You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fresh live evidence on 2026-08-17 reports 59 workflow identities while protected default branch develop@acdbea6344fe1231c39535b575f4de35e4c607c9 contains only the current checked-in workflow YAML set. Many historical bootstrap, finalizer, diagnosis, and PR-specific registry identities remain state: active even though their .github/workflows/... source path is absent from that exact protected tree.
The same live registry snapshot also proves that GitHub-managed workflows are represented as dynamic/... paths without a separate trustworthy source field, for example:
dynamic/agents/anthropic-code-agent;
dynamic/agents/openai-code-agent;
dynamic/dependabot/dependabot-updates;
dynamic/dependabot/update-graph; and
dynamic/github-code-scanning/codeql.
Therefore lifecycle classification must not use workflow names, and must not trust an arbitrary auxiliary source: github field to override repository path/tree evidence. The observed dynamic/ namespace is treated separately from repository workflow paths; any other active non-repository path must fail closed unless independently proven.
Root cause / evidence boundary
Repository workflow source and the Actions registry have independent lifecycles, but absence from protected develop alone does not prove deletion from every live branch. The standalone BandScope detector intentionally does not enumerate every non-default branch. Consequently an active .github/workflows/... registry path that is absent from the exact protected tree is a lifecycle-drift candidate whose branch provenance is unproven, not yet a proven orphan.
The product/control-plane defect is therefore two-part: repository-tree cleanup was previously treated as complete registry lifecycle cleanup, while default-tree absence was also at risk of being overinterpreted as proof that no live branch still owns the workflow. Both are unsafe. File-level tests cannot establish either registry state or cross-branch provenance.
This drift leaves an inaccurate writer inventory, retains identities tied to superseded product slices, and risks disabling a still-owned branch workflow if default-tree absence is treated as sufficient authority.
Canonical BandScope implementation
PR #895 (fix/workflows): audit orphaned Actions registry identities) is the canonical BandScope-owned detector lane. Current exact PR head at this issue refresh: 460f462a8009d575f41ee6ff1f07eb9e0715ff88.
Its current implementation is read-only and exact-default-branch-bound: it paginates the full registry, binds classification to one immutable protected tree, fails closed on incomplete evidence or branch movement, distinguishes present/disabled/GitHub-dynamic/unresolved identities, and emits machine-readable pagination receipts. orphaned_deleted remains a reserved v1 schema bucket for deletion that has been independently proven; the standalone detector does not infer that state from default-tree absence.
Current regressions lock the live registry contract:
a real-shaped dynamic/agents/openai-code-agent record with no source field classifies as GitHub-managed dynamic evidence;
forged source: github metadata on an absent .github/workflows/deleted-repair.yml path cannot override exact path/tree authority and remains unresolved while branch provenance is unproven;
an active repository workflow that is absent from develop but may still be owned by another live branch remains unresolved; and
unknown active paths such as external/workflows/... remain unresolved/fail-closed.
Ownership / remediation
Do not restore deleted workflows, create a cleanup PAT, create another self-deleting cleanup workflow, or disable an identity from default-tree absence alone. Actual Actions-registry disablement is a separate authorized operator/control-plane action coordinated with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detection issue ContextualWisdomLab/appguardrail#929.
For each candidate active repository-path identity, the authorized owner must independently establish that no live branch still owns the workflow source, re-resolve protected develop, refetch the exact registry record, and confirm the relevant evidence is unchanged immediately before mutation. If provenance or registry state changed, abort and re-audit rather than acting on a stale workflow ID. Before/after registry evidence must be retained.
BandScope owns the repository-specific detector and evidence only. Organization-wide inventory, cross-branch provenance, credentials, and registry mutation remain the central .github owner's authority.
Acceptance criteria
Complete paginated read-only detector design with exact protected-default-branch binding.
Adversarial coverage for incomplete pagination, count drift, branch movement, malformed/duplicate workflow identities, legitimate present bootstrap-named workflows, real GitHub dynamic/ identities, forged auxiliary source metadata, unknown active non-repository paths, and off-default branch-provenance ambiguity.
Standalone detector fails closed as unresolved when an active repository workflow is absent from protected develop but deletion from every live branch is unproven.
Qualifying independent non-author last-push approval and ordinary branch-protection acceptance are satisfied where live policy requires them.
Central authorized lifecycle action independently proves branch provenance before disabling each reviewed active orphan repository-path identity or records an explicit evidence-backed exception.
