Invalidate stale lifecycle status after linked issue metadata changes

[proerror77]

Parent

#455

Change contract

Keep the required Issue Lifecycle result on every open pull-request head synchronized with the current linked-issue metadata, using only the trusted default-branch auditor and a narrowly scoped status writer.

Acceptance criteria

• Relevant issue metadata changes that emit supported GitHub Actions issue events (body, category/triage labels, assignee, open/closed state) trigger immediate trusted default-branch reconciliation.
• The run enumerates open pull requests, invokes the merged auditor for each PR, and maps auditor exit 0 / 1 / 2 to the exact Issue Lifecycle commit status success / failure / error; both non-zero outcomes are red.
• The exact Issue Lifecycle context has one writer: Run the lifecycle auditor as a read-only GitHub check #467 keeps the distinct, non-required Issue Lifecycle Audit check name, and no Actions job/check run emits the authoritative context.
• An unfiltered issue trigger handles emitted issue activity; scheduled and manual full reconciliation catch Projects V2 field and native relationship changes that do not emit a supported Actions event, and auditor errors fail closed instead of preserving stale green.
• Trusted pull_request_target events seed each opened, reopened, synchronized, edited, or ready-for-review PR head without checking out or executing PR-head code.
• One repository-wide cancel-in-progress concurrency group prevents an older reconciliation run from overwriting newer lifecycle results.
• The workflow never checks out or executes pull-request code and never accepts a policy implementation from a PR head.
• Status-write permission is limited to the reconciliation job; contents, issues, and pull requests remain read-only.
• A focused test proves an issue mutation can replace a prior green PR-head status with failure and restore it after metadata repair.
• A live canary on a non-production PR demonstrates green -> metadata violation -> red -> repair -> green before Enable the Issue Lifecycle required check after a green observation window #460 changes branch protection.

Blocked by

#467 must merge first so the trusted read-only auditor entrypoint exists on the default branch.

Out of scope

• Historical metadata reconciliation; that remains Reconcile existing GitHub issue metadata against the lifecycle contract #459.
• Adding the context to branch protection; that remains Enable the Issue Lifecycle required check after a green observation window #460.
• Changing lifecycle policy or issue publication semantics.
• Closing runtime or tracking issues without acceptance evidence.

Rollout / rollback

Roll out with one canary PR and one named controller. Roll back by disabling the status-reconciliation workflow; do not alter existing branch protection until the canary has passed.

[proerror77]

Completion evidence

Acceptance checks: PR #596 merged to main at 69e42c1, canary PR #597 was zero-file-change and closed unmerged at 2026-08-02T07:29:48Z with base 69e42c1 and head ea439a5, initial run https://github.com/proerror77/monday/actions/runs/30737776622 and status 51498650568 were success, temporary needs-info produced run https://github.com/proerror77/monday/actions/runs/30737814805 and status 51498667821 failure with the sole violation Issue #480 expected exactly one triage state label found needs-info and ready-for-agent, removing needs-info produced run https://github.com/proerror77/monday/actions/runs/30737886034 and status 51498701099 success, #480 labels read back enhancement and ready-for-agent, native blocker #467 read back CLOSED, no lifecycle run is active, no open pull request remains, branch protection and #460 are unchanged.
Named controller: /root/luna_480_resume
Cleanup evidence: Temporary needs-info was removed, canary PR #597 is closed unmerged, the clean canary worktree and local and remote branch are intentionally retained because no deletion authorization exists.
Result: passed