstrap/canary/activation still omit the reviewed product_workflow_blob_sha, so null does not yet fail closed. Also retain review 5288830215: the old mandatory base-retarget canary is superseded by Foundation #1's substantive ordinary/non-force pull_request:synchronize path. This bounded worker must not recreate either Product-owner repair merely to exercise itself; wait for canonical owner acceptance and subsequent normal propagation.