test(ci): stage protected docs-only classifier foundation

[seonghobae]

Foundation repair for #279 / #282

This PR splits the trusted documentation-only CI classifier out of #282 and stages it on a workflow-free prerequisite branch before any workflow is allowed to use it as suppression authority.

Protected main is exact 87c4daa1830bac5a5228b6036752ad5633232085. Exact current head is af83c40dd2990a03064a92ca75430a9cc400f098, directly based on that protected generation and still Ready/mergeable.

Why this prerequisite is necessary

Current #282 correctly attempts to execute scripts/ci/classify_ci_change_scope.py from the protected base SHA and fails closed to full Rust verification when that file is absent from the base. However, #282 also carries the .github/workflows/ci.yml mutation that consumes the classifier. That is both a bootstrap problem and a writer-ownership problem for the scheduled OriginWeave lane: the decision code that can suppress heavy CI must become protected immutable authority before an authorized workflow owner wires it into CI, and the scheduled product writer may not own .github/**.

This prerequisite therefore preserves only #282's non-workflow classifier and focused security regressions plus truthful Unreleased CHANGELOG entries. There is no .github/**, Rust production, browser/policy, dependency, ruleset, secret, release, or publication delta.

Security contract retained from #282

The classifier consumes NUL-delimited non-combined git diff --raw -z --no-abbrev evidence and fails closed unless it can prove an ordinary prose-only change. The retained regressions cover mode/path authority, complete SHA-1/SHA-256 object identity, malformed or truncated records, impossible mode/OID combinations, symlink/gitlink/type-change and executable surfaces, non-canonical paths, contributor-instruction authority, prose boundaries, and rename/copy similarity-to-object-identity coupling.

The first split incorrectly retained a test that read/asserted .github/workflows/ci.yml, making the prerequisite depend on the future activation it was supposed to precede. ab6d5d1a04a020f37727e2f5a6950c58feae8559 removed only that workflow-specific test. Concurrent follow-up af83c40dd2990a03064a92ca75430a9cc400f098 adds a truthful CHANGELOG statement for the rename/copy similarity-to-blob-identity invariant; that valid documentation delta is retained.

Exact-current verification

The earlier ready_for_review event on 7688798e4fd176450b32cb8188069418f67ccbd4 produced CI 33928039835 with conclusion skipped; that remains #286 lifecycle/control-plane evidence, not GREEN.

Exact current af83c40dd2990a03064a92ca75430a9cc400f098 has now completed:

• CI 33931806137: success;
• Security Scan 33931806226: success;
• SAST Semgrep 33931806165: success; and
• CodeQL PR 33931806139: failure.

The CodeQL failure is the separately tracked central dispatch→verdict handoff signature, not an identified classifier-source defect. Do not replace that required verdict with predecessor/skipped evidence, local CodeQL duplication, or gate weakening. ContextualWisdomLab/.github#712 remains the canonical owner.

After this classifier foundation reaches protected main through normal required gates, the authorized #279 workflow-owner path must reconstruct #282's workflow delta against that protected classifier generation and repair #286 Ready-event admission. Only then can #283 prove that repository/documentation contracts execute while Rust/coverage heavy jobs do not materialize for a genuine prose-only delta.

Keep #282 open: its workflow/config delta is valid successor work for the authorized owner and must not be discarded. This PR is a prerequisite split, not a Close/supersession shortcut.

No self-approval, bypass, force-push, destructive rebase, workflow/ruleset/secret mutation, gate weakening, tag, release, or publication is authorized.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e3c630e3-fe46-4a24-8e63-de6ae0d76c1d

📥 Commits

Reviewing files that changed from the base of the PR and between 87c4daa and ab6d5d1.

📒 Files selected for processing (8)

• CHANGELOG.md
• scripts/ci/classify_ci_change_scope.py
• tests/test_ci_change_scope.py
• tests/test_ci_change_scope_modes.py
• tests/test_ci_change_scope_object_ids.py
• tests/test_ci_change_scope_path_identity.py
• tests/test_ci_change_scope_prose_boundary.py
• tests/test_ci_change_scope_similarity_scores.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

문서 전용 CI 변경을 판별하는 CLI를 추가했습니다. Raw diff와 name/status 입력을 검증하고, 모드 정보가 없거나 입력이 잘못되면 Rust 검사를 요구하도록 fail-closed 처리합니다. 관련 회귀 테스트와 변경 로그 항목도 추가했습니다.

