fix(governance): stage ConceptWeave Product ruleset enforcement

[seonghobae]

Purpose

Close #2348 without weakening ConceptWeave Product governance or deadlocking the one-time producer bootstrap. This remains a dependent Draft owner-plane PR on top of #1644.

Current authority — 2026-09-24 KST

• base: fix/ruleset-owner-plane-reconciler / fix(governance): automate ruleset owner-plane reconciliation #1644 exact 722fec9de67aece7500993ee2999b21df0fab83b
• current head: 1e8da05d5b0851da212b3e340e7085fb1de550ce
• OPEN / Draft / mechanically mergeable
• fix(governance): automate ruleset owner-plane reconciliation #1644 owns generic solo-maintainer approval/bypass governance.
• ConceptWeave owns Product workflow/control logic; .github owns protected-policy lifecycle and immutable workflow coordinates only.
• no live Product-specific ruleset has been created or mutated.

Accepted policy remains one dedicated organization branch/workflows ruleset scoped only to ConceptWeave repository id 1353201939 and protected/default main, binding source repository id 1353201939, .github/workflows/product.yml, refs/heads/main; no repository status fallback and no Product addition to global ruleset 18156473.

Completed owner evidence

Immutable-source review 5287728521 is GREEN through 7a627f3e9c564bcf7ce2f826b57c1b6ef8d1ebae / run 35845521134.

Mutation-boundary review 5289945740 has attributable hosted RED fdbe09abb9079638098de92f5a40575d0696b675 / run 35863230526. Production repair a1628e75dc056098f4ea2d03ec799f2026025e84 requires a reviewed Product blob before mutation, binds bootstrap/canary admission to it, and revalidates the exact blob before active PUT. Test-only successor a1af52d7bf2fcb5dfd27790961faf62651b16510 closed the retained coverage defect with terminal owner GREEN 35918073452.

Review 5294002721 now has a complete RED -> repair -> exact-head GREEN chain. Test-only exact 1a6ddce2d02df50dddeb81450ff05cb9778c94a9 / run 35944402217 produced hosted RED for protected-ref drift during the final reviewed Product blob read. Minimal production repair 97acdfeef0830d56c7b9b78226fec53de791ee8f revalidates protected .github/main and ConceptWeave main immediately after the final blob validation and before evaluate POST / active PUT. Its hosted run exposed only stale retained call-count expectations. Test-only successor 04414c5e30ba6aed2bf3d82268b356c6d6b1ad84 corrected those two expectations; owner run 35983462019 is terminal SUCCESS, with validate 107580552666 GREEN on hosted runner 1002122732. mutate-owner-plane and verify-live were skipped, so this evidence changed no live Product-specific ruleset state.

Current P1 supported-canary contract — reviews 5288830215 + 5291871021

Current exact 1e8da05d5b0851da212b3e340e7085fb1de550ce is an ordinary-forward test-only RED candidate on top of the completed 04414c5... owner GREEN. It changes only tests/test_conceptweave_product_ruleset_reconciliation.py and adds retained expectations that:

• a canonical Foundation canary may remain OPEN / Draft; Ready/Draft toggling is not evidence,
• the supported canary is a substantive pull_request:synchronize path and therefore must not require _latest_base_retarget() / base_ref_changed evidence.

The current production still rejects draft=true and still calls _latest_base_retarget(), so these tests intentionally target the known unsupported canary model rather than pre-applying the repair. Exact owner run 36010121000 is currently queued. Preserve 1e8da05... until that run reaches terminal hosted evidence; do not blind-rerun, no-op wake, or add the production fix before attributable RED.

The eventual minimum repair must keep all existing exact PR/head/current-main-base, reviewed immutable Product blob, first-attempt Product success, evaluate-mode workflows rule-suite PASS, no-later-source-movement and protected-ref/blob/history TOCTOU guards. Reopen, Ready/Draft toggle, manual rerun, no-op commit, predecessor run or administrator bypass remain invalid evidence.

