fix(automation): adopt current OIDC maintenance schedulers

[seonghobae]

Test-first control-plane repair for #157 — ACTIVE DRAFT / EXPLICIT #233 CHILD

Protected pg-llm-batch/main remains exact b84f0c94154043a3473939c01bb6471de5a129ae. No source or documentation was written directly to protected main.

Exact stack boundary

• base branch: fix/recovery-evidence-weakref-coverage-b84f0c9
• exact base SHA: 5951b7a4d779903b8924abaef2a387cae50b7f54
• head branch: agent/hourly-maintenance-nim-boundary-v2
• exact head SHA: efe766e11743c56b154d06a2a4a63cc6539923c3
• ancestry: ahead 57 / behind 0 from the exact predecessor
• relative diff remains exactly:
  • .github/workflows/hourly-maintenance.yml
  • tests/test_hourly_maintenance_credential_boundary.py
  • tests/test_workflow_contracts.py

efe766e... is a non-destructive merge commit retaining both histories. It includes #233's focused weak-reference coverage regression as a merge parent so this workflow leaf can reacquire complete repository evidence without copying or owning that test. The #233 file is not part of this PR's relative diff.

Protected-main defect and RED → GREEN lineage

Protected main still configures the existing hourly workflow with cancel-in-progress: true, broad secrets: inherit, deprecated canonical_ref, and the older 5983b41... central scheduler identity. That combination can discard a live bounded RCA when the next heartbeat arrives and unnecessarily widens stored-secret authority.

• 63c8bf35b834a5551c8ff65a9983cecea8a60806 established the failing contract: preserve hourly cadence without cancelling an in-flight execution; pin both reusable scheduler calls to one immutable reviewed central identity; remove canonical_ref; keep review-fix at {contents: read, id-token: write}; and forward no stored repository secret when central OIDC/App-token authority is sufficient.
• 55e8a3661a06788943081dcf1c180d7565cd4599 applied the narrow repair: cancel-in-progress: false; both reusable workflows pinned to exact central c47afc2dc68488292c1db7c9d6f82dcd5360f181; canonical_ref and both secrets: inherit declarations removed; review-fix permissions reduced; merge-caller permissions remain explicit and bounded.
• e3e6cc58c6334e5aac23881948e44084fb549db4 synchronized the permanent workflow contract test with that immutable scheduler identity and rejects recurrence of canonical_ref or broad secret inheritance.

The central pin is a reviewed historical central authority used by this Draft. Central .github is read-only from this pg loop; COPILOT_GITHUB_TOKEN, copied central logic, renamed PATs, and lower-level bypasses remain outside this repair. Before eventual integration, the final candidate must freshly verify that the pinned reusable-workflow contract is still permitted and semantically compatible with then-protected central governance rather than inferring that from historical ancestry.

Retained validation lineage adjudication

Fresh branch and commit evidence resolves the two historical validation refs that previously froze this contract-test lane:

• validation/exact-head-pr88-20260812@ab78e4744a0709edfe9a45d28ec29b80a05771d5; and
• validation/exact-head-pr88-run-20260812@ab78e4744a0709edfe9a45d28ec29b80a05771d5.

Both refs are aliases of the same historical commit ab78e474..., whose direct change is the structural exact-source workflow-contract test in tests/test_workflow_contracts.py. Fresh protected-main inspection shows that the same structural helpers and decoy-resistant field assertions are already implemented, with the later checkout credential-isolation assertion also present. Protected-main file history independently identifies merged PR #88 (fix(ci): bind verification to exact source heads) at merge commit 545334acfcc26f6bd93199ee14361fcb5cc1b82c; that merged authority explicitly includes test(ci): parse exact-source workflow fields structurally and test(ci): enforce checkout credential isolation.

Therefore these two validation refs are SUPERSEDED_RETAINED for the exact-source workflow-contract authority. They preserve historical validation provenance but are not current writer leases on tests/test_workflow_contracts.py; no ref is deleted, renamed, rebased, force-updated, or used to transfer historical checks/reviews.

This bounded adjudication removes only that false writer conflict. It does not prove the entire workflow surface globally writer-free. Before any future #237 source mutation, freshly inventory every then-current open/no-PR branch touching the three intended paths and freeze this lane if any other active writer appears. #237 itself remains the incumbent implementation lane and remains source-stable while predecessor #233 is unmerged.

