Live Actions registry drift
The repository's GitHub Actions API currently reports 37 workflow identities. Numerous historical TLS/HTTP implementation, diagnosis, formatting, source-export, lock-materialization, bootstrap, and one-shot records remain in state: active, including examples such as:
advance-tls-coverage.yml and bootstrap-tls-compile.yml;diagnose-tls-errors.yml;- HTTP workspace/source exports, error-extension, compile, cargo-fix, focused-gate, and transport-format workflows;
fix-empty-hex-ipv4.yml;format-pr1-once.yml;harden-agent-isolation-once.yml;- IPv6 socket-hardening variants;
- HTTP decoder/lock materializers and other completed implementation helpers.
Fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/format-pr1-once.yml. The source is absent, but GitHub still advertises the workflow identity as active.
The supported CI and Hourly Product Development workflows must be preserved. The current owner loop separately tracks credential-ordering and narrow GitHub API alias behavior; this issue does not authorize a local egress workaround.
Root cause
Temporary TLS, HTTP, and agent-isolation workflows were removed from the protected-main tree after their bounded use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level tests cannot detect orphaned control-plane identities after source removal.
Realistic remediation
OriginWeave remains read-only to the fleet incident because its dedicated writer loop is enabled. Under that owner path:
- paginate the complete Actions registry;
- bind evidence to the exact protected-main SHA and tree;
- classify present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intended pending supported integrations, and unresolved records;
- refetch exact branch/workflow state immediately before mutation;
- disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
- preserve current CI, Hourly Product Development, and supported security/product workflows;
- retain immutable before/after evidence.
Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not add another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority to an untrusted scanner.
Acceptance criteria
- complete paginated inventory and exact protected-main binding;
- every reviewed active repository-path workflow absent from protected
main disabled or explicitly justified;
- no current CI/hourly workflow disabled through name-only matching;
- no historical TLS/HTTP/one-shot source reintroduced;
- read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
- adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a currently present bounded diagnostic still owned by an active PR;
- exact-head CI/security/review gates;
- normal protected-main integration;
- post-remediation live inventory proves orphan identities disabled while supported OriginWeave Hourly Product Development remains operational.
This issue belongs to the organization-wide Hourly Product Development fleet incident.
Live Actions registry drift
The repository's GitHub Actions API currently reports 37 workflow identities. Numerous historical TLS/HTTP implementation, diagnosis, formatting, source-export, lock-materialization, bootstrap, and one-shot records remain in
state: active, including examples such as:advance-tls-coverage.ymlandbootstrap-tls-compile.yml;diagnose-tls-errors.yml;fix-empty-hex-ipv4.yml;format-pr1-once.yml;harden-agent-isolation-once.yml;Fresh protected-main contents lookup returns
404 Not Foundfor sampled active path.github/workflows/format-pr1-once.yml. The source is absent, but GitHub still advertises the workflow identity as active.The supported
CIandHourly Product Developmentworkflows must be preserved. The current owner loop separately tracks credential-ordering and narrow GitHub API alias behavior; this issue does not authorize a local egress workaround.Root cause
Temporary TLS, HTTP, and agent-isolation workflows were removed from the protected-main tree after their bounded use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level tests cannot detect orphaned control-plane identities after source removal.
Realistic remediation
OriginWeave remains read-only to the fleet incident because its dedicated writer loop is enabled. Under that owner path:
Coordinate with central lifecycle issue
ContextualWisdomLab/.github#945and AppGuardrail detector issueContextualWisdomLab/appguardrail#929. Do not add another PAT,COPILOT_GITHUB_TOKEN, broadsecrets: inherit, or workflow-disable authority to an untrusted scanner.Acceptance criteria
maindisabled or explicitly justified;This issue belongs to the organization-wide Hourly Product Development fleet incident.