Producer prerequisite and central evidence

ConceptWeave #35 exact d7b7e30b278ec2f27096b4d313c7d5eaf5387ddc remains the producer prerequisite. SAST 35825043007 and Security 35825042856 are terminal GREEN. Required CodeQL 35825042996 is terminal FAILURE from central ordering/publication, not ConceptWeave source.

Downstream .github run 35870670165 validated the exact #35/head/base/required-run tuple. Python 107322443235 and Actions 107322443261 both passed exact-head materialization, CodeQL analysis and the Medium+ SARIF gate, then failed only at GHAS base/head configuration identity; settlement 107396154783 later failed at Settle exact CodeQL required run. Keep GHAS credential/permission work in #2275/#2276 and lifecycle/publication/recovery in #1929/#2040. Queue continuation remains #2356. Do not move #35 to manufacture central evidence.

Required order

1. Preserve current 1e8da05... until run 36010121000 is terminal and classify the supported-canary RED from exact hosted evidence.
2. If RED is attributable to the retained OPEN-Draft / synchronize expectations, apply the minimum production repair on an ordinary-forward head, obtain exact-head GREEN, and only then treat reviews 5288830215 + 5291871021 as satisfied.
3. Land fix(governance): stage ConceptWeave Product ruleset enforcement #2350 source normally with no live Product mutation.
4. 🛡️ Sentinel: [HIGH] Fix HTML Comment Breakout in JSON Serialization #35 obtains terminal current-head central evidence and lands normally as the one-time Product producer bootstrap.
5. Re-read protected Product Contents and adopt only that immutable blob SHA through ordinary reviewed .github source.
6. Bootstrap the dedicated organization branch ruleset in evaluate; adopt its positive identity through ordinary review.
7. Ordinary/non-force reconcile Foundation Add Palette journal for profile repo #1; its substantive Draft pull_request:synchronize run is the evaluate-mode Product canary.
8. Immediately before active PUT, revalidate protected .github/main, protected ConceptWeave main/canary base, immutable Product blob, repository/ref targeting, ruleset state/history and concurrent drift; promote evaluate -> active only after exact canary and evaluate-rule PASS.

No force push, destructive rebase, self-approval, synthetic status/reviewer, direct protected-branch write, routine admin bypass, PYTHONPATH workaround, manual/blind rerun, no-op wake, Ready/Draft trigger manipulation, or live ruleset mutation is authorized.

Refs #2348, #1644, #772, #1351, ContextualWisdomLab/ConceptWeave#35, ContextualWisdomLab/ConceptWeave#1, ContextualWisdomLab/ConceptWeave#4.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

P1 runtime finding: the privileged verify-live and mutate-owner-plane jobs execute the new Python 3.10+ reconciler but do not install/pin Python at all. The validation job does, and canonical #1644 apply also does. On a GitHub-hosted runner this makes the live control path depend on the runner image's incidental Python, so the source can validate while the privileged path later fails before governance verification/mutation. Add the same pinned actions/setup-python@5fda3b95... / Python 3.12 boundary to both live jobs and contract-test that requirement. Do not weaken the Python requirement or fall back to whatever python happens to be on the image.

[seonghobae]

P1 activation-path correctness: _decode_workflow() uses base64.b64decode(content, validate=True) directly on the repository-contents API content field. GitHub's current REST documentation shows that field as line-wrapped base64 containing \n separators. Python strict base64 validation rejects those separators, so a legitimate protected-base .github/workflows/product.yml can fail before canary validation and make evaluate→active promotion impossible. Please preserve strict alphabet validation but normalize only GitHub's documented CR/LF wrapping before decoding, and add a regression that uses a line-wrapped contents payload. RED is a valid GitHub contents response that fails current _decode_workflow; GREEN is the same payload decoding exactly while malformed non-base64 remains fail-closed. Source: https://docs.github.com/en/rest/repos/contents#get-repository-content (current response example contains \n in content).

