[Fleet incident] Disable orphaned federation and product-loop bootstrap workflow identities

[seonghobae]

Live Actions registry drift

The repository's Actions API currently reports 42 workflow identities. Numerous historical federation, OIDC, OpenCode product-loop, dependency-refresh, coverage, and desired-state bootstrap records remain in state: active, including examples such as:

• bootstrap-federation-preflight.yml and URL-hardening variants;
• bootstrap-finalize-coverage.yml;
• the OpenCode product-loop finalization/reconciliation bootstrap series;
• bootstrap-https-review-remediation.yml;
• OIDC federation preflight versions through v5;
• bootstrap-upgrade-cryptography.yml;
• one-shot dependency-refresh/consolidation workflows;
• historical desired-state and coverage materializers.

Fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/bootstrap-federation-preflight.yml. The source is absent, but GitHub continues to advertise the workflow identity as active.

The supported ci, CodeQL, Hourly PR steward, and Hourly product development workflows must be preserved. PR #74's egress repair is already on protected main; this issue tracks a separate workflow-lifecycle defect.

Root cause

Temporary federation and product-loop bootstrap workflows were removed from the protected-main tree after their bounded use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level tests cannot detect orphaned control-plane identities after source removal.

Realistic remediation

Keyverse remains owned by the enabled general CWL Autonomous Development writer lease. The fleet incident loop must remain read-only and must not race it. Under that owner path:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected-main SHA and tree;
3. classify present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intended pending supported integrations, and unresolved records;
4. refetch exact branch/workflow state immediately before mutation;
5. disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
6. preserve all current supported CI/security/hourly workflows;
7. retain immutable before/after evidence.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not add another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority to an untrusted scanner.

Acceptance criteria

• complete paginated inventory and exact protected-main binding;
• every reviewed active repository-path workflow absent from protected main disabled or explicitly justified;
• no current CI/security/hourly workflow disabled through name-only matching;
• no historical federation/product-loop bootstrap source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a currently present bounded bootstrap still owned by an active PR;
• exact-head CI/security/review gates;
• normal protected-main integration;
• post-remediation live inventory proves orphan identities disabled while supported Hourly PR steward and Hourly product development remain operational.

This issue belongs to the organization-wide Hourly Product Development fleet incident.

[seonghobae]

Related control-plane drift found during the 2026-08-20 PR queue audit (separate from the orphaned identity cleanup): active ruleset CWL Central required workflows (ID 18156473) requires .github/workflows/close-empty-pr.yml, opencode-review.yml, pr-review-merge-scheduler.yml, security-scan.yml, strix.yml, sast-semgrep.yml, and noema-review.yml from main, but main currently contains only ci.yml, codeql.yml, hourly-pr-steward.yml, and hourly-product-development.yml. The required workflow paths return 404 from the repository Contents API, while new PR runs still create queued check contexts for those deleted workflow identities; run view/watch also returns 404 for the queued workflow run. This leaves protected PRs waiting on non-existent workflow definitions. Acceptance: reconcile the ruleset required-workflow paths with active main workflow definitions through the authorized control-plane owner, or restore equivalent definitions through a normal reviewed PR; then verify a fresh exact-head PR reaches terminal required checks. Do not transfer historical green checks or bypass protection.

[seonghobae]

Correction to the previous audit note: repository ID 1274066402 in ruleset 18156473 resolves to ContextualWisdomLab/.github, not ContextualWisdomLab/keyverse. The seven required workflow source files do exist in the central .github repository, so their absence from Keyverse main is expected and is not by itself ruleset drift. The remaining observed symptom is narrower: Keyverse PR #100 exact-head required-workflow run 32356529260 (workflow identity 309130044) is queued, its target-repository workflow view returns 404, and its job remains queued; this requires central required-workflow execution tracing, not restoring local stubs. No protected setting was changed.

[seonghobae]

Keyverse exact workflow-lifecycle evidence - 2026-08-20

Read-only complete registry/tree reconciliation against protected main:

• exact protected main SHA: ce207df;
• Actions registry: 43 workflow identities, all 43 active;
• exact protected tree contains 4 active repository-path identities: ci.yml, codeql.yml, hourly-pr-steward.yml, hourly-product-development.yml;
• 37 active repository-path identities have no source at that exact tree SHA;
• 2 active dynamic/* identities are classified as GitHub-owned dynamic workflows, not deleted repository files.

No workflow state was mutated. The 37 missing repository paths are evidence for the authorized lifecycle owner to classify and revalidate by workflow ID immediately before any disablement; supported CI/security/hourly paths remain preserved. This is registry/tree evidence only and does not alter the Keyverse protected merge gate.

[seonghobae]

Fresh read-only workflow lifecycle evidence — 2026-08-21

A complete paginated Actions registry audit was repeated against protected main without mutation.

• protected-main SHA: ce207dfd42975db61c82a5963e206fc1db14ac2b
• registry records: 43
• active repository paths present in that exact tree: 4
• active repository-path identities absent from that exact tree: 37
• GitHub-owned dynamic identities: 2
• recursive tree response: not truncated

The four present repository workflows are the supported CI, CodeQL, Hourly PR steward, and Hourly product development paths. The 37 missing repository-path records remain classified as orphan candidates; no workflow was disabled, and no name-only heuristic was used. Disablement remains delegated to the authorized central lifecycle owner after exact workflow-ID revalidation.

