[Fleet incident] Resolve independent-review bootstrap deadlock for sole-collaborator repositories

[seonghobae]

Live policy deadlock

Fresh protected-branch rule evidence for ContextualWisdomLab/.github/main requires:

• 2 approving reviews;
• stale approvals dismissed on push;
• approval after the last push;
• all review threads resolved.

The live collaborators API returns exactly one human collaborator, seonghobae, who is also the author of the current central repair pull requests. Self-approval is not a qualifying independent review.

PR #835 at exact head 6a1acb1559755c27d7267e39fd6275bb9db74dc9 has every observed exact-head quality/security/supply-chain workflow successful, all review threads resolved, auto-merge enabled, and one formal OpenCode APPROVED review. GitHub still reports mergeable_state=blocked, which is consistent with the unsatisfied second approval.

PR #834 repairs the Noema OIDC response-envelope consumer that is intended to supply a second independent review identity, but #834 is governed by the same two-approval rule and currently has no qualifying approval. Therefore the broken second-review path cannot bootstrap its own repair.

The same condition appears in sole-collaborator product repositories such as EmbedRelay: exact-head code/security evidence can be green, but the standard reviewer-request API cannot request a non-collaborator App identity, and the central mention/OIDC route remains the only scalable independent-review path.

Root cause

The repository ruleset assumes at least two simultaneously operational independent reviewer identities, while organization access and reviewer control-plane deployment currently provide only one functioning formal reviewer identity (opencode-agent) in addition to the author. The second reviewer (cwl-noema-review) is itself impaired by the unmerged OIDC envelope and mention-concurrency repairs.

This is not a code-quality failure in #834/#835 and not a reason to reduce the required approval count. It is an identity/bootstrap architecture gap between branch policy and installed reviewer capacity.

Feasible remedies

Revalidate live organization policy and use one of these normal-policy options:

1. Independent human bootstrap reviewer — immediate and least architectural change

   • grant one trusted non-author human the minimum repository read/triage access required to submit formal reviews;
   • require that person to review exact-current-head fix(noema): validate stable OIDC exchange envelope #834 and fix(automation): replay isolated review-agent queues on current main #835 independently;
   • do not grant branch write, merge, release, deployment, secret, or administration authority merely to review.

2. Second review-only GitHub App identity — durable option

   • install/configure a second App whose repository permissions are limited to metadata/read, checks/read, contents/read, and pull-requests/write for review submission;
   • keep its credentials and provider/model path independent from OpenCode;
   • prove exact repository/head/base binding and formal APPROVE submission;
   • use it to bootstrap fix(noema): validate stable OIDC exchange envelope #834/fix(automation): replay isolated review-agent queues on current main #835 without repurposing a maintainer token.

3. Organization team reviewer capacity

   • grant a trusted non-author team read/triage review access and use normal GitHub review requests;
   • preserve the two-approval rule and last-push approval requirement.

Rejected non-remedies

• lowering required_approving_review_count from 2;
• administrator bypass or direct merge;
• self-approval;
• counting CodeRabbit COMMENTED, status checks, mention acknowledgements, or resolved threads as approval;
• reusing predecessor-head approvals;
• granting contents: write, merge, release, or deployment authority to a reviewer merely to satisfy the count;
• inventing a PAT or using COPILOT_GITHUB_TOKEN;
• asking the broken Noema path to approve the PR that must first repair that path.

Acceptance criteria

1. at least two independent non-author reviewer identities are demonstrably operational under the protected-main policy;
2. fix(noema): validate stable OIDC exchange envelope #834 and fix(automation): replay isolated review-agent queues on current main #835 each receive the required exact-current-head approvals without bypass;
3. both integrate through normal protected-main policy;
4. post-merge Noema OIDC and mention-concurrency canaries produce formal reviews on sole-collaborator repository PRs;
5. reviewer identities remain review-only and cannot write code, merge, release, deploy, or access unrelated secrets;
6. a documented onboarding/offboarding and outage fallback exists so loss of one reviewer does not deadlock the organization again;
7. no approval-count reduction or temporary bypass remains after bootstrap.

This issue is part of the organization-wide Hourly Product Development fleet incident. The central .github owner loop retains all implementation and merge authority. The fleet audit remains read-only and reports this because an external independent identity or permission grant is genuinely required to break the bootstrap deadlock.

