[Fleet incident] Resolve independent-review bootstrap deadlock for sole-collaborator repositories

[seonghobae]

Live policy deadlock

Fresh protected-branch rule evidence for ContextualWisdomLab/.github/main requires:

• 2 approving reviews;
• stale approvals dismissed on push;
• approval after the last push;
• all review threads resolved.

The live collaborators API returns exactly one human collaborator, seonghobae, who is also the author of the current central repair pull requests. Self-approval is not a qualifying independent review.

PR #835 at exact head 6a1acb1559755c27d7267e39fd6275bb9db74dc9 has every observed exact-head quality/security/supply-chain workflow successful, all review threads resolved, auto-merge enabled, and one formal OpenCode APPROVED review. GitHub still reports mergeable_state=blocked, which is consistent with the unsatisfied second approval.

PR #834 repairs the Noema OIDC response-envelope consumer that is intended to supply a second independent review identity, but #834 is governed by the same two-approval rule and currently has no qualifying approval. Therefore the broken second-review path cannot bootstrap its own repair.

The same condition appears in sole-collaborator product repositories such as EmbedRelay: exact-head code/security evidence can be green, but the standard reviewer-request API cannot request a non-collaborator App identity, and the central mention/OIDC route remains the only scalable independent-review path.

Root cause

The repository ruleset assumes at least two simultaneously operational independent reviewer identities, while organization access and reviewer control-plane deployment currently provide only one functioning formal reviewer identity (opencode-agent) in addition to the author. The second reviewer (cwl-noema-review) is itself impaired by the unmerged OIDC envelope and mention-concurrency repairs.

This is not a code-quality failure in #834/#835 and not a reason to reduce the required approval count. It is an identity/bootstrap architecture gap between branch policy and installed reviewer capacity.

Feasible remedies

Revalidate live organization policy and use one of these normal-policy options:

1. Independent human bootstrap reviewer — immediate and least architectural change

   • grant one trusted non-author human the minimum repository read/triage access required to submit formal reviews;
   • require that person to review exact-current-head fix(noema): validate stable OIDC exchange envelope #834 and fix(automation): replay isolated review-agent queues on current main #835 independently;
   • do not grant branch write, merge, release, deployment, secret, or administration authority merely to review.

2. Second review-only GitHub App identity — durable option

   • install/configure a second App whose repository permissions are limited to metadata/read, checks/read, contents/read, and pull-requests/write for review submission;
   • keep its credentials and provider/model path independent from OpenCode;
   • prove exact repository/head/base binding and formal APPROVE submission;
   • use it to bootstrap fix(noema): validate stable OIDC exchange envelope #834/fix(automation): replay isolated review-agent queues on current main #835 without repurposing a maintainer token.

3. Organization team reviewer capacity

   • grant a trusted non-author team read/triage review access and use normal GitHub review requests;
   • preserve the two-approval rule and last-push approval requirement.

Rejected non-remedies

• lowering required_approving_review_count from 2;
• administrator bypass or direct merge;
• self-approval;
• counting CodeRabbit COMMENTED, status checks, mention acknowledgements, or resolved threads as approval;
• reusing predecessor-head approvals;
• granting contents: write, merge, release, or deployment authority to a reviewer merely to satisfy the count;
• inventing a PAT or using COPILOT_GITHUB_TOKEN;
• asking the broken Noema path to approve the PR that must first repair that path.

Acceptance criteria

1. at least two independent non-author reviewer identities are demonstrably operational under the protected-main policy;
2. fix(noema): validate stable OIDC exchange envelope #834 and fix(automation): replay isolated review-agent queues on current main #835 each receive the required exact-current-head approvals without bypass;
3. both integrate through normal protected-main policy;
4. post-merge Noema OIDC and mention-concurrency canaries produce formal reviews on sole-collaborator repository PRs;
5. reviewer identities remain review-only and cannot write code, merge, release, deploy, or access unrelated secrets;
6. a documented onboarding/offboarding and outage fallback exists so loss of one reviewer does not deadlock the organization again;
7. no approval-count reduction or temporary bypass remains after bootstrap.

This issue is part of the organization-wide Hourly Product Development fleet incident. The central .github owner loop retains all implementation and merge authority. The fleet audit remains read-only and reports this because an external independent identity or permission grant is genuinely required to break the bootstrap deadlock.

[seonghobae]

2026-08-15 exact-state refresh: the bootstrap deadlock remains active and is now blocking the central hourly/commercialization path as well as individual repairs.

