[Fleet incident] Disable orphaned implementation, release, and PR-integration workflow identities

[seonghobae]

Live Actions registry drift

A fresh complete Actions registry read still reports 23 active workflow identities while exact protected main contains only four repository workflow files. Numerous historical implementation, migration, release-readiness, formatting-repair, branch-update, and one-shot PR-integration identities remain active after their source disappeared.

The supported ci, release, Hourly PR Maintenance, and Hourly Autonomous Product Development source paths on protected main must be preserved. The historical publish registry identity is active but its source is absent; it remains lifecycle evidence to classify, not a path to restore by assumption.

Fresh protected-state evidence

Protected main remains 7faf7a3b8a47980113982914000e724ab6a6cda5.

At that exact revision, .github/workflows/ contains only:

• .github/workflows/ci.yml;
• .github/workflows/hourly-pr-maintenance.yml;
• .github/workflows/hourly-product-development.yml;
• .github/workflows/release.yml.

The live registry still reports 23 active identities. Three are GitHub-owned dynamic workflows (dynamic/dependabot/dependabot-updates, dynamic/dependabot/update-graph, and dynamic/github-code-scanning/codeql). Four correspond to protected-tree files. The remaining 16 active repository-path identities are absent from the exact protected tree:

• .github/workflows/authority-pair-documentation.yml;
• .github/workflows/authority-pair-implementation.yml;
• .github/workflows/docstring-quality-implementation.yml;
• .github/workflows/finalize-release-verifier.yml;
• .github/workflows/implement-request-timeout-policy.yml;
• .github/workflows/implement-response-header-limits.yml;
• .github/workflows/merge-main-pr39.yml;
• .github/workflows/migrate-opencode-nvidia.yml;
• .github/workflows/pr32-implementation-bootstrap.yml;
• .github/workflows/pr35-readme-contract-fix.yml;
• .github/workflows/publication-status-readme.yml;
• .github/workflows/publish.yml;
• .github/workflows/release-changelog-update.yml;
• .github/workflows/ruff-fix-complete-coverage.yml;
• .github/workflows/sync-pr39-main.yml;
• .github/workflows/update-timeout-branch-from-main.yml.

Current detector lane

Draft PR #203 is the single live read-only detector lane.

Fresh identity:

• exact base / protected-main snapshot: 7faf7a3b8a47980113982914000e724ab6a6cda5;
• exact current head: 9ac4bc2de5bdba2e92be184e46a42ef55627bd77;
• open / Draft / mergeable;
• exact delta: scripts/ci/audit_workflow_registry.py, tests/test_workflow_registry_audit.py, tests/test_workflow_registry_partial_transfer.py, and tests/test_workflow_registry_state_integrity.py;
• formal PR reviews: none;
• unresolved inline review threads: none.

The detector separately reserves workflow paths still owned by exact open-PR snapshots before classifying an identity as active_orphan. It binds evidence to one expected protected SHA, paginates and rechecks registry and PR reservation state, emits workflow ID/path/state/classification plus receipts, and returns nonzero while active orphans remain. It has no disable, branch, PR-comment, reviewer, credential-minting, or status-publication authority.

Detector hardening evidence

Partial HTTP transfers

A truncated GitHub API response previously allowed http.client.IncompleteRead and partial-body metadata to escape the reviewed audit boundary.

• test-only RED 06f5fbf3a96f77bae9ba2e8bd674813773a761e9;
• CI 31662731204, Python 3.14 job 94330765367: 1 failed, 1043 passed; raw IncompleteRead(11 bytes read, 100 more expected) escaped;
• first fix d936687d94ec26911854ceac8cb87aba1e173909 caught the transfer failure but retained it in AuditError.__context__;
• second RED CI 31663075087, Python 3.14 job 94331810126: 1 failed, 1043 passed on the provenance assertion;
• provenance-safe fix 7d3edee15b184c308b7fa77670a239218989c57e raises one fresh generic error only after leaving the active handler.

Unknown lifecycle states

The detector then proved another integrity gap: any non-empty state other than active was silently treated as disabled. A malformed or future provider state could therefore be represented as safe lifecycle closure.

• test-only RED ee0a630d7f94f8f61d7a7c56e6e4b95799de3ff4;
• CI 31663714501, Python 3.11 job 94333748752: exact checkout and Ruff passed; 1 failed, 1044 passed because provider_future_state did not fail closed;
• current fix 9ac4bc2de5bdba2e92be184e46a42ef55627bd77 accepts only exact documented GitHub states: active, deleted, disabled_fork, disabled_inactivity, and disabled_manually, applying the same validator to the emitted audit and recheck snapshot.