[seonghobae]

2026-08-15 exact-state refresh: the bootstrap deadlock remains active and is now blocking the central hourly/commercialization path as well as individual repairs.

• feat(automation): coordinate hourly organization readiness #832 0dc693b26feb62742c252498f231c4a83eb1d501: bounded organization hourly coordinator; latest exact-head workflow inventory has no queued, running, failed, or cancelled runs, but no qualifying current-head independent approval.
• fix(scheduler): require independent exact-head approval #828 911f95c4a256000d8aabdcc45e178ab1cfbb81f6: independent-approval scheduler gate; effective tree restored to the prior bounded scheduler tree, but it cannot bootstrap the second counted reviewer.
• fix(noema): validate stable OIDC exchange envelope #834 526e7c284c4cb60979516935f3fb930319aed5de: Noema OIDC envelope repair; auto-merge armed, still missing normal-policy approvals.
• fix(automation): replay isolated review-agent queues on current main #835 c9fe4779d0030534a366d6a0fe4ae4252bb794fe: mention-concurrency isolation; auto-merge armed, still missing normal-policy approvals.

No approval-count reduction, self-approval, review dismissal, admin merge, token substitution, or ruleset bypass was attempted. The required external remedy remains a genuinely independent counted reviewer identity (human or review-only App) that can approve the exact unchanged heads through ordinary GitHub protection.

[seonghobae]

Fresh ScopeWeave owner-boundary evidence (2026-08-17 KST): ContextualWisdomLab/scopeweave protected develop remains at 28420da358f57be5e85be3660251e39b85e1cc94. Organization ruleset 18156473 currently requires 1 approving review, dismisses stale reviews on push, requires last-push approval, resolved threads, and has no bypass. The repository collaborators API currently returns exactly one collaborator, seonghobae (admin), who is also the author/last pusher on critical PR #523 head 27b95f435ffd4904e5b98c6940c27aad89a7babe. All seven repository-native workflows on that head are terminal success, current check inventory has no failed/queued check, and the actionable review threads are resolved; no qualifying independent approval exists. This is the same sole-collaborator bootstrap deadlock class tracked here, now blocking ScopeWeave's exact-contributor-head CI integrity fix. Acceptance for the central reviewer-capacity repair should include a canary proving a non-author counted approval on ScopeWeave under the 1-approval + last-push rule without granting source/merge/release authority.

[seonghobae]

Fresh organization-ruleset regression observed during the Context Fabric read-only dependency sweep. Ruleset 18156473 (CWL Central required workflows) changed during this invocation from the earlier live pull-request rule (required_approving_review_count=1, require_last_push_approval=true, required_review_thread_resolution=true; ruleset updated_at=2026-08-16T23:45:11.508+09:00) to the current rule at updated_at=2026-08-17T03:58:01.800+09:00: required_approving_review_count=0, require_last_push_approval=false, required_review_thread_resolution=false. The workflow requirements remain present and the rule still targets ~DEFAULT_BRANCH; bypass_actors=[] / current_user_can_bypass=never remain unchanged.

This is not a passing workaround for the reviewer-capacity incident. It directly conflicts with this issue's rejected non-remedy (“lowering required_approving_review_count”) and with #772's independent-review objective, and it removes latest-push/thread-resolution safeguards fleet-wide wherever this organization ruleset resolves to the default branch.

Owner-path action requested, without changing leaf repositories: identify the exact ruleset mutation actor/change receipt in organization audit/rule insights, determine whether this was an authorized emergency policy change or automation drift, and restore the intended fail-closed review policy through the central governance owner if the reduction was not explicitly approved. Acceptance must re-fetch the live ruleset after repair and prove the intended approval count, latest-push approval, thread-resolution rule, required-workflow set, target, and bypass actors together. Do not manufacture approvals or compensate by weakening leaf checks. Context Fabric will treat the current zero-approval rule as live policy evidence but will not treat the reduction itself as safety/commercial-readiness evidence.

[seonghobae]

Follow-up live revalidation: the fleet-wide review-policy regression reported above has been repaired. Ruleset 18156473 now reports updated_at=2026-08-17T04:31:31.043+09:00 with required_approving_review_count=1, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, and required_review_thread_resolution=true; bypass_actors=[] / current_user_can_bypass=never remain unchanged, and all seven central required workflows still target .github/main under ~DEFAULT_BRANCH.

