fix(trust): roll forward audited central workflow source

[seonghobae]

Scope

Roll Noema's immutable GitHub Actions OIDC workflow-source authority forward to the current protected ContextualWisdomLab/.github source without weakening exact job_workflow_sha verification or mutating the foreign repository.

Verified trust decision

Protected Noema main is ad99b10f12bc0b42385f4d23fb7658480a12e83f. Read-only protected central .github/main is 1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5.

The exact trusted .github/workflows/noema-review.yml blob remains unchanged across the accepted central movement, while the materialized central source tree changed in the review gate. Because the workflow executes code from the exact job_workflow_sha, Noema continues to require exact commit equality rather than trusting ancestry or unchanged YAML bytes alone.

Protected Noema main still pins ALLOWED_WORKFLOW_SHA=3a7941aa92de00b8b39fd11cbe7bf3da2fbbeddc; this PR owns the accepted roll-forward to 1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5. The separate central OIDC consumer mismatch remains central-owned and is not worked around in Noema.

Test-first / production lineage

• Historical hosted RED 0bece50dc1ae4375fcbf67e8e097a142b410762d: stale production trust pin failed the focused regression while the rest of the suite passed.
• 97dae86f3a075b2883c2a00b29f13cd322848f3a: later test-only stale-pin state; superseded before terminal hosted evidence.
• 7f9085e9b3593477c2744d760cafc8560780a1e8: production ALLOWED_WORKFLOW_SHA moves to central 1cbb6a... without weakening exact source equality.
• a4108cef7aa210e2b7010d3e99e5705f5dd52295: architecture records the accepted central source decision.
• b220c192438576bb6649ecb8497bee2557c75623: another compatible writer non-destructively incorporated protected main@ad99b10...; verification shows current main is now the exact merge base and the effective delta remains only three trust-authority files.

Current exact authority

Only unchanged evidence for exact head b220c192438576bb6649ecb8497bee2557c75623 is eligible.

• protected live base: main@ad99b10f12bc0b42385f4d23fb7658480a12e83f;
• ancestry: 51 ahead / 0 behind; current protected main is the exact merge base;
• candidate delta: ARCHITECTURE.md, test/trusted-workflow-source-rollforward.test.ts, wrangler.toml only;
• PR: open / Ready / mergeable;
• current inline review threads: 0;
• current formal review: Devin COMMENTED/no-issues only; no APPROVE authority is inferred;
• exact-head Application 33385497084: success;
• exact-head reviewer-ci 33385497149: success;
• exact-head required Security Scan 33385497328: success;
• exact-head dedicated patch-validator-image 33385497135: in progress / non-passing.

Do not merge until the unchanged exact-head image/runtime/SBOM/vulnerability/provenance gate is terminal-success and live head/base/review/governance/central authority remain freshly unchanged.

Guardrails

• Keep ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main exact and preserve cryptographic source-SHA equality.
• Re-audit the exact workflow blob and relevant protected central source delta before every future roll-forward.
• Never substitute predecessor, queued, cancelled, skipped, absent, stale, model-only or status-only evidence for current exact-head gates.
• Keep central .github, naruon, contextual-orchestrator and other dedicated-writer repositories read-only from this Noema lane.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cd8f3833-a95b-4e8f-a9ae-d2f17b735f8a

📥 Commits

Reviewing files that changed from the base of the PR and between 5a7ca74 and 088348b.

📒 Files selected for processing (3)

• ARCHITECTURE.md
• test/trusted-workflow-source-rollforward.test.ts
• wrangler.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

중앙 워크플로의 허용 커밋 SHA를 3a7941...에서 1ff826...으로 갱신했습니다. Wrangler 설정, 회귀 테스트, 아키텍처 추적 기록이 새 SHA를 반영합니다.

Changes

OIDC 신뢰 기준 갱신

Layer / File(s)	Summary
신뢰 워크플로 SHA 갱신 ARCHITECTURE.md, wrangler.toml, test/trusted-workflow-source-rollforward.test.ts	ALLOWED_WORKFLOW_SHA와 auditedCentralWorkflowSourceSha가 1ff8268255b061461d9d49b4cab4febf9a8e7bfa를 사용합니다. 아키텍처 문서에 새 중앙 커밋의 workflow blob 검증 내용이 기록됩니다. 아키텍처 변경 일관성 요구사항은 유지됩니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🟡 Moderate · up to 08834

This change rolls OIDC authorization forward to an audited central workflow commit without broadening the existing exact-source checks. The bounded risk is that the trust-anchor audit remains dependent on supplied external-source evidence, and required CI and security gates are still running; merge should wait for terminal-clean results and owner confirmation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 감사된 중앙 워크플로 소스의 신뢰 기준을 다음 커밋으로 갱신하는 주요 변경 사항을 명확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/trusted-workflow-source-rollforward-71abbd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.