fix(automation): recover organization loop without maintainer PAT

[seonghobae]

Root cause

Protected-main scheduled run 33483275421 failed before the organization coordinator started because PR_REVIEW_MERGE_TOKEN was absent and the workflow accepted no other bounded maintainer credential. The job log shows GH_TOKEN empty and exits with PR_REVIEW_MERGE_TOKEN is required; the subsequent receipt upload also fails because the coordinator never creates its JSON receipt.

This is a central control-plane credential-availability defect, not a product test failure, provider/model failure, or downstream repository defect. Protected main at branch creation (8e04ab8f5f70b1c3c7f19211f2041570ae53b2f8) still had the same PAT-only workflow. The broader #1545 branch already contained a reviewed OIDC fallback, but it was a stale, non-mergeable 17-file DDD feature bundle. This PR extracts only that credential-recovery boundary onto current main so production recovery is not coupled to unrelated DDD work.

Test-first evidence

RED exact head d6a726219bb317f12748006acbce050b27715bbc added only the missing-credential contract. Hosted Organization Commercial Readiness Loop Quality CI run 33490804781, job 99801577027, checked out that exact head and failed exactly the new assertion because id-token: write was absent: 1 failed, 34 passed.

The minimal implementation then:

• keeps PR_REVIEW_MERGE_TOKEN as first choice;
• grants id-token: write only to the coordinator job;
• adds only api.opencode.ai:443 to the blocked-egress allowlist;
• requests the job-bound GitHub OIDC token with 10-second connect / 30-second total timeout;
• requires non-empty string JSON fields for both OIDC and App responses;
• masks both temporary tokens;
• exchanges for the existing short-lived OpenCode GitHub App token and exports it as GH_TOKEN only when the explicit maintainer secret is absent;
• accepts neither ${{ github.token }} nor a GITHUB_TOKEN: binding as mutation authority.

The first GREEN attempt correctly exposed a test-only false positive: a blanket "GITHUB_TOKEN" not in dispatch_step assertion matched the diagnostic sentence saying repository-scoped GITHUB_TOKEN is not accepted. The regression was narrowed to forbid actual ${{ github.token }} and GITHUB_TOKEN: bindings instead of harmless diagnostic prose.

Final exact head 46261f201ba5d1dde7c40023dc6bd7097240abb9: hosted quality run 33491063381, job 99802413728, completed success with 35 passed, organization_commercial_readiness_loop.py 382/382 statements and 88/88 branches (100%), compileall, and clean-tree verification.

Documentation / operational acceptance

docs/doctoring/organization-commercial-readiness-loop.md records the production RCA, security boundary, focused extraction from #1545, and post-integration acceptance criteria. The pull-request quality job deliberately does not exercise a real mutation-capable OIDC identity; that credential must remain unavailable to untrusted PR code.

Operational closure therefore requires a scheduled run from protected main after integration whose exact workflow source contains this fallback, proceeds beyond the missing-PAT guard, emits the deterministic JSON fleet receipt, and preserves downstream fail-closed governance.

Merge boundary

This source repair is ready for independent review, not automatically merge-authorized. Broad security/review/provenance checks and any qualifying independent approval remain authoritative on the unchanged exact head. Queued, pending, cancelled, skipped-required, predecessor-head, model-only, or author-only evidence is non-passing. No gate weakening, repository-token fallback, self-approval, force push, destructive rebase, or downstream source mutation is introduced.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}