fix(operations): audit orphaned Actions workflow identities

[seonghobae]

Buyer and control-plane incident

Issue #31 proves that protected main contains four supported workflow sources while the live GitHub Actions registry reports 27 identities, including historical PR #20 repair, bootstrap, diagnosis, and finalizer paths that remain state: active after their YAML was deleted. Source deletion is therefore not complete workflow lifecycle cleanup.

This PR adds a read-only, exact-revision lifecycle audit. It does not restore historical repair workflows, disable workflow records, add an Actions-write credential, change release blocker #17, or weaken PR #20's post-release integration gate.

GREEN: complete implementation

Exact contributor head: c005f29f3b56625ba039c2ea94e69d80ab512989
Exact protected-main parent: e10bbd8939a249f67ffec7253dfcee667178e7fb

scripts/ci/actions_registry_audit.py now implements the complete committed design:

• exact repository/SHA/workflow-path identity validation (normalize_repository, normalize_sha, normalize_workflow_path, including NFC/traversal/duplicate-separator rejection);
• complete, verified pagination for the workflow registry and open same-repository pull requests, with total-count agreement, repeated-page rejection, and a hard page cap;
• exact protected-main and PR-head Git tree reads, failing closed on a truncated tree;
• the seven-way finite classification model (present_active, present_disabled, active_pr_workflow, orphan_active, orphan_disabled, dynamic_owned, unresolved);
• a start/end protected-main SHA revalidation so a branch move mid-audit is detected rather than silently bound to stale evidence;
• deterministic, schema-versioned (threadweave.actions-registry-audit/v1) JSON evidence with an atomic writer;
• a strict GitHubJsonClient: bounded response size, duplicate-JSON-key rejection, https-only scheme enforcement, and token-redacted diagnostics.

.github/workflows/actions-registry-audit.yml runs the detector with exactly actions: read, contents: read, and pull-requests: read — no mutation authority — on protected-main changes to the detector, on manual dispatch, and hourly at minute 53. It deliberately does not run on pull_request: the audit is meant to fail visibly on a genuine live orphan, and while any real orphan remains undisabled (which is currently true — see below) that would make it a permanently red check on every unrelated PR. tests/test_actions_registry_audit.py already provides exact PR-time contract coverage of the detector itself through ci.yml.

ADR-0010 records the observation/disable-authority separation and is wired into docs/adr/README.md, docs/TRACEABILITY.md, docs/INCIDENT_RUNBOOK.md, docs/THREAT_MODEL.md, docs/TEST_STRATEGY.md, and docs/operations/hourly-autonomous-maintenance.md.

Verification

• 103 tests in tests/test_actions_registry_audit.py (+ 9 in tests/test_actions_registry_audit_workflow.py locking the workflow's trigger/permission/pin contract), exact 100% statement/branch coverage, 100% docstring coverage via tests/test_autonomous_documentation.py.
• Ran the detector locally against ThreadWeave's actual live registry: it reproduces issue [Fleet incident] Disable orphaned PR 20 repair and hourly-diagnostics workflow identities #31 exactly — 21 confirmed orphan_active records (every one a named PR feat: add incremental mailbox threading with stable identity handoff #20 repair/bootstrap/finalizer workflow from the incident), 4 present_active, 1 active_pr_workflow (this PR's own new workflow), 2 dynamic_owned.
• Full repository suite green (405+ tests), Ruff/compileall/actionlint/Semgrep clean.

Numbering note

The original design doc reserved "ADR-0009" for this decision; ThreadWeave#34 claimed ADR-0009 for the LineageWeave/naruon consumer boundary first (merged independently, unrelated topic). This PR's decision is recorded as ADR-0010 instead, with the design/plan docs' cross-references updated to match.

Authority and dependency boundary

Protected-main integration is still intermediate: issue #31 closes only after an authorized operator independently revalidates the exact live ledger, disables only confirmed active orphan IDs through the GitHub Actions lifecycle API, preserves ci, Hourly PR Maintenance, Hourly Product Development, Release ThreadWeave, and Actions Registry Audit, and records before/after evidence. This PR only produces the evidence; it does not perform that disablement.

Related: ThreadWeave #31, ContextualWisdomLab/.github#945, ContextualWisdomLab/appguardrail#929.

Summary by CodeRabbit

• 새 기능

  • GitHub Actions 레지스트리를 매시간 또는 수동으로 점검하는 읽기 전용 감사 기능을 추가했습니다.
  • 워크플로 상태를 7개 범주로 분류하고, 고립된 활성 워크플로 ID에 대한 비활성화 권고를 JSON 보고서로 제공합니다.
  • 감사 결과를 실행 성공 여부와 관계없이 최대 90일간 보관합니다.
  • 실제 워크플로 비활성화 없이 최소 읽기 권한으로 안전하게 실행됩니다.

• 문서

  • 사고 대응 절차, 운영 가이드, 위협 모델 및 변경 기록을 업데이트했습니다.