[seonghobae]

P1 hosted entrypoint failure confirmed by current run 35805657970: validate fails at Validate reviewed Product target manifest before any lifecycle tests. The workflow executes python scripts/ci/reconcile_conceptweave_product_ruleset.py, but that file imports scripts.ci.reconcile_ruleset_governance; direct script execution sets the import root to scripts/ci, so the package-qualified scripts.ci import is not a reliable CLI entrypoint. The same failure already existed at predecessor run 35805011918, so it is not caused by the wrapped-base64 repair. Repair the workflow to use the package entrypoint python -m scripts.ci.reconcile_conceptweave_product_ruleset for validate/verify/bootstrap/activate, and contract-test that direct-script invocation is absent. Do not paper over it with PYTHONPATH.

[seonghobae]

P1 — bootstrap create has a protected-main TOCTOU window. bootstrap_product_ruleset() checks expected_main_sha only at entry, then performs repository ruleset discovery before _create_evaluate_ruleset() issues the POST. If protected .github/main advances during that discovery/read window, the live repository ruleset can be created from a stale trusted source revision and only be rejected after the mutation already exists. Activation already rechecks immediately before its PUT. Bootstrap should do the same immediately before POST, with a regression that proves a second current-main check aborts before _create_evaluate_ruleset() is called. Do not paper over this in the workflow or with PYTHONPATH; keep the guard in the owner mutation boundary.

[seonghobae]

P1 — activation/bootstrap do not bind the protected Product workflow to an immutable reviewed content coordinate. The ruleset correctly points at ContextualWisdomLab/ConceptWeave:.github/workflows/product.yml@refs/heads/main, but _assert_base_product_workflow() currently accepts any protected-main file containing four marker strings. Between #35 producer landing and this Product ruleset becoming active, a later Product change can retain those markers while weakening/removing substantive gates; Product itself is not yet a required merge gate in that bootstrap window. A successful canary plus evaluate rule-suite PASS would then validate the drifted workflow, not the #35-reviewed producer. RED: manifest/lifecycle tests must reject bootstrap/activation when the protected Product Contents API blob SHA differs from a reviewed immutable coordinate, and must reject mutation when no such coordinate has been adopted. GREEN: keep ConceptWeave as Product source owner, but carry only its immutable workflow blob coordinate in the owner-plane manifest; allow the initial source PR to keep that coordinate unadopted/null, require a normal reviewed manifest update after #35 lands, and re-check the exact blob before evaluate creation, canary acceptance, and active PUT. Do not copy Product YAML semantics into .github beyond the existing sanity checks.

[seonghobae]

P1 — the activation canary contract currently requires evidence that GitHub's ruleset workflow cannot naturally produce for the intended Foundation canary. _latest_base_retarget() requires a base_ref_changed event and rejects any later committed event; _canary_evidence() then requires a successful Product run created after that retarget. GitHub's current required-workflow semantics ignore pull_request activity filters and trigger only the default opened, synchronize, and reopened activities, so a base retarget (edited) does not create the required Product run. Foundation #1 already targets main and its current timeline has no base_ref_changed; after #35 lands, the intended ordinary/non-force reconciliation creates a real source commit and therefore a synchronize event, which the current code explicitly rejects if it follows a retarget. This makes the documented first substantive canary either impossible or dependent on artificial source-neutral PR-state manipulation/manual rerun, both outside the accepted contract.

Keep the current immutable-workflow-coordinate RED head unchanged until its hosted RED executes. On the subsequent repair head, replace the mandatory base-retarget proof with an event model that matches GitHub required workflows: accept a first-attempt terminal Product run from the exact current PR head/base produced by a supported ruleset event, and for the intended Foundation path require a substantive ordinary/non-force reconciliation commit after protected main advances. Bind the run to the exact PR/head/base and evaluate-mode rule-suite PASS; continue rejecting manual reruns/no-op wake, stale base, later source movement, and predecessor evidence. The existing target-main/blob/history TOCTOU guards remain required.