This closes the zero-approval/latest-push/thread-resolution regression as a live safety state; Context Fabric will no longer describe the weakened rule as current. It does not by itself close this reviewer-capacity incident: one qualifying independent non-author approval is again required, so repositories with only the author as a human collaborator still need the review-only human/App/team capacity described in this issue before a protected merge can pass normally.

Audit provenance for the temporary 03:58:01.800 +09:00 weakening remains useful for incident RCA if available, but leaf products should now revalidate against the restored 04:31:31.043 +09:00 rule rather than carrying the temporary policy forward.

[seonghobae]

Fresh Context Fabric owner-boundary evidence after repository-owned repairs (2026-08-17 KST): ruleset 18156473 is restored at updated_at=2026-08-17T04:31:31.043+09:00 to 1 approval + stale-review dismissal + last-push approval + thread resolution, with bypass_actors=[] / current_user_can_bypass=never and the seven central required workflows unchanged. context-graph-contracts#4 is now at exact head 85b5d154953a5c9be5f05bb3e02c2e14c80d91b5; the causal Ruff failure was repaired there, and the current head's last commit is authored/pushed by the sole human seonghobae, so a review from that identity cannot satisfy the last-push independence rule. Stacked docs PR #5 is refreshed onto that exact head at 915d71be82c7ba03a8136e70e7be9390382804f9. enterprise-architecture-core#4 is at exact head d58a33f446b1f27d04aecd81db9f80e81f2c79ce after its exact-job Ruff failures were repaired; it is likewise waiting on current-head CI and, once eligible, needs a qualifying reviewer distinct from the last pusher. Current exact-head workflows are still queued/pending, so none are being treated as passing. Separate leaf issues #2 in both repositories still own the repository-settings prerequisite that main must replace bootstrap/root as the default branch so ~DEFAULT_BRANCH protection resolves to the intended integration branch. Acceptance for this central reviewer-capacity incident should include a canary on these Context Fabric bot-authored PRs proving a counted non-last-pusher approval without source/merge/release authority; do not lower the approval rule or reuse predecessor-head reviews.

[seonghobae]

Fresh Context Fabric revalidation found the organization ruleset has regressed again after the earlier 04:31 restoration.

Live inherited ruleset evidence (read through context-graph-contracts): ruleset 18156473, updated_at=2026-08-17T07:47:41.514+09:00, still active, still targets ~DEFAULT_BRANCH, still requires the seven central workflows from .github/main, bypass_actors=[], current_user_can_bypass=never; however its pull-request rule is now required_approving_review_count=0, require_last_push_approval=false, and required_review_thread_resolution=false.

This is not a Context Fabric source defect and I will not exploit the weakened policy to merge. Owner-path acceptance remains: inspect organization audit log / Rule Insights for the 07:47:41 +09:00 ruleset mutation and its authorized rationale; if unintended, restore the intended independent-review/latest-push/thread-resolution policy without lowering deterministic workflow gates. Revalidate the exact live ruleset afterward from a child repository. Context Fabric local PR repair continues independently.

[seonghobae]

Fresh Context Fabric owner-boundary revalidation after the 07:47 regression: inherited organization ruleset 18156473 changed again at 2026-08-17T08:42:06.726+09:00 and is currently restored to the intended fail-closed review policy: required_approving_review_count=1, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, required_review_thread_resolution=true, bypass_actors=[], current_user_can_bypass=never, with all seven central required workflows from .github/main still present under ~DEFAULT_BRANCH.

The reviewer-capacity incident itself remains reproducible. Fresh collaborator inventory for both context-graph-contracts and enterprise-architecture-core returns only seonghobae with repository access. Current locally validated PR heads are context-graph-contracts#4 = ff9b3f801329d689203d1e2d21a101d603439111 (local ci + supply-chain GREEN; package job proves PR merge ref contains that head and executes packaged timestamp/assertion/CloudEvent/JSON conformance) and enterprise-architecture-core#4 = d4df6c00095f7d6fdf9c6e48637631c32d526972 (local ci + runtime-readiness + supply-chain GREEN). Both exact head commits are authored/committed by seonghobae, so that sole available human cannot satisfy require_last_push_approval=true for these heads.

