fix(automation): recover organization loop without maintainer PAT

[seonghobae]

Root cause

Protected-main scheduled run 33483275421 failed before the organization coordinator started because PR_REVIEW_MERGE_TOKEN was absent and the workflow accepted no other bounded maintainer credential. The failing job log shows GH_TOKEN empty and exits with PR_REVIEW_MERGE_TOKEN is required; the subsequent receipt upload fails because the coordinator never creates its JSON receipt.

This is a central control-plane credential-availability defect, not a product test failure, provider/model failure, transient network failure, or downstream repository defect. Protected main at branch creation still had the same PAT-only workflow. The broader #1545 branch contained an OIDC fallback but is a much broader stale bundle; this branch extracts only the credential-recovery boundary.

Test-first evidence

RED exact head d6a726219bb317f12748006acbce050b27715bbc added only the missing-credential contract. Hosted Organization Commercial Readiness Loop Quality CI run 33490804781, job 99801577027, failed exactly that new assertion because id-token: write was absent: 1 failed, 34 passed.

Focused GREEN predecessor head 46261f201ba5d1dde7c40023dc6bd7097240abb9: hosted quality run 33491063381, job 99802413728, completed success with 35 passed, organization_commercial_readiness_loop.py 382/382 statements and 88/88 branches (100%), compileall, and clean-tree verification.

Current exact head 556dee448b24116276673321fcae0fbf564b84c8 is the same focused repair after a normal non-force sync merge with protected main. Current-head Organization Commercial Readiness Loop Quality CI runs 33492667608 and 33492728477 both completed success. Security and review workflows remain authoritative at this head; queued/skipped/cancelled evidence is not treated as passing and this PR must not merge until required current-head gates are terminal-successful.

The minimal implementation keeps PR_REVIEW_MERGE_TOKEN as first choice; grants id-token: write only to the coordinator job; allows only the required OpenCode API endpoint for this fallback; requests a job-bound GitHub OIDC token with bounded timeouts; validates non-empty token fields; masks temporary tokens; exchanges for the existing short-lived OpenCode GitHub App token; and never accepts ${{ github.token }} / GITHUB_TOKEN as mutation authority.

docs/doctoring/organization-commercial-readiness-loop.md records the production RCA, security boundary, and post-integration acceptance criteria. Operational closure requires a protected-main run after integration that proceeds beyond the missing-PAT guard and emits the deterministic fleet receipt while preserving fail-closed governance.

Review boundary

This replaces draft #1577 on the same focused branch because the connected GitHub ready-for-review mutation currently errors in its GraphQL response normalization. #1577 had no submitted reviews; closing it and opening this non-draft PR preserved the branch and commits without force push or rebase, while allowing the repository's normal independent review automation to run. This is not merge authorization: required security, provenance, and independent review gates remain authoritative. No self-approval or gate weakening is requested.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 10 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e034994a-bae8-4798-b7b0-d0f9508db4bd

📥 Commits

Reviewing files that changed from the base of the PR and between 7f35816 and 556dee4.

📒 Files selected for processing (3)

• .github/workflows/organization-commercial-readiness-loop.yml
• docs/doctoring/organization-commercial-readiness-loop.md
• tests/test_organization_commercial_readiness_loop_secret_scope.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Exact-current-head orchestration wake for 556dee448b24116276673321fcae0fbf564b84c8 only. The source is non-destructively reconciled with protected main, the duplicate Ready-successor PR has been closed to retire its queued runs, and this comment is not approval or predecessor-evidence transfer.

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG admission decision for exact head 556dee448b24116276673321fcae0fbf564b84c8: this PR repairs the protected-main organization-loop credential deadlock itself. GitHub reports the head mechanically mergeable; there are zero unresolved review threads; Devin's exact-PR review reports no issues; the repository-owned quality gate is terminal success on this exact head (runs 33492667608 and 33492728477). The remaining security/provenance workflow lanes are queued in the saturated central Actions fleet, with predecessor duplicate-PR runs already cancelled where concurrency applied. No substantive test failure, security finding, merge conflict, malformed provenance, or meaningful CHANGES_REQUESTED is being bypassed. Merging with expected-head identity so the scheduled coordinator can regain its bounded OIDC/App-token fallback; protected-main canary remains required immediately after integration.