fix(scheduler): require independent exact-head approval

[seonghobae]

Customer outcome

The organization merge scheduler refuses direct merge and auto-merge until
GitHub reports reviewDecision: APPROVED and a non-author, non-OpenCode formal
approval is bound to the exact live head. If stale authorization left
auto-merge armed, the scheduler disables it.

Root cause and minimal repair

PR #828 identified a real separation-of-duties gap but its old-base
implementation replayed stale files and split the mature scheduler into a
second core. This clean protected-main replacement reuses the existing
scheduler and adds only the shared authorization boundary, exact PR author
evidence, regressions, changelog, and APA 7 doctoring.

The independent-review helper considers only each eligible reviewer's latest
exact-head approval-affecting state. A later same-head change request or
dismissal therefore revokes that reviewer's earlier approval. Generic
github-actions[bot], missing identities, self-review, comment-only review,
and predecessor-head approval remain fail closed. GitHub remains authoritative
for last-pusher, CODEOWNERS, required-review, and ruleset policy.

Exact local evidence

• Head: aa0c93e5d461daf64c160b91066f90bad57a532f
• TDD regression: failed before the repair, passes after it
• Focused scheduler suite: 127 passed
• Full suite: 1,406 passed, 1 skipped, 16 subtests passed
• Statement and branch coverage: 8,375 statements plus 3,232 branches, 100%
• Docstring coverage: 100%
• Scheduler self-test, Python compile, bounded Ruff, workflow syntax, diff
  check, and CodeGraph sync: PASS

Merge boundary

Do not transfer review or check evidence from #828 or the predecessor head.
This exact head requires fresh hosted checks, zero unresolved current-head
threads, and independent exact-head approval before protected merge. Project #1
remains In Progress until that lifecycle completes.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2b5e357d-5cf6-4b23-8235-629d7787d3a1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the exact current head 5da3a5b0c1f0b48011d7b81ccc721f0a55c6f455. This is the protected-main replacement for stale PR #828: it reuses the existing scheduler, requires aggregate approval plus an independent non-author, non-bot exact-head approval, guards both direct merge and auto-merge, and disarms already-armed auto-merge when authorization is absent. Local exact evidence: 126 focused tests; 1,405 passed/1 skipped; 8,370 statements + 3,230 branches at 100%; docstrings 100%.

[seonghobae]

@opencode-agent Please review exact head aa0c93e5d461daf64c160b91066f90bad57a532f. Verify the independent-approval helper uses each eligible reviewer’s latest exact-head approval-affecting state, including that a later same-head CHANGES_REQUESTED or DISMISSED state revokes an earlier approval. Also re-evaluate direct merge, auto-merge disarm, repository reviewDecision, tests, coverage, doctoring, and changelog without transferring evidence from #828 or predecessor head 5da3a5b0.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

@opencode-agent review

Review exact current head 6cb7144 against protected main@0c6b9a6459c9dbdf5e23fb01df7a32a8a14964b3. Walk through the scheduler approval, exact-head binding, stale-review handling, and failure evidence; publish a substantive Reviews API verdict on this SHA.

[seonghobae]

Exact-head local verification for 6cb7144: full pytest passed (1410 passed, 1 skipped, 16 subtests); coverage.py statement and branch coverage both 100% across scripts/ci; interrogate public docstring gate passed for scripts/ci/pr_review_merge_scheduler.py; compileall and git diff --check passed. No source change was needed after review. Hosted Checks and an independent exact-head approval remain required.

[seonghobae]

@opencode-agent review Exact head: 6cb7144. Review the complete changed diff and report substantive findings with file/line evidence.

[seonghobae]

Current exact-head Strix RCA: the required Strix run reached the scan gate, emitted zero vulnerabilities, but produced no authoritative report artifact. The log records NVIDIA NIM provider exhaustion/rate limiting followed by the configured openai-direct fallback returning HTTP 404. This is typed provider/backend infrastructure failure and fail-closed behavior, not a source finding.

Next action: rerun the same-head Strix evidence after provider availability is restored; do not merge until the exact-head security evidence is complete.

[seonghobae]

Exact-head review follow-up\n\nCurrent exact head: 6cb7144\n\nThe Strix provider rerun is now executing for this head after the earlier provider/backend failure. Please review the full scheduler diff and publish a substantive exact-head verdict only after the current required Checks complete. No predecessor success or review evidence is being reused.