fix(actions): reduce Draft queue pressure and retry GitHub reads

.github/workflows/appguardrail.yml

@@ -3,6 +3,7 @@ name: AppGuardrail
 on:
   pull_request:
     branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
     paths-ignore:
       - "docs/**"
       - "*.md"
@@ -22,6 +23,7 @@ concurrency:
 
 jobs:
   scan:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
+    types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
   contents: read
@@ -15,6 +16,7 @@ concurrency:
 
 jobs:
   compose_runtime:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
@@ -49,6 +51,7 @@ jobs:
               >/dev/null
 
   today-concurrency:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     env:
@@ -91,6 +94,7 @@ jobs:
           tests/postgres-today-lock-order.integration.test.ts
 
   validate:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     needs: compose_runtime
     runs-on: ubuntu-24.04
     timeout-minutes: 20
@@ -175,6 +179,7 @@ jobs:
         run: docker compose config --quiet
 
   browser-acceptance:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
@@ -202,7 +207,7 @@ jobs:
         run: pnpm --filter @life-os/web test:e2e
 
   merge_compatibility:
-    if: github.event_name == 'pull_request'
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     env:

.github/workflows/commercial-readiness.yml

@@ -3,6 +3,7 @@ name: Commercial Readiness
 on:
   pull_request:
     branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches: [main]
   schedule:
@@ -22,6 +23,7 @@ env:
 
 jobs:
   audit:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:

CHANGELOG.md

@@ -31,6 +31,8 @@ All notable changes to LifeOS are documented in this file.
 
 ### Fixed
 
+- Commercial Readiness now ignores malformed decisive review evidence with a blank reviewer identity or invalid submission timestamp, so malformed approvals cannot satisfy the merge gate.
+- Commercial Readiness merge automation now fails closed when the latest decisive review set contains no approval, instead of allowing otherwise-GREEN zero-review or COMMENTED-only evidence to reach the merge path; exact-head approval freshness remains governed by the active stale-review-dismissal rule until immutable review-head identity is carried locally.
 - The public Gateway Today endpoint now fails explicitly with bounded `today_composition_unavailable` problem details instead of returning fabricated successful composition data while authenticated Planning/Habit integration is absent; issue #163 remains open for the real composition path.
 - Data-rights request-ID and idempotency collisions now resolve through stable credential-free domain conflicts instead of exposing raw PostgreSQL uniqueness errors, including ambiguous dual-collision evidence.
 - The OpenCode development loop now prevents project settings from overriding its pinned offline NVIDIA model, records catalog failures accurately, parses the accepted candidate's exact Compose file outside the model account, and requires digest-pinned PostgreSQL queries plus NATS JetStream probes in pull-request CI.

packages/commercial-readiness/src/github-client-read-retry.test.mjs

@@ -0,0 +1,92 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { GitHubApiClient } from './github-client.mjs';
+
+function jsonResponse(value, status) {
+  const body = JSON.stringify(value);
+  return new Response(body, {
+    status,
+    headers: {
+      'content-type': 'application/json',
+      'content-length': String(Buffer.byteLength(body)),
+    },
+  });
+}
+
+describe('GitHubApiClient transient read retry', () => {
+  it('retries only bounded transient GET failures and returns the first successful response', async () => {
+    const statuses = [504, 502, 200];
+    const calls = [];
+    const client = new GitHubApiClient({
+      token: 'token',
+      fetchImpl: async (_url, options) => {
+        calls.push(options.method);
+        const status = statuses.shift();
+        return jsonResponse(
+          status === 200 ? { ok: true } : { message: 'must-not-escape' },
+          status,
+        );
+      },
+    });
+
+    assert.deepEqual(await client.requestJson('/repos/o/r'), { ok: true });
+    assert.deepEqual(calls, ['GET', 'GET', 'GET']);
+  });
+
+  it('stops after three transient GET attempts and preserves the generic status boundary', async () => {
+    let calls = 0;
+    const client = new GitHubApiClient({
+      token: 'token',
+      fetchImpl: async () => {
+        calls += 1;
+        return jsonResponse({ secret: 'must-not-escape' }, 503);
+      },
+    });
+
+    await assert.rejects(
+      () => client.requestJson('/repos/o/r/actions/runs'),
+      new Error('GitHub API request failed with status 503'),
+    );
+    assert.equal(calls, 3);
+  });
+
+  it('never replays mutation requests after a transient server failure', async () => {
+    let calls = 0;
+    const client = new GitHubApiClient({
+      token: 'token',
+      fetchImpl: async () => {
+        calls += 1;
+        return jsonResponse({ secret: 'must-not-escape' }, 503);
+      },
+    });
+
+    await assert.rejects(
+      () =>
+        client.requestJson('/repos/o/r/issues/1', {
+          method: 'PATCH',
+          body: { state: 'closed' },
+        }),
+      new Error('GitHub API request failed with status 503'),
+    );
+    assert.equal(calls, 1);
+  });
+
+  it('does not retry non-transient client or server statuses', async () => {
+    for (const status of [400, 401, 403, 404, 409, 422, 429, 501]) {
+      let calls = 0;
+      const client = new GitHubApiClient({
+        token: 'token',
+        fetchImpl: async () => {
+          calls += 1;
+          return jsonResponse({ message: 'must-not-escape' }, status);
+        },
+      });
+
+      await assert.rejects(
+        () => client.requestJson('/repos/o/r'),
+        new Error(`GitHub API request failed with status ${status}`),
+      );
+      assert.equal(calls, 1);
+    }
+  });
+});