Changes

CI 변경 범위 분류

Layer / File(s)	Summary
Raw diff 계약과 검증 scripts/ci/classify_ci_change_scope.py	NUL 구분 raw diff와 legacy name/status 입력을 파싱합니다. 경로, 모드, 객체 ID, 상태, rename/copy 유사도 규칙을 검증합니다.
문서 범위 분류와 CLI 출력 scripts/ci/classify_ci_change_scope.py, CHANGELOG.md	일반 문서 경로와 파일 모드만 문서 전용으로 분류합니다. 빈 입력, mode-blind 입력, 비문서 변경은 Rust 필요로 처리합니다. CLI는 GitHub Actions 출력 형식을 생성하고 오류 시 종료 코드 2를 반환합니다.
기본 분류와 CLI 검증 tests/test_ci_change_scope.py	문서 및 코드 변경, 특수 Git 모드, 잘못된 경로와 스트림, 출력 형식, CLI 오류 처리를 검증합니다.
Fail-closed 회귀 검증 tests/test_ci_change_scope_modes.py, tests/test_ci_change_scope_object_ids.py, tests/test_ci_change_scope_path_identity.py, tests/test_ci_change_scope_prose_boundary.py, tests/test_ci_change_scope_similarity_scores.py	Mode-blind 입력, 객체 ID 의미, rename/copy 경로 동일성, 문서 경계, 유사도 점수 형식을 검증합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to ab6d5

The classifier and its fail-closed regression coverage introduce no identified merge-blocking risk.

Sequence Diagram(s)

sequenceDiagram
  participant Git
  participant ClassifierCLI
  participant ScopeClassifier
  participant CIOutput
  Git->>ClassifierCLI: raw diff 또는 name/status 입력
  ClassifierCLI->>ScopeClassifier: 변경 범위 파싱 및 검증
  ScopeClassifier->>CIOutput: documentation_only, rust_required
  CIOutput-->>ClassifierCLI: GitHub Actions 출력

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 74 functions across 7 files. (1 skipped: 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 보호된 문서 전용 CI 분류기 기반을 추가하고 테스트하는 변경을 정확히 요약합니다. 제목은 간결하고 구체적입니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docs-only-ci-classifier-foundation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head foundation review for bb052af8a9c27d88561bd5b2f98b6a7a74808af9: fresh compare against protected main@87c4daa... is 1 ahead / 0 behind with merge base exactly protected main. The effective delta is only the classifier plus six focused Python security-regression files; there is no .github/** delta. This is the correct prerequisite shape for #282's protected-base classifier execution. Native CI 33924362459 is intentionally skipped while Draft under #286 and is not GREEN; Security/Semgrep/CodeQL are queued. Keep Draft until the truthful classifier-only CHANGELOG debt is repaired and a Ready transition produces fresh exact-head verification.

[seonghobae]

Current-head review for ab6d5d1a04a020f37727e2f5a6950c58feae8559: the foundation is now workflow-independent. The first split still carried a test that read and asserted the future .github/workflows/ci.yml activation, which inverted the prerequisite relationship; that test has been removed while the classifier and fail-closed security regressions remain. The ready_for_review event on predecessor 7688798e... produced CI 33928039835 as skipped, so it is not GREEN. Fresh synchronize CI 33928174824 and security lanes are the only acceptance evidence for this generation. Do not merge unless exact-head required checks become terminal GREEN and counted approval/thread gates are satisfied.

[seonghobae]

Exact-head repair at af83c40dd2990a03064a92ca75430a9cc400f098: the previous head failed its own release-record contract because CHANGELOG omitted the tested rename/copy similarity-to-blob-identity invariant. The repair adds that single missing record without changing classifier behavior or workflows. Verification on this exact tree: focused classifier suite 53 passed plus 38 subtests; full Python repository suite 205 passed plus 581 subtests; cargo fmt --all --check, workspace all-target tests, strict Clippy, rustdoc, and nightly branch coverage all pass with 100% functions/lines/regions/branches. git diff --check is clean. Fresh hosted checks/reviews for this moved head remain required; predecessor results do not transfer.

[seonghobae]

Exact-head review on af83c40dd2990a03064a92ca75430a9cc400f098: the concurrent CHANGELOG follow-up is a valid explanation of the rename/copy similarity-to-blob-identity invariant and is adopted, not treated as a race. The prior ab6d5d1a... CI/Security/Semgrep/CodeQL runs are now terminal cancelled after branch movement and are historical only. Fresh current-head CI 33931806137, Security 33931806226, Semgrep 33931806165, and CodeQL 33931806139 are queued. No current-generation GREEN is claimed; keep the workflow-free classifier prerequisite separate from authorized #279/#282 workflow activation.