[seonghobae]

P1 — the immutable Product blob coordinate is parsed and _assert_base_product_workflow() can compare it, but neither live mutation path actually consumes it yet.

Current bootstrap_product_ruleset() calls _assert_base_product_workflow(target_main_sha) without manifest["product_workflow_blob_sha"]; therefore product_workflow_blob_sha: null does not fail closed and an evaluate ruleset can still be created from marker-compatible Product content. _canary_evidence() does the same unpinned call, and activate_product_ruleset() never requires a non-null reviewed blob coordinate before evaluate evidence or active PUT. That violates #2348's staged bootstrap contract and leaves the exact mutable-main gap this repair is intended to close.

Required repair after the currently queued exact-head owner run settles: add a contract RED proving bootstrap and activation reject null coordinates and marker-compatible blob drift before any POST/PUT, then thread the reviewed coordinate through bootstrap, canary admission and the final pre-PUT revalidation. Keep Product semantics ConceptWeave-owned; .github should compare only the immutable Contents blob coordinate plus existing marker/TOCTOU/ruleset-history guards. Do not pre-adopt #35's unlanded candidate blob.

[seonghobae]

P1 — the supported Foundation canary is still impossible without a governance-state manipulation because _canary_evidence() rejects draft=true. Canonical Foundation #1 is intentionally OPEN / Draft on main, and its ordinary/non-force parent reconciliation is supposed to produce the substantive pull_request:synchronize canary after #35 lands. GitHub's current ruleset-workflow contract does not require a PR to be Ready for synchronize: required workflows run on the default pull_request activities opened, synchronize, and reopened, and GitHub explicitly lists pushing/updating the branch as the way to trigger a newly required workflow on an already-open PR. A Ready transition is a different ready_for_review activity and is not a supported ruleset-workflow trigger.

Therefore, after the current 5289945740 mutation-boundary RED → repair → GREEN is complete, fold this into the separate supported-canary repair 5288830215: accept an open Draft Foundation PR as canary evidence while still requiring the exact PR number, substantive current head, current protected main base, reviewed Product blob, first-attempt terminal Product success from the supported pull_request:synchronize run, exact evaluate-mode workflows rule PASS, and no later source movement. Keep Ready/Draft toggling, reopen, no-op commits, manual reruns, predecessor evidence and administrator bypass explicitly invalid as canary evidence. Do not weaken the PR's own Draft/acceptance lifecycle merely to satisfy owner-plane activation.

Primary GitHub authority: https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/troubleshooting-rules and https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows.

[seonghobae]

P1 follow-up on the mutation-boundary repair: the immutable Product blob is now revalidated before POST/PUT, but the network read itself re-opens the protected-ref TOCTOU window. Bootstrap currently checks .github/main and ConceptWeave main, then performs _assert_base_product_workflow(... expected_blob_sha=...), then POSTs without re-reading either protected ref. Activation does the same before active PUT. If either protected ref advances while the Contents request is in flight, the mutation can still be authorized from stale owner source/base evidence even though the immutable blob check itself passed. Preserve the current exact head until its owner run settles; then add a reality RED where the first ref checks and blob check succeed but a final ref read observes drift, and require both _assert_current_main(expected_main_sha) and _assert_target_main(base_sha/target_main_sha) after the blob revalidation and immediately before POST/PUT. Do not weaken or remove the blob coordinate guard; this is the final ordering guard around it.

[seonghobae]

2026-09-24 KST fresh coordination: #2350 source remains exact a1628e75dc056098f4ea2d03ec799f2026025e84; owner run 35891410528 / validate 107284521412 is still queued before runner assignment, so preserve this exact repair head and do not stage review 5294002721 yet. ConceptWeave#35 central CodeQL downstream run 35870670165 has progressed independently: validate-dispatch 107213600319 is terminal SUCCESS on the bound PR/head/base tuple, while scan jobs 107322443235 (python) and 107322443261 (actions) remain queued. This narrows #35's central blocker but does not change the Product-ruleset sequence: exact owner evidence here → 5294002721 RED/final protected-ref revalidation/GREEN → separate 5288830215 + 5291871021 canary repair → normal source landing with no live Product mutation.

