fix(metadata): require dedicated repository settings credential

[seonghobae]

Outcome

Make the protected-main repository metadata reconciliation fail closed unless it receives the dedicated least-privilege settings credential specified by issue #1579.

• replace the apply lane's reuse of PR_REVIEW_MERGE_TOKEN with CWL_REPOSITORY_METADATA_TOKEN;
• add an explicit preflight that refuses to enter mutation work when the dedicated credential is absent;
• add a static regression contract proving the apply job cannot silently regress to the review/merge credential;
• include that contract in the workflow's path filter so future credential-boundary edits are validated;
• update ADR-0020 and the operational doctoring so the accepted authority boundary and live integration state agree with executable source.

Current-main reconciliation

Protected main is now ad65125acfe901bf4c4958b6c705ffce17714358, containing the integrated 22-repository metadata desired state and 39-target label taxonomy from #1622/#1634. Concurrent work had already reconciled this branch once after #1622; when #1634 advanced main, I preserved that writer work and appended another ordinary two-parent merge rather than force-pushing.

Current exact head: bc3edee4866ec3a6e224abcd2cc6bb3d51e18329.

The new tree starts from protected main and reapplies only this lane's four owned files:

• .github/workflows/repository-metadata-reconcile.yml;
• tests/test_repository_metadata_workflow.py;
• docs/adr/0020-repository-public-surface-reconciliation.md;
• docs/doctoring/repository-public-surface-reconciliation.md.

No force update, destructive rebase, or predecessor-evidence transfer was used.

Safety boundary

This PR does not provision or expose the secret, broaden GITHUB_TOKEN, change repository permissions, or claim live metadata/Pages convergence. Scheduled apply fails before either mutation lane when the dedicated credential is absent; the dedicated identity is unavailable to pull-request code/model processes and cannot fall back to review/merge authority.

After source integration, #1579 remains open until a least-privilege GitHub App/token is actually provisioned in the protected repository-metadata-maintenance environment, a trusted-main apply obtains it without disclosure, and a live canary re-read proves the intended repository settings. Source integration is necessary but not sufficient evidence of live convergence.

Verification boundary

All predecessor-head checks/reviews are historical. Fresh review and hosted evidence must bind to unchanged exact head bc3edee4866ec3a6e224abcd2cc6bb3d51e18329. A queue-saturation exception, if used, must be re-proven on this exact head and may not bypass a substantive failure or review objection.

[coderabbitai]

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: a96bdafe-d73f-4cf7-9cd9-6df0f5d47ba9

📥 Commits

Reviewing files that changed from the base of the PR and between ad65125 and bc3edee.

📒 Files selected for processing (4)

• .github/workflows/repository-metadata-reconcile.yml
• docs/adr/0020-repository-public-surface-reconciliation.md
• docs/doctoring/repository-public-surface-reconciliation.md
• tests/test_repository_metadata_workflow.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG revalidated on exact head 5e3ee2de94efea752d463d1efe55049017c2b8ea against protected main@696852eb44586150a4d9c22cba794b2089a9543a.

The current base-to-head delta is exactly two files and was rebuilt from protected main rather than replaying the stale branch tree: the live metadata workflow keeps the newer Pages-mode contract and PR-stable concurrency, while this head adds only the dedicated CWL_REPOSITORY_METADATA_TOKEN preflight/token boundary plus its static regression. GitHub reports the head mechanically mergeable; all review threads are resolved; current-head Devin Review and CodeRabbit statuses are both success. The nine current-head hosted workflows materialized, but every one is still queued (Repository Metadata Reconcile, SAST, Secret, Security Scan, Scorecard, SBOM, CodeQL, Python Security, OSV) while the repository-wide queued-run inventory is saturated. There is no substantive failing test, security finding, provenance defect, conflict, or meaningful CHANGES_REQUESTED on this head.

This is a fail-closed least-privilege control-plane repair: if the dedicated secret is not provisioned, the trusted apply lane stops before either mutation path. The current tree preserves the full protected-main validation behavior, and the independent semantic reviews explicitly confirm the preflight covers both mutation paths and the static contract matches the current structure. Ordinary admission is therefore blocked only on hosted capacity, not an unresolved source condition. I am using the owner-authorized queue-saturation exception with exact expected-head identity; post-merge live reconciliation remains separately fail-closed until the dedicated credential exists and a main-branch canary verifies settings convergence.

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG verified for exact head bc3edee4866ec3a6e224abcd2cc6bb3d51e18329 against protected main@ad65125acfe901bf4c4958b6c705ffce17714358.

Before the merge decision, this lane was reconciled non-destructively with current main after two independent metadata integrations. The exact head is mechanically mergeable and its tree starts from protected main, reapplying only four owned credential/contract/documentation files. CodeRabbit and Devin are both success on this exact head; every review thread is resolved and no substantive current-head review/security objection exists. Exact-head Actions inventory contains nine PR workflows, all queued and none failed. The repository-wide queued run count has risen to 971, confirming continued central fleet saturation rather than a source-specific failed check.

This exception does not treat queued checks as success and does not transfer predecessor workflow evidence. It is limited to the verified least-privilege credential repair, pinned to the exact head SHA. Live credential provisioning and metadata convergence are not claimed by this merge and remain tracked by #1579.