Current workflow-evidence boundary

Historical workflow conclusions for unchanged stacked head efe766e11743c56b154d06a2a4a63cc6539923c3 include CI 32208125873, SAST Semgrep 32208125944, Release Acceptance 32208125956, and Security Scan 32208125997 as terminal-success, plus historical status/check evidence from the central review path. Those conclusions are retained evidence only.

This Draft is not represented as exact-final-head acquisition acceptance merely because the historical run metadata is green. Actual scanner checkout/source identity, then-live reusable-workflow authority, final protected base, review disposition, and all required gates must be reacquired on the eventual integration candidate. Fresh formal-review inventory remains empty; absence of review is not approval. The predecessor gate remains independent.

Dependency and integration boundary — refreshed 2026-08-30

#233 is the exact predecessor and must integrate first. The obsolete statement that #233 is still waiting for central exact-source Security/SAST repair is removed: #233 now has regenerated exact-contributor-head CI, Release Acceptance, Security Scan, SAST Semgrep, and bounded Strix evidence on unchanged 5951b7a4d779903b8924abaef2a387cae50b7f54. It nevertheless remains non-passing because the active same-head OpenCode CHANGES_REQUESTED has not been superseded and no qualifying approval exists under live governance.

Do not duplicate mutable central SHAs/runs/retry state here. Issue #244 is the sole pg-owned mutable control-plane ledger and must be freshly read before review/security/scheduler decisions. Keep this PR Draft while #233 is unmerged. The two historical PR #88 validation refs above no longer constitute a current writer blocker.

After #233 integrates, retarget this PR to then-current protected main, freshly inventory all intended-path writers again, reconcile its immutable reusable-workflow pins to a then-current reviewed/permitted central authority, prove the final diff remains bounded to the scheduler-contract surface, and reacquire every exact-final-head/current-base CI, security, coverage, package, provenance, release, review, and thread-resolution gate. Merge only with the qualifying non-author approval required by then-live policy.

Queued, pending, cancelled, skipped-required, absent, neutral, stale, predecessor, status-only, synthetic, author-only, rate-limited, infrastructure-failed, dismissed, or conclusion-null evidence is non-passing.

Refs #88, #157, #233, #244.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh writer-safety addendum — 2026-08-28

Before this pg write I re-read exact Draft #237 head efe766e11743c56b154d06a2a4a63cc6539923c3, exact predecessor #233 head 5951b7a4d779903b8924abaef2a387cae50b7f54, current protected main@b84f0c94154043a3473939c01bb6471de5a129ae, current review state (no formal reviews), and the retained overlapping v1 ref.

The existing writer boundary in this PR names the two retained PR #88 validation refs, but fresh branch/provenance comparison establishes one additional overlapping source lineage that must be included in every future lease check:

• agent/hourly-maintenance-nim-boundary@02aa6efe447389cafca3d891fcfd394832d34cfe is the exact head of historical Draft fix(automation): harden hourly maintenance credentials #67, closed without merge as superseded by fix(automation): harden hourly maintenance credentials #69. It still exists as a non-default ref.
• Against current protected main it is diverged 21 ahead / 182 behind from merge base f0c5f79c5327a090014dd5558750110fce9fd2ac and changes the CI/workflow contract surface.
• The active fix(automation): adopt current OIDC maintenance schedulers #237 v2 head does not prove full subsumption of that retained lineage: exact v1→v2 comparison is itself diverged rather than ancestor/descendant.

Therefore treat the v1 ref as ACTIVE_WRITER evidence for lane-safety purposes, consistent with #316's fresh lifecycle adjudication. This does not make v1 current implementation authority and does not authorize deletion, rename, force-update, destructive rebase, cherry-pick, or transfer of stale checks/reviews.

Updated source-freeze contract

Before any further #237 source mutation, freshly compare all of the following against the then-current intended paths/base:

1. agent/hourly-maintenance-nim-boundary@02aa6efe...;
2. validation/exact-head-pr88-20260812@ab78e474...;
3. validation/exact-head-pr88-run-20260812@ab78e474...; and
4. every other then-current PR/no-PR ref touching .github/workflows/hourly-maintenance.yml, tests/test_hourly_maintenance_credential_boundary.py, or tests/test_workflow_contracts.py.

Keep #237 Draft and source-frozen until #233 integrates first and every overlapping retained writer is non-destructively reconciled or independently proven inert for the exact intended surface. Historical #237 local greens remain development evidence only; final acceptance must be regenerated on the then-final head/base under then-live governance.