• feat(automation): coordinate hourly organization readiness #832 0dc693b26feb62742c252498f231c4a83eb1d501: bounded organization hourly coordinator; latest exact-head workflow inventory has no queued, running, failed, or cancelled runs, but no qualifying current-head independent approval.
• fix(scheduler): require independent exact-head approval #828 911f95c4a256000d8aabdcc45e178ab1cfbb81f6: independent-approval scheduler gate; effective tree restored to the prior bounded scheduler tree, but it cannot bootstrap the second counted reviewer.
• fix(noema): validate stable OIDC exchange envelope #834 526e7c284c4cb60979516935f3fb930319aed5de: Noema OIDC envelope repair; auto-merge armed, still missing normal-policy approvals.
• fix(automation): replay isolated review-agent queues on current main #835 c9fe4779d0030534a366d6a0fe4ae4252bb794fe: mention-concurrency isolation; auto-merge armed, still missing normal-policy approvals.

No approval-count reduction, self-approval, review dismissal, admin merge, token substitution, or ruleset bypass was attempted. The required external remedy remains a genuinely independent counted reviewer identity (human or review-only App) that can approve the exact unchanged heads through ordinary GitHub protection.

[seonghobae]

Fresh ScopeWeave owner-boundary evidence (2026-08-17 KST): ContextualWisdomLab/scopeweave protected develop remains at 28420da358f57be5e85be3660251e39b85e1cc94. Organization ruleset 18156473 currently requires 1 approving review, dismisses stale reviews on push, requires last-push approval, resolved threads, and has no bypass. The repository collaborators API currently returns exactly one collaborator, seonghobae (admin), who is also the author/last pusher on critical PR #523 head 27b95f435ffd4904e5b98c6940c27aad89a7babe. All seven repository-native workflows on that head are terminal success, current check inventory has no failed/queued check, and the actionable review threads are resolved; no qualifying independent approval exists. This is the same sole-collaborator bootstrap deadlock class tracked here, now blocking ScopeWeave's exact-contributor-head CI integrity fix. Acceptance for the central reviewer-capacity repair should include a canary proving a non-author counted approval on ScopeWeave under the 1-approval + last-push rule without granting source/merge/release authority.

[seonghobae]

Fresh organization-ruleset regression observed during the Context Fabric read-only dependency sweep. Ruleset 18156473 (CWL Central required workflows) changed during this invocation from the earlier live pull-request rule (required_approving_review_count=1, require_last_push_approval=true, required_review_thread_resolution=true; ruleset updated_at=2026-08-16T23:45:11.508+09:00) to the current rule at updated_at=2026-08-17T03:58:01.800+09:00: required_approving_review_count=0, require_last_push_approval=false, required_review_thread_resolution=false. The workflow requirements remain present and the rule still targets ~DEFAULT_BRANCH; bypass_actors=[] / current_user_can_bypass=never remain unchanged.

This is not a passing workaround for the reviewer-capacity incident. It directly conflicts with this issue's rejected non-remedy (“lowering required_approving_review_count”) and with #772's independent-review objective, and it removes latest-push/thread-resolution safeguards fleet-wide wherever this organization ruleset resolves to the default branch.

Owner-path action requested, without changing leaf repositories: identify the exact ruleset mutation actor/change receipt in organization audit/rule insights, determine whether this was an authorized emergency policy change or automation drift, and restore the intended fail-closed review policy through the central governance owner if the reduction was not explicitly approved. Acceptance must re-fetch the live ruleset after repair and prove the intended approval count, latest-push approval, thread-resolution rule, required-workflow set, target, and bypass actors together. Do not manufacture approvals or compensate by weakening leaf checks. Context Fabric will treat the current zero-approval rule as live policy evidence but will not treat the reduction itself as safety/commercial-readiness evidence.

[seonghobae]

Follow-up live revalidation: the fleet-wide review-policy regression reported above has been repaired. Ruleset 18156473 now reports updated_at=2026-08-17T04:31:31.043+09:00 with required_approving_review_count=1, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, and required_review_thread_resolution=true; bypass_actors=[] / current_user_can_bypass=never remain unchanged, and all seven central required workflows still target .github/main under ~DEFAULT_BRANCH.

This closes the zero-approval/latest-push/thread-resolution regression as a live safety state; Context Fabric will no longer describe the weakened rule as current. It does not by itself close this reviewer-capacity incident: one qualifying independent non-author approval is again required, so repositories with only the author as a human collaborator still need the review-only human/App/team capacity described in this issue before a protected merge can pass normally.

Audit provenance for the temporary 03:58:01.800 +09:00 weakening remains useful for incident RCA if available, but leaf products should now revalidate against the restored 04:31:31.043 +09:00 rule rather than carrying the temporary policy forward.