fix(actions): retire stale Noema token-lifetime quality runs

[seonghobae]

Root cause

A fresh synchronize on #1717 demonstrated that every predecessor PR workflow lineage except Noema Reviewer Token Lifetime CI retired its old head. Predecessor run 33621482031 remained queued after current-head run 33622618082 was created. The owner workflow .github/workflows/noema-token-lifetime-quality-ci.yml had no concurrency contract, so each push admitted another obsolete deterministic quality run into the saturated Actions fleet.

RED → repair

• RED first: commit 181889f260d3c0f5a048a52f58e470bfb9090b64 adds an executable contract requiring repository + PR stable concurrency, no head SHA, and cancel-in-progress: true; protected main fails it because the workflow has no concurrency: block.
• Production repair: commit abb7b9936bab8cc5f1628263fe615c6a5c09bc42 adds the native PR-stable group using github.event.pull_request.base.repo.full_name + PR number and cancel-in-progress: true.
• Doctoring: commit 3751cd3b82e48f0131689ab18fbea16ff741f37d records the exact predecessor/current run evidence and preserved security/quality invariants.

This is deterministic quality CI, not a long semantic reviewer, so native cancellation is appropriate and strictly lower privilege than a custom actions: write cancellation path. No model/provider/routing, Noema verdict semantics, protected requirements, test scope, hash-locked dependencies, runner image, or permissions are weakened.

Verification

Fresh exact-head Checks/reviews/threads are required. A subsequent synchronize must prove that the predecessor Noema token-lifetime run is retired while the sole current-head authoritative lineage remains. docs/product-technical-gap-baseline.md is intentionally not concurrently rewritten here because the repository already has a dedicated baseline single-writer lane; this incident and repair are recorded in doctoring for that lane to integrate without competing file ownership.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 6c38a762-f189-4e1c-89dd-2e20c001f291

📥 Commits

Reviewing files that changed from the base of the PR and between 8eaa650 and b4632b0.

📒 Files selected for processing (3)

• .github/workflows/noema-token-lifetime-quality-ci.yml
• docs/doctoring/noema-token-lifetime-stale-run-retirement.md
• tests/test_noema_token_lifetime_stale_run_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.