[seonghobae]

Fresh ConceptWeave owner-path correction: the Producer prerequisite paragraph in this PR body is now stale only for downstream CodeQL execution state. .github run 35870670165 still binds the exact ConceptWeave#35@d7b7e30b278ec2f27096b4d313c7d5eaf5387ddc / base f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425 / required 35825042996 tuple. validate-dispatch 107213600319 is SUCCESS. Both language jobs have now run: Python 107322443235 and Actions 107322443261 each completed exact-head materialization, CodeQL init/analysis, and the Medium+ SARIF gate, then failed only at Verify GHAS base/head CodeQL configuration identity; SARIF preservation and dispatch-status publication completed afterward. The new settle exact required run job 107396154783 is the remaining runnerless queued job. This narrows the central path to .github#1929/#2275/#2276 for GHAS identity/credential plus settlement admission, and does not justify moving ConceptWeave#35 or this #2350 source. Current #2350 exact head remains a1af52d7bf2fcb5dfd27790961faf62651b16510; owner validate 107374677579 is still queued with runner_id=0 and no steps, so preserve this head and do not start 5294002721 yet.

[seonghobae]

Authority correction — producer prerequisite only; no source/head change.

The Producer prerequisite paragraph in the current PR body is stale where it says downstream CodeQL python/actions scans remain queued. Fresh 35870670165 state is:

• validate-dispatch 107213600319: terminal SUCCESS;
• python 107322443235: terminal FAILURE only at Verify GHAS base/head CodeQL configuration identity, after exact-head materialization, CodeQL analysis, and Medium+ SARIF gate succeeded; evidence preservation/status publication succeeded;
• actions 107322443261: same terminal failure boundary and same preceding successes;
• settle exact required run 107396154783: current runnerless queue specimen ([ubuntu-24.04], runner_id=0, steps=[]).

The two scan failures remain .github#1929/#2275/#2276-owned GHAS identity/credential evidence, not ConceptWeave source defects. The queue specimen is now recorded on bounded continuation issue #2356 (comment 5805398442) rather than unwritable #712.

#2350 itself remains exact a1af52d7bf2fcb5dfd27790961faf62651b16510; owner run 35918073452 / validate 107374677579 is still queued pre-runner. Preserve this exact head. Review 5294002721 remains sequenced only after exact owner GREEN.

[seonghobae]

Authority update — a1af52d7bf2fcb5dfd27790961faf62651b16510 is now exact owner GREEN: Product Ruleset Reconcile 35918073452 completed SUCCESS. This settles the prior 100% coverage repair and unlocks review 5294002721.

Ordinary-forward test-only head is now 1a6ddce2d02df50dddeb81450ff05cb9778c94a9 (test(governance): prove post-blob protected ref drift). It changes only the bootstrap/activation race tests. The new contract covers both protected refs (.github/main and ConceptWeave main) and requires that a ref advancing during the final exact Product blob read causes fail-closed behavior with zero evaluate create / zero active PUT. Production reconciler code is intentionally unchanged so this head remains the reality-RED candidate.

Fresh owner run 35944402217 / validate 107459043420 is queued before runner assignment with no steps. Preserve this exact head until the owner run settles; do not no-op wake, blind-rerun, or apply the production fix early. If it reaches the intended RED, the minimum causal repair is to re-read both protected refs immediately after final blob validation and immediately before _create_evaluate_ruleset() / active PUT, then reacquire exact-head GREEN.

Separate central CodeQL state remains owner-external: #35 downstream Python/Actions shards completed scan + Medium+ SARIF and fail only at GHAS configuration-identity verification; only settlement remains queued. Keep that under #1929/#2275/#2276 rather than moving ConceptWeave source.