packages/commercial-readiness/src/github-client.mjs

@@ -5,6 +5,9 @@ const DEFAULT_TIMEOUT_MS = 15_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
 const API_PAGE_SIZE = 100;
 const MAX_API_PAGES = 10;
+const MAX_READ_ATTEMPTS = 3;
+const READ_RETRY_DELAYS_MS = [100, 250];
+const READ_RETRYABLE_STATUSES = new Set([500, 502, 503, 504]);
 const REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 const SHA_PATTERN = /^[0-9a-f]{40}$/i;
 
@@ -43,6 +46,11 @@ async function readBoundedText(response, maxBytes) {
   return new TextDecoder().decode(merged);
 }
 
+function waitForReadRetry(attempt) {
+  const delay = READ_RETRY_DELAYS_MS[attempt - 1];
+  return new Promise((resolve) => setTimeout(resolve, delay));
+}
+
 export class GitHubApiClient {
   constructor({
     token,
@@ -85,45 +93,55 @@ export class GitHubApiClient {
     ) {
       throw new Error('Invalid GitHub API path');
     }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    try {
-      const response = await this.fetchImpl(`${API_ORIGIN}${path}`, {
-        method,
-        redirect: 'error',
-        signal: controller.signal,
-        headers: {
-          accept: 'application/vnd.github+json',
-          authorization: `Bearer ${this.token}`,
-          'user-agent': 'life-os-commercial-readiness',
-          'x-github-api-version': '2022-11-28',
-          ...(body === undefined ? {} : { 'content-type': 'application/json' }),
-          ...headers,
-        },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-      });
-      const contentType = response.headers.get('content-type') ?? '';
-      if (!contentType.toLowerCase().includes('json')) {
-        throw new Error('GitHub API response was invalid');
-      }
-      const text = await readBoundedText(response, this.maxResponseBytes);
-      if (!response.ok) {
-        throw new Error(
-          `GitHub API request failed with status ${response.status}`,
-        );
-      }
+    const maximumAttempts = method === 'GET' ? MAX_READ_ATTEMPTS : 1;
+    for (let attempt = 1; attempt <= maximumAttempts; attempt += 1) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      let shouldRetry = false;
       try {
-        return text ? JSON.parse(text) : null;
-      } catch {
-        throw new Error('GitHub API response was invalid');
+        const response = await this.fetchImpl(`${API_ORIGIN}${path}`, {
+          method,
+          redirect: 'error',
+          signal: controller.signal,
+          headers: {
+            accept: 'application/vnd.github+json',
+            authorization: `Bearer ${this.token}`,
+            'user-agent': 'life-os-commercial-readiness',
+            'x-github-api-version': '2022-11-28',
+            ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+            ...headers,
+          },
+          ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+        const text = await readBoundedText(response, this.maxResponseBytes);
+        shouldRetry =
+          attempt < maximumAttempts &&
+          READ_RETRYABLE_STATUSES.has(response.status);
+        if (shouldRetry) continue;
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.toLowerCase().includes('json')) {
+          throw new Error('GitHub API response was invalid');
+        }
+        if (!response.ok) {
+          throw new Error(
+            `GitHub API request failed with status ${response.status}`,
+          );
+        }
+        try {
+          return text ? JSON.parse(text) : null;
+        } catch {
+          throw new Error('GitHub API response was invalid');
+        }
+      } catch (error) {
+        if (error?.name === 'AbortError')
+          throw new Error('GitHub API request timed out');
+        throw error;
+      } finally {
+        clearTimeout(timer);
+        if (shouldRetry) await waitForReadRetry(attempt);
       }
-    } catch (error) {
-      if (error?.name === 'AbortError')
-        throw new Error('GitHub API request timed out');
-      throw error;
-    } finally {
-      clearTimeout(timer);
     }
+    throw new Error('GitHub API request retry invariant failed');
   }
 }
 

