feat(operations): run default-branch Maintainer App preflight

[seonghobae]

Summary

• add a default-branch-only repository_dispatch pre-activation workflow for the dedicated Maintainer GitHub App
• mint a repository-scoped Maintainer token with explicit Actions/checks/contents/metadata/pull-request/status permissions and no administration permission
• separately authenticate the existing Reviewer App with a Metadata-read-only token, then bind NOEMA_REVIEWER_LOGIN to the pinned action's app-slug and positive installation-id outputs without exposing that token to scripts
• invoke reviewed Node entrypoints directly without installing repository dependencies or executing npm lifecycle hooks
• continue after token-mint failures only to generate bounded failure artifacts, while requiring both token-action outcomes in the final fail-closed gate
• emit a fixed no-network maintainer_token_unavailable dry-run artifact when no Maintainer token exists
• execute the bounded collector and existing commercial-readiness loop without --apply
• retain governance, App-readiness, and dry-run artifacts for 90 days
• document exact scope privacy, operating procedure, rollback posture, and evidence limits
• update CHANGELOG.md

Dependency status

The evaluator/governance prerequisite merged in #60 and the bounded collector merged in #61. This branch has been rebuilt as one workflow/documentation commit on the resulting main commit and now requires fresh exact-head validation.

Security boundaries

• repository_dispatch uses workflow code from the default branch; branch-selected workflow code is not accepted
• checkout is bound to github.sha, the default-branch commit captured for the event
• job-level GITHUB_TOKEN remains contents: read and is not a write fallback
• both App-token actions are pinned by full commit SHA and scoped to ContextualWisdomLab/noema
• the Maintainer token alone is supplied to governance, API-probe, and no-write dry-run scripts
• the Reviewer token has Metadata read only and is never passed to scripts; only authenticated app-slug and installation-id outputs cross the identity boundary
• no repository dependencies are installed and no npm lifecycle command runs in the privileged audit job
• failed token mints remain explicit final-gate failures but still produce bounded machine-readable evidence after checkout
• broad-scope evidence retains only the repository count, not unexpected repository names
• the run never enables maintenance, dispatches a Noema review, or merges a pull request
• complete App registration, key ownership, installation suspension, administrator bypass, and break-glass ownership remain independent evidence under chore(operations): provision and activate hourly maintainer App #29 and chore(governance): protect main and enforce release checks #27

TDD

• RED: the workflow installed repository dependencies despite using only built-in Node scripts
• GREEN: the privileged job invokes the reviewed entrypoint files directly
• RED: a failed token mint skipped the normal loop before its dry-run artifact could be written
• GREEN: token outcomes are retained, bounded fallback evidence is written, and the final gate still fails
• workflow contracts cover immutable checkout, separate permission scopes, reviewer-token non-exposure, exact gate order, no-write behavior, artifact retention, and documentation

Verification required before merge

The rebuilt exact head must satisfy ci, reviewer-ci, Security Scan, CodeRabbit, review-thread, and repository-policy gates. Queued, stale-head, or predecessor-branch results are not accepted.

Related: #29, #27

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 21288802-3cf0-4823-b210-ab5907e086f1

📥 Commits

Reviewing files that changed from the base of the PR and between 5cc520c and f1a7d7f.

📒 Files selected for processing (5)

• .github/workflows/maintainer-app-readiness.yml
• CHANGELOG.md
• docs/maintainer-app-readiness-audit.md
• test/maintainer-app-readiness-workflow-hardening.test.ts
• test/maintainer-app-readiness-workflow.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Pre-merge exact-head verification record (supersedes the earlier head record):

• Exact head: f1a7d7fe648e4d6632ba8a1b1d93133d3745f818
• ci run 30888618203: completed / success
• reviewer-ci run 30888618241: completed / success (100% line+branch and docstring gates, signed/scanned no-network CodeGraph sandbox smoke)
• Security Scan run 30888618224: completed / success
• CodeRabbit commit status: success, but no substantive review was submitted; a fresh @coderabbitai full review request is currently rate-limited
• Submitted PR reviews: 0
• Unresolved review threads: 0

Merge remains intentionally withheld. Exact-head CI and security evidence are green, but the required independent Noema/OpenCode, CodeRabbit substantive review, or human approval has not been produced. That requirement will not be bypassed or replaced with a self-approval.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 32 minutes.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@seonghobae Noted.

The exact-head CI and security evidence is green for f1a7d7fe648e4d6632ba8a1b1d93133d3745f818.

The current CodeRabbit commit status does not provide a substantive review. The merge should remain blocked until an independent Noema/OpenCode review, a substantive CodeRabbit review, or a human approval is recorded.

_{You are interacting with an AI system.}

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 23 minutes.

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 1 minute.

[seonghobae]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 2 minutes.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

This PR is being superseded without changing its reviewed commit. The replacement PR will target the same exact head from a fresh opened event so the organization-required OpenCode/Noema workflows can produce current-head independent review evidence. No check, review, or merge requirement is being removed or bypassed.