[seonghobae]

Exact-current correction (2026-09-24 KST): PR head is 1a6ddce2d02df50dddeb81450ff05cb9778c94a9, not the stale body coordinate a1af52d....

a1af52d7bf2fcb5dfd27790961faf62651b16510 completed the prior coverage-repair gate successfully. 1a6ddce... is the subsequent test-only reality contract for review 5294002721: bootstrap and activation tests stage protected .github/main / ConceptWeave-main drift during successful Product Contents/blob validation and require evaluate POST / active PUT to remain uncalled. Production reconciler behavior is intentionally unchanged on this head.

Owner run 35944402217 remains queued before execution. Preserve this exact head until terminal evidence. If it produces the intended RED, apply only the causal production repair: re-read both protected refs after successful blob validation and immediately before mutation, retain the immutable blob check, then reacquire exact-head GREEN. Do not fold the later supported-synchronize / OPEN-Draft canary repair (5288830215 + 5291871021) into this head.

Separately, ConceptWeave #35 downstream settlement 107396154783 has now left the queue and completed FAILURE at its settlement step; that is central lifecycle evidence, not a reason to move this Product-governance head.

[seonghobae]

Review 5294002721 has now produced attributable hosted RED on 1a6ddce2.../35944402217. Current 97acdfeef0830d56c7b9b78226fec53de791ee8f is the minimal causal repair: exactly two protected-ref reads after the final Product blob validation in bootstrap and two in activation, immediately before POST/PUT. No policy/workflow/manifest/test/live-state delta is included. Keep the finding open until owner run 35961585829 is terminal GREEN; do not transfer predecessor GREEN.

[seonghobae]

Current-head RCA / repair update (2026-09-24 KST)

97acdfeef0830d56c7b9b78226fec53de791ee8f is no longer queued evidence. Owner run 35961585829 reached hosted runner 1002120081 and failed in Prove Product ruleset lifecycle contract after exact checkout/revision/tooling/manifest validation; mutate-owner-plane and verify-live remained skipped, so no live Product-specific ruleset mutation occurred.

The failure is attributable to a retained success-path unit expectation, not the four-line production repair. bootstrap_product_ruleset() now intentionally revalidates both protected refs once more immediately after the final reviewed Product blob read and before evaluate POST, while retaining the existing post-create settlement checks. test_bootstrap_create still expected only 3 .github/main checks and 2 ConceptWeave-main checks; the repaired control flow correctly performs 4 and 3 respectively.

Ordinary-forward test-only repair: 04414c5e30ba6aed2bf3d82268b356c6d6b1ad84 (test(governance): align bootstrap ref revalidation expectations). The commit changes only those two call-count assertions. Production code, workflow, manifest, policy shape, canary semantics, and live ruleset state are unchanged.

New exact owner run 35983462019 / validate 107580552666 is currently queued on [ubuntu-24.04] with no runner and steps=[]. Preserve 04414c5... until terminal exact evidence; no blind rerun/no-op wake. Review 5294002721 remains open until this exact head is GREEN.

[seonghobae]

5294002721 is now evidence-complete. Exact test-only successor 04414c5e30ba6aed2bf3d82268b356c6d6b1ad84 reached terminal owner GREEN in run 35983462019; validate 107580552666 completed SUCCESS on hosted runner 1002122732, including exact checkout/revision, hash-locked tooling, reviewed Product manifest validation, and the lifecycle contract. mutate-owner-plane and verify-live were skipped, so no live Product-specific ruleset state changed. This closes the post-blob protected-ref ordering finding without transferring predecessor GREEN.

A concurrent ordinary-forward commit, 1e8da05d5b0851da212b3e340e7085fb1de550ce, is one test-only commit ahead of 04414c5... and is adopted as the separate 5288830215 + 5291871021 supported-canary RED candidate. It adds OPEN-Draft and no-base-retarget expectations only; current production still rejects Draft and calls _latest_base_retarget(). Preserve 1e8da05... until exact owner run 36010121000 reaches terminal hosted evidence; do not pre-apply the repair or manufacture a wake.