Exact-current-head gate proof

On unchanged head 9ac4bc2de5bdba2e92be184e46a42ef55627bd77:

• repository CI 31663948791 completed successfully across package acceptance and Python 3.10–3.14;
• Python 3.14 job 94334452103 checked out the exact head, ran CPython 3.14.7, Ruff, 1045 passed, product guard, compileall, exact 1758/1758 statement coverage and 588/588 branch coverage;
• SAST Semgrep 31663948803 completed successfully;
• Security Scan 31663948798 is only aggregate-success evidence: dependency-review job 94334454133 completed, but its actual Dependency review action was skipped after the support probe. Under the repository acceptance contract this is non-passing. The separately governed root repair remains read-only central PR ContextualWisdomLab/.github#897, currently open at exact head 714a19818ff35cce246b6b59b9d3969783037cb0 against central protected main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• required OpenCode transport 31663947429 completed successfully, but its current jobs are bootstrap/echo wrappers and there is still no formal exact-head PR review. Wrapper/status/model transport is not semantic review or qualifying approval;
• required Strix transport 31663947448 / job 94334450406 completed successfully and emitted artifact strix-reports (sha256:ec665dbe9b99532fff3605bc4766282be2d4074daf62d3d15343d607b901347c). The report is explicitly preliminary and recommends expanded/manual validation; the gate console records provider-infrastructure/failure-signal paths and fail-closed handling. Therefore wrapper success is not a substantive clean-scan proof.

PR #203 correctly remains Draft. Do not churn its unchanged clean head merely to retrigger external providers.

RCA

Incident root cause

Temporary implementation and PR-integration workflow files were removed from protected-main history after bounded use, but their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Tree-level checks alone cannot prove lifecycle closure after source removal.

Detector evidence-boundary root causes

The detector must treat API transport integrity and lifecycle-state vocabulary as security-relevant evidence boundaries: partial responses, unknown states, or changing snapshots cannot be inferred as safe absence/disablement. The two test-first repairs above make those boundaries fail closed.

Current integration blockers

The first remaining failing boundaries are not detector source defects:

1. central Security Scan converts unavailable Dependency Review evidence into a skipped action and aggregate green;
2. Strix transport/provider execution does not currently yield substantive clean-scan evidence for this exact head;
3. no formal exact-head source review exists.

Those are separate governance/provider lanes. Local source churn cannot repair them and would invalidate otherwise-good exact-head evidence.

Distinct remedies and feasibility

• Workflow registry cleanup: disable reviewed orphan identities by exact workflow ID through an authorized normal control-plane action. Feasible only through authority exposing the lifecycle-disable operation; the current GitHub connector exposes inspection/rerun operations but no disable mutation.
• Detector integration: keep ci: audit orphaned Actions workflow identities #203 unchanged while external gates are non-substantive; after the central Dependency Review repair is protected and current semantic/security evidence exists, rerun/refetch under normal governance and integrate only the unchanged accepted tree.
• Rejected wrong-layer remedies: restoring historical YAML, creating a self-deleting cleanup workflow, display-name matching, inventing a PAT/reviewer/credential, COPILOT_GITHUB_TOKEN, broad secrets: inherit, weakening/skipping required evidence, or making a no-op commit only to retrigger providers.

Authorized remediation sequence

1. paginate the complete Actions registry;
2. bind evidence to exact protected-main SHA and tree;
3. classify present repository workflows, active orphan records, documented disabled records, GitHub-owned dynamic workflows, paths reserved by exact active PRs, and reject unknown states;
4. refetch exact branch, registry, PR reservations, workflow IDs and states immediately before mutation;
5. disable reviewed active orphan identities by exact workflow ID through authorized normal control-plane action;
6. preserve the current protected CI/release/hourly identities and any separately justified lifecycle identity;
7. retain immutable before/after evidence and re-run the protected detector.

Coordinate with read-only central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929 without racing their writers.

Acceptance criteria

• Maintain a complete paginated live inventory and exact protected-main binding.
• Distinguish protected-tree, dynamic, documented-disabled, active-PR-reserved, and active-orphan identities.
• Reject pagination truncation, changing registry/branch/PR reservations, malformed identities, permission/network/HTTP/JSON failures, unsafe path forms, partial transfers, and unknown lifecycle states.
• Add immutable RED/GREEN evidence that partial HTTP transfers fail closed behind a generic non-leaking error with no cause/context provenance.
• Add immutable RED/GREEN evidence that an unknown provider/future workflow state cannot be silently classified as disabled.
• Preserve exact Python 3.10–3.14/package and exact owned-production statement/branch coverage on the current detector head.
• Complete exact-current-head repository CI and SAST on ci: audit orphaned Actions workflow identities #203.
• Integrate the separately governed fail-closed Dependency Review repair, then require the actual immutable-pinned action to execute and succeed on unchanged ci: audit orphaned Actions workflow identities #203; aggregate green with the action skipped is not passing.
• Obtain substantive exact-head Strix evidence and current source review with zero valid unresolved findings; wrapper/model/status transport is not sufficient.
• Merge ci: audit orphaned Actions workflow identities #203 only under live protected governance and verify the detector from protected main.
• Through authorized control-plane action, disable or explicitly justify every reviewed active repository-path identity absent from protected main.
• Prove after remediation that no protected CI/release/hourly identity was disabled and the detector reports the corrected registry state.

This issue remains open for protected detector integration and authorized registry cleanup. No self-approval, bypass, local central-workflow fork, temporary writer workflow, or clean-head churn merely to retrigger external providers is acceptable.