Separately, both leaf repositories still have default_branch=bootstrap/root; live applied-rules inspection on context-graph-contracts/main is empty because the organization ruleset targets ~DEFAULT_BRANCH. The existing leaf governance issues own that repository-setting change. Central acceptance for #948 should therefore remain a canary proving a counted reviewer identity distinct from the last pusher, without granting source/merge/release authority and without weakening the restored review rule.

[seonghobae]

Fresh OriginWeave owner-boundary evidence (2026-08-17 KST): organization ruleset 18156473 now reports updated_at=2026-08-17T08:42:06.726+09:00 and requires 1 approving review, stale-review dismissal on push, latest-push approval, resolved review threads, all seven central required workflows, and no bypass. ContextualWisdomLab/OriginWeave currently has exactly one repository collaborator, seonghobae (admin). Independent root PR OriginWeave #51 is at exact head ed01297e5fd0e6a97336078e23f49206c0952ef3 on live main 0841d2ab3d8b5e60a03c0a8e818cf438e2716829; its repository CI, SAST, Security Scan, OpenCode/coverage and returned check inventory are terminal-success, all returned CodeRabbit threads are resolved, but no formal qualifying independent approval exists. This is the same sole-collaborator + last-push approval deadlock tracked here. Please include OriginWeave as a canary for the central reviewer-capacity repair: a non-author counted reviewer must be able to approve the unchanged exact head through normal protection without gaining source/merge/release authority. No leaf rules, source, checks, or approval semantics should be weakened.

[seonghobae]

Fresh Context Fabric owner-boundary evidence: inherited organization ruleset 18156473 has regressed again at 2026-08-17T11:02:58.026+09:00. Read through ContextualWisdomLab/context-graph-contracts, it remains active, targets ~DEFAULT_BRANCH, retains the seven required workflows from .github/main, bypass_actors=[], and current_user_can_bypass=never; however the pull-request rule is again required_approving_review_count=0, require_last_push_approval=false, and required_review_thread_resolution=false (stale-review dismissal remains true).

This repeats the same policy oscillation already observed at 03:58 and 07:47 after restorations at 04:31 and 08:42. Context Fabric will not exploit the weakened review rule to merge. Please treat the recurrence itself as a central governance/control-plane defect: use organization audit log / Rule Insights to identify the exact 11:02:58 mutation actor/change receipt and the recurring mutation source (human, automation, policy sync, or configuration drift), then remove that causal writer/oscillation rather than merely restoring the fields once more.

Acceptance: (1) restore the intended independent-review policy (required_approving_review_count=1, stale-review dismissal, last-push approval, thread resolution) without changing the seven deterministic required workflows or introducing bypass actors; (2) identify and disable/repair the recurring unauthorized writer or synchronization path so the rule remains stable across subsequent refreshes; (3) re-fetch the inherited rule from a child repository and preserve audit evidence of actor/time/change; (4) retain the review-only independent reviewer-capacity canary. Leaf products must not compensate with source changes, self-approval, direct merge, or weaker gates.

[seonghobae]

Fresh post-intervention re-fetch: inherited organization ruleset 18156473 was restored again at 2026-08-17T11:33:08.826+09:00 to required_approving_review_count=1, dismiss_stale_reviews_on_push=true, require_last_push_approval=true, and required_review_thread_resolution=true, with the same seven required .github/main workflows, bypass_actors=[], and current_user_can_bypass=never.

Context Fabric will treat this as a restored snapshot, not incident closure, because the same rule has already oscillated three times today. Please retain the audit-log / Rule Insights RCA and recurring-writer removal acceptance from the prior comment. Closure evidence should prove the actor/change receipt for the 11:02:58 weakening and 11:33:08 restoration, identify the causal human/automation/policy-sync path, and demonstrate that the intended review policy remains stable across subsequent refreshes without one-off manual toggling. Leaf repositories will continue refusing merges until their main branch is actually the default/protected ref and qualifying independent review capacity exists.

[seonghobae]

Fresh Context Fabric owner-boundary stability sample (2026-08-17 13:xx KST): inherited organization ruleset 18156473, read through both context-graph-contracts and enterprise-architecture-core, is still fail-closed after the 11:33 restoration: 1 approving review, stale-review dismissal, independent last-push approval, review-thread resolution, the same seven required .github/main workflows, deletion/non-fast-forward protection, and no leaf bypass evidence. This is a useful stability sample, not closure of the earlier 03:58 / 07:47 / 11:02 oscillation; audit/Rule Insights RCA and recurring-writer removal remain required.