• 품질 개선

  • 브랜치·워크플로·PR 상태 변경과 비정상 응답을 감지해 안전하게 실패하도록 검증을 강화했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in:41 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4958545a-1902-4dfa-8083-42cadb14ce0d

📥 Commits

Reviewing files that changed from the base of the PR and between 78ac1a6 and 91a0535.

📒 Files selected for processing (2)

• scripts/ci/actions_registry_audit.py
• tests/test_actions_registry_audit.py

📝 Walkthrough

Walkthrough

읽기 전용 Actions 레지스트리 감사기, 예약 워크플로, 결정적 JSON 보고서, fail-closed 테스트 및 운영 문서를 추가했습니다. 감사기는 보호된 main과 동일 저장소 PR head를 기준으로 workflow identity를 분류합니다.

Changes

Actions 레지스트리 감사

Layer / File(s)	Summary
감사 계약과 분류 scripts/ci/actions_registry_audit.py, tests/test_actions_registry_audit.py, docs/superpowers/specs/..., docs/superpowers/plans/...	저장소, SHA, workflow 경로와 API 응답을 엄격히 검증합니다. 레지스트리 항목을 7개 분류로 나눕니다.
스냅샷 수집과 보고서 생성 scripts/ci/actions_registry_audit.py, tests/test_actions_registry_audit.py	레지스트리, 동일 저장소 PR head, Git tree를 수집합니다. main SHA, workflow inventory, PR snapshot drift와 잘린 응답을 거부합니다. 결정적 JSON 보고서를 원자적으로 기록합니다.
HTTP 클라이언트와 CLI scripts/ci/actions_registry_audit.py, tests/test_actions_registry_audit.py	HTTPS, 토큰, 응답 크기, UTF-8, 중복 JSON 키와 쿼리 인코딩을 검증합니다. CLI는 감사 결과와 오류에 따라 종료 코드를 반환합니다.
워크플로와 품질 게이트 .github/workflows/actions-registry-audit.yml, .github/workflows/ci.yml, tests/test_actions_registry_audit_workflow.py, tests/test_autonomous_documentation.py, tests/test_workflows.py, .gitignore	시간별·수동 감사 워크플로를 추가합니다. actions: read, contents: read, pull-requests: read 권한만 사용합니다. 커버리지와 계약 검사를 CI에 연결합니다.
운영 및 거버넌스 문서 docs/adr/*, docs/operations/*, docs/INCIDENT_RUNBOOK.md, docs/TEST_STRATEGY.md, docs/THREAT_MODEL.md, docs/TRACEABILITY.md, CHANGELOG.md	감사 결과 확인과 실제 workflow 비활성화 권한을 분리하는 운영 절차와 ADR-0010을 기록합니다.

Estimated code review effort: 5 (Critical) | ~90+ minutes

Merge Risk:🔵 Low · up to 78ac1

The PR adds a read-only hourly audit, but malformed workflow records may not be included in drift detection and high pull-request volumes could increase API rate-limit pressure without telemetry. The change is mergeable with explicit owner awareness and follow-up on these bounded risks.

Sequence Diagram(s)

sequenceDiagram
participant Scheduler_or_Operator
participant Actions_Registry_Audit_Workflow
participant actions_registry_audit_py
participant GitHub_API
participant Evidence_Artifact
Scheduler_or_Operator->>Actions_Registry_Audit_Workflow: 예약 또는 수동 실행
Actions_Registry_Audit_Workflow->>actions_registry_audit_py: audit --repository --output 실행
actions_registry_audit_py->>GitHub_API: registry, PR, tree 조회
GitHub_API-->>actions_registry_audit_py: 검증된 API 응답
actions_registry_audit_py-->>Actions_Registry_Audit_Workflow: 보고서 및 종료 코드 반환
Actions_Registry_Audit_Workflow->>Evidence_Artifact: 감사 보고서 업로드

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.74% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 172 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 고아 GitHub Actions 워크플로 ID를 감사하는 이번 변경의 핵심 목적을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/actions-registry-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

CI passes and the audit detector matches issue #31. Approving for merge.

[devin-ai-integration]

All checks green and remaining informational review threads are resolved.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 91a05358df75b7324025896f8b79a22076202dcd.

• Head SHA: 91a05358df75b7324025896f8b79a22076202dcd

• Workflow run: 32699419292

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (9 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (9 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: actions_registry_audit.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: actions_registry_audit.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (4 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (4 files)"]
R5 --> V5["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 91a05358df75b7324025896f8b79a22076202dcd
• Workflow run: 32699419292
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 91a05358df75b7324025896f8b79a22076202dcd.

• Head SHA: 91a05358df75b7324025896f8b79a22076202dcd

• Workflow run: 32699419292

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (9 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (9 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: actions_registry_audit.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: actions_registry_audit.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (4 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (4 files)"]
R5 --> V5["targeted test run"]

Loading