[seonghobae]

Fresh exact-head review on af83c40dd2990a03064a92ca75430a9cc400f098 found no actionable defect in the mode-aware raw-diff classifier foundation. A real git diff --raw -z --no-abbrev main...HEAD feeds the executable boundary and correctly classifies this code-bearing branch as documentation_only=false / rust_required=true; 53 focused parser, object-identity, similarity, path, and prose-boundary regressions plus all 205 repository Python tests pass. The worktree is clean and there are no review threads. Hosted checks remain queued and the required independent review is unmet, so this is verification evidence only, not approval or merge authorization.

[seonghobae]

Exact-head focused review on af83c40dd2990a03064a92ca75430a9cc400f098: rechecked the NUL-framed git diff --raw -z --no-abbrev parser, canonical repository-path boundary, status/path cardinality, file-mode semantics, SHA-1/SHA-256 object identity checks, rename/copy similarity binding, instruction-file exclusion, and fail-closed legacy path-only route. I found no new source-backed bypass in this review pass; current tests cover malformed/truncated records, traversal/non-canonical paths, executable/symlink/gitlink/type changes, object-id mismatches, and rename/copy preimages.

This is a COMMENTED review record, not approval or merge authorization. Hosted exact-head checks and an eligible independent approval remain required.

[seonghobae]

Exact-head handoff RCA at af83c40 against protected main 87c4daa (2026-09-05T08:34Z): repository-native CI 33931806137 is successful. Semgrep 33931806165 ran its scan job successfully. Security Scan 33931806226 ran Scorecard and Trivy successfully; gitleaks, OSV and dependency-review were skipped by scope, so those skips are not independent executed scan evidence.

CodeQL wrapper 33931806139 is failure, but current job logs identify an authenticated dispatch handoff rather than a terminal scan verdict: JavaScript/TypeScript 101244865461, Actions 101244865470 and Python 101244865526 each record DISPATCH_OUTCOME=success, VERDICT_STATE=pending, and intentional exit 1 so the dispatcher can replay the exact job after its terminal verdict. The gh run convenience route cannot resolve the cross-repository workflow (404); direct REST job logs provide the authoritative diagnosis.

The canonical .github repository has three matching target-head dispatches: 33954721186, 33955024697 and 33955164029, all queued. Their display titles identify OriginWeave#287af83c40..., while their immutable run.head_sha values belong to the central workflow repository (71dd84d... / 27d7331...), not the OriginWeave commit. This distinction is preserved; no PR association or title is substituted for source checkout validation. Do not rerun this wrapper or create a duplicate dispatch while these exact handles remain non-terminal. Revisit their authenticated terminal verdict and original-job replay after material state change.

Follow-up at 2026-09-05T09:07Z: Strix run 33931804438 / scan job 101243872506 executed Run Strix (quick) and uploaded reports successfully; skipped ancillary status publication is not the scan. Noema run 33931804409 / job 101245089068 failed at 09:00 UTC with gateway HTTP 502 after 2739.2 seconds and one caller attempt. The gateway owns provider repair/failover; no caller timeout, model, provider or workflow was changed. Current-head inventory showed no other Noema run or pending duplicate. With the exact PR head unchanged, the first safe corrective action was a failed-job rerun of that same run; REST now reports queued, not executed review, provider recovery, a verdict or eligible approval. Do not duplicate it while pending. The three central CodeQL dispatches remain queued and were not replayed manually. OpenCode remains queued. Live rules still require counted non-author approval and only the author is a listed collaborator.

[seonghobae]

Exact-current verification update for af83c40dd2990a03064a92ca75430a9cc400f098: CI 33931806137, Security Scan 33931806226, and SAST Semgrep 33931806165 are terminal success. CodeQL PR 33931806139 is terminal failure, but all three language compatibility shards successfully reach the central dispatch step and fail only while waiting for the authenticated terminal verdict. Python job 101244865526 validates the unchanged live PR/head, obtains OIDC and the repository-scoped App token, successfully dispatches codeql-scan, then exits fail-closed with VERDICT_STATE=pending. Fresh exact-head commit statuses contain no codeql-dispatch/* verdict. This independently reproduces the same central stall as #272; I appended both canaries to ContextualWisdomLab/.github#712 comment 5551060102. No classifier/source workaround or gate weakening is warranted. Keep #282/#283 owner order unchanged until this exact CodeQL evidence becomes terminal.