[Fleet incident] Disable orphaned one-shot and finalizer workflow identities

[seonghobae]

Live Actions registry drift

Fresh live Actions registry observation reports 63 workflow identities while protected main remains exactly 3b38ead2d00f44eb578d0689087b9293b3dabe1e. This is a control-plane registry count, not a claim that all 63 identities are orphaned.

Numerous historical apply, fix, finalizer, one-shot, and PR-specific repair records remain advertised in state: active, including examples such as:

• apply-preparse-envelope-limits.yml;
• finalize-atomic-envelope-restore.yml;
• finalize-conflict-evidence.yml;
• finalize-document-revision-tags.yml;
• fix-autosave-latest-ordering.yml;
• fix-collaboration-test.yml;
• one-shot-imperative-envelope-persistence.yml;
• one-shot-imperative-envelope-pr.yml;
• one-shot-pr61-autosave-validator-repair.yml;
• other completed editor/Office repair and finalizer workflows.

Previously sampled protected-main contents lookup returned 404 Not Found for active path .github/workflows/apply-preparse-envelope-limits.yml: the source file was absent while GitHub still advertised its workflow identity as active. Current classification must nevertheless be derived from a complete exact-SHA-bound audit, not from registry count or name patterns alone.

The supported CI, CodeQL, current cross-engine/browser validation, release, security, and product workflows must be preserved. Recently created bounded repair workflows must be evaluated by exact source presence and owner intent rather than disabled merely because their names contain once.

Current owner path

Draft PR #279 is the read-only recurrence-detector owner. Its unchanged current exact head is 49405ed479893afdfa273b3a088b0c48317e9d47, synchronized non-destructively onto exact protected main with zero commits behind. Fresh exact-head repository evidence is terminal-success: CI 32072116989, Security Scan 32072116290, and SAST Semgrep 32072116548 all completed / success. The current #279 canonical record additionally binds successful Required Noema Review 32072115565, Strix Security Scan 32072116185, Required PR Review Merge Scheduler 32072115018, Close Empty PR 32072115706, and Required OpenCode Review 32072115079 to this exact head. Formal submitted reviews remain 0, unresolved review threads remain 0, and GitHub reports the Draft mechanically mergeable.

The prior issue snapshot saying Required OpenCode Review was still queued is superseded and must not be used as current evidence. Successful repository/central/model runs remain technical evidence only and do not constitute qualifying independent approval or protected integration.

The currently available Inkspan GitHub mutation surface does not expose a workflow-disable operation. Disabling an exact registry workflow identity is therefore TOOL_UNAVAILABLE for this control-plane mutation in this lane. Do not evade that boundary through lower-level APIs, restore historical YAML, create a new self-deleting cleanup workflow, or add workflow-disable authority to the untrusted detector. The detector and exact remediation inventory should continue to advance; final disablement requires an authorized workflow-control surface/operator after fresh pre-mutation refetch.

Root cause

Temporary editor and document-processing repair workflows were removed from the repository tree after use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current source-level tests cannot detect orphaned control-plane identities after the YAML disappears.

This produces a false enabled-writer inventory and violates the fleet invariant that temporary write-capable/self-modifying repair workflows must not remain.

Realistic remediation

Under Inkspan's dedicated writer/operations loop:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected-main SHA and tree;
3. distinguish present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intentionally pending supported integrations, and unresolved records;
4. retain exact PR/head ownership evidence for any active repair exemption;
5. refetch exact state immediately before mutation;
6. disable proven active orphan repository-path identities through an authorized operator/control-plane action;
7. preserve all current CI/security/release/product workflows and any genuinely active bounded repair with an explicit owner;
8. retain immutable before/after evidence and re-run the Inkspan-side detector.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not introduce another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority into an untrusted scanner.

Acceptance criteria

• complete paginated inventory and exact default-branch binding;
• every reviewed active repository-path workflow absent from protected main disabled or explicitly justified;
• no current production/browser/Office workflow disabled through name-only matching;
• no old repair/finalizer source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• active-repair exemptions retain exact PR/head authority and fail closed when stale/ambiguous;
• adversarial tests cover partial pagination, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub-owned dynamic workflows, a legitimate live workflow with once in its name, and a recently created repair still owned by an active PR;
• exact-head CI/security/review gates;
• normal protected-main integration;
• post-remediation live inventory proves orphan identities disabled while supported Inkspan automation remains operational.

This issue is part of the organization-wide GitHub Actions fleet incident. The fleet audit remains read-only and tracks protected-main operational evidence.

[seonghobae]

Fresh control-plane evidence on protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03: the Actions registry now reports 63 workflow identities (the issue body's earlier 48-count snapshot is stale). Workflow id 326648609, path .github/workflows/apply-preparse-envelope-limits.yml, remains state: active; exact contents lookup for that path at the protected SHA still returns 404. The systemic owner path was actively advanced in ContextualWisdomLab/.github#945 with this Inkspan evidence. Available GitHub tooling in this invocation still exposes workflow read/rerun but no supported workflow-disable mutation, so do not restore deleted YAML or emulate disablement through a new self-modifying workflow.