[seonghobae]

Exact pre-mutation gate — 2026-08-21

Fresh read-only refetch immediately before the lifecycle action:

• protected main: ce207dfd42975db61c82a5963e206fc1db14ac2b
• Actions registry: 43 identities; all active
• repository-path identities: 41 active
• exact protected tree: 4 workflow paths (ci.yml, codeql.yml, hourly-pr-steward.yml, hourly-product-development.yml)
• active repository-path orphans: 37
• dynamic Dependabot identities: 2; excluded from repository-path mutation
• current open Keyverse PRs introduce no workflow path absent from the exact protected tree

The 37 mutation candidates are the active registry records whose exact paths are absent from the protected tree:

326681839 bootstrap-federation-preflight.yml
326684502 bootstrap-federation-url-hardening.yml
326697093 measure-account-unification-coverage.yml
326713601 bootstrap-finalize-coverage.yml
326776223 bootstrap-upgrade-cryptography.yml
326786474 bootstrap-https-review-remediation.yml
326829155 bootstrap-oidc-federation-preflight.yml
326842014 bootstrap-oidc-federation-preflight-v2.yml
326852283 bootstrap-oidc-federation-preflight-v3.yml
326866819 bootstrap-oidc-federation-preflight-v4.yml
326879928 bootstrap-oidc-federation-preflight-v5.yml
327019021 bootstrap-finalize-opencode-product-loop.yml
327022811 bootstrap-reconcile-opencode-product-loop.yml
327027114 bootstrap-finalize-opencode-v3.yml
327470672 bootstrap-finalize-opencode-v4.yml
327536863 one-shot-fix-ldap-object-class-profile.yml
327549930 materialize-ldap-directory-desired-state.yml
327574046 one-shot-snapshot-ldap-hardening.yml
327697695 one-shot-publish-ldap-hardening.yml
327767086 one-shot-consolidate-august-dependencies.yml
327768662 repair-account-unification-ruff-lock.yml
327776222 repair-account-unification-regressions.yml
327796408 one-shot-restore-directory-gates.yml
327833573 one-shot-publish-oidc-rp-preflight.yml
328274394 one-shot-finalize-oidc-rp-preflight.yml
328287352 one-shot-consolidate-august-dependencies-v2.yml
328288702 one-shot-bootstrap-dependency-refresh-v3.yml
328289942 one-shot-consolidate-august-dependencies-v3.yml
328303895 one-shot-finalize-oidc-rp-preflight-v2.yml
328305574 one-shot-repair-oidc-finalizer-v3.yml
328306259 one-shot-repair-oidc-finalizer-v4.yml
328306745 one-shot-repair-oidc-finalizer-v5.yml
328310026 one-shot-repair-oidc-finalizer-v6.yml
328312195 one-shot-finalize-oidc-rp-preflight-v7.yml
329222533 one-shot-fix-rp-endpoint-policy.yml
329232587 one-shot-normalize-rp-mappers.yml
334165362 repair-python-locks.yml

The supported four workflows are excluded by exact tree membership. The next action is the authorized workflow-registry disable operation for these IDs only, followed by a fresh paginated before/after reconciliation and protected-main workflow smoke checks.

[seonghobae]

Exact post-mutation reconciliation — 2026-08-21

The authorized registry action completed for all 37 preflight candidates. Fresh live evidence now shows:

• protected main: ce207dfd42975db61c82a5963e206fc1db14ac2b
• Actions registry: 43 identities total
• repository-path identities: 41 total; 4 active, 37 disabled_manually
• dynamic Dependabot identities: 2 active and unchanged
• active repository-path identities absent from the exact protected tree: 0
• exact protected tree still contains exactly ci.yml, codeql.yml, hourly-pr-steward.yml, and hourly-product-development.yml
• all four supported workflow records remain active

Operational smoke evidence remains available on the protected SHA: Hourly product development run 32443743245 succeeded at 2026-08-21T03:32:31Z; the latest completed Hourly PR steward run 32425875355 succeeded at 2026-08-20T22:47:59Z; CodeQL run 31783415830 succeeded on the protected SHA. The latest ci.yml success is run 31555831037 on 2026-08-12, before the current protected SHA; no supported workflow was disabled by this action.

No dynamic Dependabot identity, current protected workflow, open-PR workflow path, source file, credential, or branch-protection setting was mutated. This closes the registry/tree reconciliation and leaves the recurrence-detector and cross-repository coordination acceptance work tracked separately.

[seonghobae]

Central lifecycle owner handoff refresh: .github#1026 exact head is 580c8e97e2498fbd6b41bc2de6f2e7fca7dd4e48. The central read-only detector now carries the complete explicit owner-issue registry for confirmed fleet evidence, including this keyverse#99 owner route; it still does not mutate Actions state. Local central verification on that head is complete; hosted Checks and independent review remain pending under normal protection.

[seonghobae]

Central lifecycle owner refresh: .github#1026 is now at exact head 30644f0b2d88de36af4b0156f83b56ef8c65dd89 against current base 731af58e954901c4f1cc853231c592abb1eaf617 after a normal base update. The explicit central registry retains ContextualWisdomLab/keyverse#99 as the owner route and remains read-only. Local merged-tree verification passed; hosted Checks and independent review remain authoritative.

[seonghobae]

Live governance evidence: repository ruleset 18156473 (CWL Central required workflows) is active on ~ALL, requires PR/non-fast-forward protections, and has OrganizationAdmin bypass_mode=always. Updating PR #100’s head with the authenticated maintainer therefore caused GitHub to report a branch-rule bypass even though the update was a fast-forward to an existing PR branch and not a protected-main push/force push/merge. This is a control-plane defect: future PR-branch updates need a non-admin actor or a narrowly scoped ruleset target; no protected-main merge bypass was used.

[seonghobae]

Follow-up: organization ruleset 18156473 was corrected live. It remains active, now targets only ~DEFAULT_BRANCH, preserves required workflow/review/deletion/non-fast-forward rules, and has no bypass actors. The prior PR-branch OrganizationAdmin bypass vector is closed.