fix(governance): automate ruleset owner-plane reconciliation

[seonghobae]

Buyer/control-plane outcome

This is the owner-plane writer for the live ruleset drift blocking Orgmetra's ordinary protected merge canary. Source integration alone does not mutate live settings: privileged apply remains disabled unless trusted protected main has CWL_RULESET_RECONCILE_ENABLED=true and the protected ruleset-governance-maintenance environment supplies a separately provisioned least-privilege CWL_RULESET_ADMIN_TOKEN with Administration write authority.

Current exact stack — 2026-09-02

Current exact head: 7698f40fb0dafa4b8bbedbe46e8ab02ec662fbf9.

Current protected main: 6f70174e338013fec9a000311bc72312f5d4dbf9 (#1704). The existing writer preserves concurrent protected-main intent without force-push. Fresh comparison reports behind_by=0; the diff remains exactly the same 19 governance-owned paths.

Exact-head evidence: Ruleset Governance Reconcile run 33611906329 is terminal SUCCESS on 7698f40fb0dafa4b8bbedbe46e8ab02ec662fbf9; all current inline review threads are resolved. OSV, CodeQL, Python Security, Secret Scan, SBOM, Scorecard, Security Scan and SAST on this same exact head are queued at the current read, so focused governance success is not promoted to whole-PR merge/release evidence. Ordinary squash auto-merge is enabled; administrator bypass and self-approval are not used.

A one-shot source-fix workflow attempted during earlier repair was blocked before any job executed and was immediately deleted; no temporary repair workflow remains in the current tree.

Reviewed implementation boundary

• config/ruleset-governance.json binds exactly repository ruleset 17921150 and organization ruleset 18156473.
• The canonical policy is the solo-maintainer contract: approval count 0, last-push and same-author CODEOWNER approval disabled, no synthetic required reviewers, stale-review dismissal and thread resolution retained, merge/squash only, deletion/non-fast-forward retained, and routine bypass actors forbidden.
• The reconciler validates exact live target identity and invokes the canonical ruleset auditors against projected and post-write live-shaped payloads so unmanaged scope/workflow/protection drift cannot be mislabeled as convergence.
• GitHub exposes no conditional unsafe PUT precondition for these ruleset updates. A second live read detects visible drift but is not represented as compare-and-swap.
• Privileged mutation samples immutable ruleset history before its final live read and binds both CLI and callable mutation paths to an exact protected-main SHA. Ambiguous mutation results are settled from live state plus immutable history rather than blindly retried.
• Collision recovery follows immutable predecessor evidence, preserves newer administrator state, settles ambiguous recovery writes across the bounded observation horizon before any subsequent PUT, and rechecks version state after settlement before trusting the restore.
• Visible current-state changes are checked before a recovery write; protected-main freshness is then checked immediately before that privileged write. Once an earlier PUT may already have been accepted, history settlement and lossless compensation finish without a stale-main veto so an overwritten administrator predecessor is not stranded.
• Privileged non-PR owner-plane runs share one serialized non-cancellable concurrency group; read-only PR validation may supersede itself.
• Pull-request validation uses pinned actions and hash-locked tooling, verifies exact checkout, executes the permanent governance/adversarial suites, and enforces 100% owned statement/branch/docstring gates without persisted checkout credentials.
• The source-derived two-target critical-section bound is 7,680 seconds / 128 minutes; the apply job uses GitHub's documented 360-minute hosted-job ceiling rather than inventing a smaller setup allowance.
• Doctoring records the REST/history authority boundary, timeout/collision semantics, current GitHub Actions execution limits, NIST SP 800-53 Rev. 5 AC-6/CM-3, and Sinan, Shahin, and Gondal (2025) in APA 7th form.

Live drift and acceptance boundary

Fresh live reads still show inherited organization ruleset 18156473 with required_approving_review_count=1, stale-review dismissal and thread resolution enabled, merge/squash only, and routine OrganizationAdmin/always bypass. The .github repository ruleset 17921150 has approval 0/last-push false/CODEOWNER false but still permits rebase and retains routine OrganizationAdmin/always bypass. This PR therefore has not completed settings reconciliation merely by changing source.

Require terminal successor-head security/review evidence before ordinary merge. After source reaches protected main, provision the distinct least-privilege owner-plane identity, enable reconciliation only for a controlled maintenance interval, require exact live payload plus immutable-history convergence, re-run the canonical audit, and prove unchanged deterministic-GREEN ContextualWisdomLab/Orgmetra#88@0dc4f09cc3c87829ea1e3a0e3dc0188df07ad8cd can take the ordinary protected merge path without synthetic approval or routine administrator bypass. Genuine failed/absent required workflows and unresolved required threads remain blocking.

Refs #772, #1176, #1340, #1351, ContextualWisdomLab/Orgmetra#89.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Fresh owner-path dependency evidence for the Context Fabric control-plane repair: protected .github/main has advanced to 33db5bf40672f6292e9f0965d977e3b0d293df90 via #1691; its parent is the 6958918beaad96d0a67ce264706c828bb7f3f000 main tip against which this PR’s current f43ea2a42141317f1878e553289cb00440bb0487 restack/body was previously validated. Treat the prior behind-by=0/path-disjoint proof and all predecessor exact-head checks/reviews as historical now.

Before merge or any privileged reconciliation, re-fetch current protected main and compare #1644’s 19 governance-owned paths against 33db5bf4.... If the new protected-main delta is disjoint, advance this writer non-destructively while preserving protected-main history; if it overlaps, resolve the overlap causally in this owner branch. Do not force-push/destructively rebase, self-approve, or use predecessor evidence. Any head movement must reacquire the focused governance suite plus all then-required security/static-analysis/review evidence on the new exact head. The live organization ruleset remains unreconciled until the protected owner-plane source and privileged settings path both converge; this comment is freshness evidence only, not permission to bypass those gates.

[seonghobae]

Context Fabric dependency refresh — exact live central stack moved after the PR body was last validated.

Fresh compare now reports main@5c561a65cca3b925d533e4b40c5c3ac00f16524e vs fix/ruleset-owner-plane-reconciler@25ef94557344de5ca988496cd7d0e4a2c321b405 as diverged, behind_by=3, ahead_by=227, merge base 33db5bf40672f6292e9f0965d977e3b0d293df90; GitHub PR metadata now reports mergeable=false. The body’s earlier behind_by=0 / protected-main 33db5bf... statement is therefore historical.

Please have the central .github owner writer refetch the three new protected-main commits and path overlap, then preserve both protected-main changes and the reviewed 19-path ruleset-governance delta through the same non-destructive owner procedure (no force-push/destructive rebase). Re-run exact-head governance/security evidence after convergence and do not transfer 33601351770 or predecessor review/check evidence to the successor head.

Context Fabric product branches remain intentionally unchanged until the central protected-main/default/review settings path reaches live truth.