Post-remediation live inventory proves reviewed orphan identities are disabled while current supported BandScope automation, any still-owned branch workflows, and GitHub-managed dynamic/ workflows remain intact.
Protected integration and post-remediation operational evidence close this issue.
This issue remains open until protected integration plus authorized registry cleanup evidence proves the product/control-plane defect is actually removed.
Live Actions registry drift
Fresh live evidence on 2026-08-17 reports 59 workflow identities while protected default branch
develop@acdbea6344fe1231c39535b575f4de35e4c607c9contains only the current checked-in workflow YAML set. Many historical bootstrap, finalizer, diagnosis, and PR-specific registry identities remainstate: activeeven though their.github/workflows/...source path is absent from that exact protected tree.The same live registry snapshot also proves that GitHub-managed workflows are represented as
dynamic/...paths without a separate trustworthysourcefield, for example:dynamic/agents/anthropic-code-agent;dynamic/agents/openai-code-agent;dynamic/dependabot/dependabot-updates;dynamic/dependabot/update-graph; anddynamic/github-code-scanning/codeql.Therefore lifecycle classification must not use workflow names, and must not trust an arbitrary auxiliary
source: githubfield to override repository path/tree evidence. The observeddynamic/namespace is treated separately from repository workflow paths; any other active non-repository path must fail closed unless independently proven.Root cause / evidence boundary
Repository workflow source and the Actions registry have independent lifecycles, but absence from protected
developalone does not prove deletion from every live branch. The standalone BandScope detector intentionally does not enumerate every non-default branch. Consequently an active.github/workflows/...registry path that is absent from the exact protected tree is a lifecycle-drift candidate whose branch provenance is unproven, not yet a proven orphan.The product/control-plane defect is therefore two-part: repository-tree cleanup was previously treated as complete registry lifecycle cleanup, while default-tree absence was also at risk of being overinterpreted as proof that no live branch still owns the workflow. Both are unsafe. File-level tests cannot establish either registry state or cross-branch provenance.
This drift leaves an inaccurate writer inventory, retains identities tied to superseded product slices, and risks disabling a still-owned branch workflow if default-tree absence is treated as sufficient authority.
Canonical BandScope implementation
PR #895 (
fix/workflows): audit orphaned Actions registry identities) is the canonical BandScope-owned detector lane. Current exact PR head at this issue refresh:460f462a8009d575f41ee6ff1f07eb9e0715ff88.Its current implementation is read-only and exact-default-branch-bound: it paginates the full registry, binds classification to one immutable protected tree, fails closed on incomplete evidence or branch movement, distinguishes present/disabled/GitHub-dynamic/unresolved identities, and emits machine-readable pagination receipts.
orphaned_deletedremains a reserved v1 schema bucket for deletion that has been independently proven; the standalone detector does not infer that state from default-tree absence.Current regressions lock the live registry contract:
dynamic/agents/openai-code-agentrecord with nosourcefield classifies as GitHub-managed dynamic evidence;source: githubmetadata on an absent.github/workflows/deleted-repair.ymlpath cannot override exact path/tree authority and remainsunresolvedwhile branch provenance is unproven;developbut may still be owned by another live branch remainsunresolved; andexternal/workflows/...remain unresolved/fail-closed.Ownership / remediation
Do not restore deleted workflows, create a cleanup PAT, create another self-deleting cleanup workflow, or disable an identity from default-tree absence alone. Actual Actions-registry disablement is a separate authorized operator/control-plane action coordinated with central lifecycle issue
ContextualWisdomLab/.github#945and AppGuardrail detection issueContextualWisdomLab/appguardrail#929.For each candidate active repository-path identity, the authorized owner must independently establish that no live branch still owns the workflow source, re-resolve protected
develop, refetch the exact registry record, and confirm the relevant evidence is unchanged immediately before mutation. If provenance or registry state changed, abort and re-audit rather than acting on a stale workflow ID. Before/after registry evidence must be retained.BandScope owns the repository-specific detector and evidence only. Organization-wide inventory, cross-branch provenance, credentials, and registry mutation remain the central
.githubowner's authority.Acceptance criteria
dynamic/identities, forged auxiliary source metadata, unknown active non-repository paths, and off-default branch-provenance ambiguity.unresolvedwhen an active repository workflow is absent from protecteddevelopbut deletion from every live branch is unproven.dynamic/workflows remain intact.This issue remains open until protected integration plus authorized registry cleanup evidence proves the product/control-plane defect is actually removed.