Fresh leaf evidence still reproduces the reviewer-capacity/default-branch deadlock: both repositories report default_branch=bootstrap/root; applied rules for main are empty while bootstrap/root receives ruleset 18156473; collaborator inventory exposes only seonghobae. context-graph-contracts#8 has now advanced to Ready on unchanged exact head 93a14489203b0cea45ada841f38d2e1241c12870 over exact parent head 5f0bdc449443ab868c96302a1b995a84c2649b14. Repository ci run 31991540353 and supply-chain run 31991540364 are terminal success; Python 3.11 reports 255 passed with 864/864 statements and 302/302 branches covered, and the installed-wheel package job exercises the conformance runner, manifest generator, and approved-manifest verifier. Fresh review inventory is empty and there are no inline review threads. No merge, self-approval, bypass, default-branch workaround, or gate weakening was attempted.

Central acceptance remains unchanged: provide a qualifying review-only identity distinct from the last pusher and complete the ruleset-mutation RCA; leaf repository administration must separately make main the default branch so ~DEFAULT_BRANCH protection actually covers the integration branch.

[seonghobae]

Fresh ScopeWeave consumer evidence adds a concrete sole-collaborator/last-push deadlock canary. ContextualWisdomLab/scopeweave live ruleset 18156473 requires 1 approving review, dismisses stale approvals, requires approval of the most recent reviewable push, requires thread resolution, and has no bypass actors. The live collaborators API currently returns exactly one human collaborator: seonghobae (admin). On ScopeWeave #545, exact head ef9f9a9912b37946ee340aef26f7f2d62a03e32d is a bot-authored PR (cursor[bot]), but the latest head commit was authored/committed by seonghobae at 2026-08-16T21:05:57Z. The current formal APPROVED review is also from seonghobae (2026-08-17T01:51:56Z). GitHub's documented require_last_push_approval semantics require approval by someone other than the person who made the most recent reviewable push, so this approval cannot solve the live last-push gate by itself. User-authored root PRs such as #506 are even more directly blocked because the sole collaborator is also the PR author/pusher and current automated evidence is not a qualifying independent approval. Please include ScopeWeave as an acceptance canary for the existing review-only identity/bootstrap repair: after the owner fix, a fresh unchanged ScopeWeave head should be able to receive a formal exact-head approval from an authorized non-author/non-last-pusher identity without granting source-write/merge/release authority or weakening the ruleset.

[seonghobae]

Fresh Context Fabric owner-boundary recurrence (2026-08-17 KST): the inherited organization ruleset 18156473 has weakened again after the 13:xx fail-closed stability sample. Two independent child-repository reads agree: ContextualWisdomLab/context-graph-contracts and ContextualWisdomLab/enterprise-architecture-core both currently apply the same seven required .github/main workflows plus deletion/non-fast-forward protection to bootstrap/root, but the pull-request rule is now required_approving_review_count=0, dismiss_stale_reviews_on_push=true, require_last_push_approval=false, and required_review_thread_resolution=false. Both repositories still report default_branch=bootstrap/root; applied rules for their integration branch main remain exactly [].

This is a fourth observed regression class after the earlier 03:58 / 07:47 / 11:02 oscillations and the 11:33 restoration / 13:xx stability sample. Context Fabric will not exploit the weakened review rule to merge. Please advance the existing central RCA from one-off restoration to removal of the causal recurring writer/synchronization path: identify the new mutation actor/change receipt in organization Audit Log / Rule Insights, correlate it with the prior toggles, and disable or repair the human/automation/policy-sync source that is repeatedly rewriting review fields.

Acceptance remains fail-closed: restore required_approving_review_count=1, latest-push approval, and review-thread resolution while preserving stale-review dismissal, all seven deterministic required workflows, deletion/non-fast-forward protection, and existing bypass posture; then prove stability across repeated fresh child-repository reads. Retain the separate review-only independent-reviewer canary and default-branch remediation. Leaf products must not compensate with source changes, self-approval, direct merge, force updates, or weaker gates.