packages/commercial-readiness/src/pr-gate.mjs

@@ -12,10 +12,12 @@ function latestReviewsByActor(reviews) {
     ) {
       continue;
     }
-    const timestamp = Date.parse(review.submitted_at ?? '') || 0;
-    const current = latest.get(review.actor);
+    const actor = review.actor.trim();
+    const timestamp = Date.parse(review.submitted_at ?? '');
+    if (!actor || !Number.isFinite(timestamp)) continue;
+    const current = latest.get(actor);
     if (!current || timestamp >= current.timestamp) {
-      latest.set(review.actor, { state: review.state, timestamp });
+      latest.set(actor, { state: review.state, timestamp });
     }
   }
   return latest;
@@ -79,12 +81,15 @@ export function evaluatePullRequestForMerge(pr, policy) {
     blockers.push('unresolved-review-thread');
   }
 
-  for (const review of latestReviewsByActor(pr.reviews).values()) {
+  const decisiveReviews = latestReviewsByActor(pr.reviews);
+  let hasApproval = false;
+  for (const review of decisiveReviews.values()) {
+    if (review.state === 'APPROVED') hasApproval = true;
     if (review.state === 'CHANGES_REQUESTED') {
       blockers.push('changes-requested');
-      break;
     }
   }
+  if (!hasApproval) blockers.push('missing-approval');
 
   for (const workflow of policy.required_workflows) {
     const evidence = workflowEvidence(pr, workflow);

packages/commercial-readiness/src/pr-gate.test.mjs

@@ -88,6 +88,59 @@ describe('evaluatePullRequestForMerge', () => {
     });
   });
 
+  it('requires an explicit decisive approval before merge automation can proceed', () => {
+    for (const reviews of [
+      [],
+      [
+        {
+          actor: 'reviewer-a',
+          state: 'COMMENTED',
+          submitted_at: '2026-08-03T06:00:00Z',
+        },
+      ],
+    ]) {
+      const result = evaluatePullRequestForMerge(
+        pullRequest({ reviews }),
+        policy(),
+      );
+      assert.equal(result.eligible, false);
+      assert.ok(result.blockers.includes('missing-approval'));
+    }
+  });
+
+  it('rejects malformed reviewer identity or timestamp as approval evidence', () => {
+    const malformedReviews = [
+      {
+        actor: '',
+        state: 'APPROVED',
+        submitted_at: '2026-08-03T06:00:00Z',
+      },
+      {
+        actor: '   ',
+        state: 'APPROVED',
+        submitted_at: '2026-08-03T06:00:00Z',
+      },
+      {
+        actor: 'reviewer-a',
+        state: 'APPROVED',
+        submitted_at: null,
+      },
+      {
+        actor: 'reviewer-a',
+        state: 'APPROVED',
+        submitted_at: 'not-a-timestamp',
+      },
+    ];
+    for (const review of malformedReviews) {
+      const result = evaluatePullRequestForMerge(
+        pullRequest({ reviews: [review] }),
+        policy(),
+      );
+      assert.equal(result.eligible, false);
+      assert.ok(result.blockers.includes('missing-approval'));
+    }
+  });
+
   it('uses repository branch provenance instead of PR-opener association as source trust', () => {
     const candidate = pullRequest({ author_association: 'CONTRIBUTOR' });
     assert.deepEqual(evaluatePullRequestForMerge(candidate, policy()), {