[Fleet incident] Govern orphaned GitHub Actions workflow lifecycle organization-wide

[seonghobae]

Systemic fleet defect

Live Actions inventories now prove the same recurrence mechanism in multiple ContextualWisdomLab repositories:

• appguardrail: 42 registered workflows, including numerous historical apply-*, finalize-*, and *-once.yml identities still reported as state: active although sampled paths return 404 on the protected default branch (appguardrail#929);
• clearfolio: 23 registered workflows, including several one-shot-*, PR-specific reconciliation, and repair identities still active although sampled source paths are absent (clearfolio#423);
• disksage: 54 registered workflows, including many PR-specific/one-shot/finalizer identities still active although sampled source paths are absent (disksage#191).

This is not isolated repository clutter. The organization has repeatedly used temporary branch-writing/finalizer workflows, deleted their YAML after use, and assumed source deletion completed the workflow lifecycle. GitHub persists workflow registry records independently, so deleted source paths can remain advertised as active identities.

Root cause

The central governance model validates repository trees and workflow source, but it does not reconcile the GitHub Actions control-plane registry against the exact protected default-branch tree. No organization-level invariant currently requires:

active repository workflow identity
=> source file exists on exact protected default branch
   OR explicit reviewed exception

Consequently the fleet cannot reliably answer which workflow writers are genuinely enabled, and file-only tests cannot detect orphaned registry state.

Required central architecture

Implement a centrally owned, read-only-first workflow lifecycle inventory using the existing organization GitHub App/OIDC authority rather than a new PAT. It should:

1. enumerate every visible non-archived organization repository with pagination;
2. resolve each exact default-branch SHA;
3. paginate each repository's Actions workflow registry;
4. distinguish repository-path workflows from GitHub-owned dynamic workflows;
5. check exact source-file presence on the resolved default-branch SHA;
6. classify records as present_active, present_disabled, orphan_active, orphan_disabled, dynamic_owned, or unresolved;
7. emit immutable evidence with repository, workflow ID, name, path, state, default-branch SHA, observation time, and API-pagination receipts;
8. fail closed on incomplete visibility, 403/404 ambiguity, pagination truncation, or branch movement;
9. open/update bounded repository issues for orphan_active findings through existing governance;
10. permit disablement only in a separate reviewed operator step or explicit bounded central action after exact evidence is revalidated.

Do not recreate deleted workflows, add a temporary self-deleting cleanup workflow, or give an untrusted scanner workflow organization-wide write authority.

Prevention policy

Add a central reusable contract for repository workflows and AppGuardrail integration so that future bounded repair workflows must either:

• be implemented through a normal branch/PR and deleted before merge without ever becoming a protected-default-branch workflow identity; or
• include an explicit lifecycle owner, expiry condition, and post-use registry-disable action verified through a normal reviewed control-plane path.

A source file named once is not alone proof of invalidity; classification must be evidence-based. Conversely a benign name must not hide branch-writing or workflow-state mutation.

Acceptance criteria

• complete paginated inventory of every visible eligible repository;
• exact default-branch SHA binding and branch-movement retry/abort behavior;
• no conflation of GitHub dynamic workflows with deleted repository files;
• all known active orphan identities in AppGuardrail, Clearfolio, and DiskSage routed to their owner issues and ultimately disabled;
• no production scheduled, reusable, security, release, Dependabot, or GitHub-owned workflow disabled by heuristic name matching;
• tests cover partial pagination, API permission loss, transient 404/5xx, default-branch changes, path case/encoding, renamed workflows, reused workflow IDs, and active files with one-shot-like names;
• AppGuardrail detects the same control-plane class from live evidence;
• protected-main central integration through normal review/check policy;
• a post-integration organization sweep produces a reproducible ledger and demonstrates that the known orphan records are no longer active;
• no COPILOT_GITHUB_TOKEN, guessed PAT, or broad secrets: inherit is introduced.

This issue is part of the Hourly Product Development fleet incident. The central .github dedicated writer loop owns implementation; repository fleet audit remains read-only and tracks downstream operational evidence.

[seonghobae]

Additional confirmed blast radius

Fresh repository-specific inventory extends the proven recurrence beyond the initial three repositories:

• pg-erd-cloud: 52 workflow identities; multiple active apply-pr-*, autofix-pr-*, bootstrap-*, cleanup-*, probe and PR-specific repair records. Protected-main contents lookup returns 404 for sampled apply-pr-696-review-fixes-v4.yml. Owner issue: ContextualWisdomLab/pg-erd-cloud#865.
• bandscope: 44 workflow identities; multiple active bootstrap, finalizer, diagnosis and PR-specific records. Protected-default-branch contents lookup returns 404 for sampled bootstrap-handoff-import.yml. Owner issue: ContextualWisdomLab/bandscope#847.
• clearfolio: its active hourly-product-development.yml identity is itself absent from protected main; recorded runs are feature-branch push runs from Draft Guard OpenCode approval with commit check-runs #271, so it must be classified as an orphan pending intended supported integration rather than as proof of an operating schedule.

The central solution must therefore preserve owner intent as well as source presence. An active absent identity may be:

1. a completed temporary writer that should be disabled;
2. a production workflow awaiting normal protected-branch integration and therefore not yet operational;
3. an unresolved/ambiguous record requiring owner review.

Do not auto-disable solely from path absence or naming. The inventory should open/update exact owner issues and require a second exact-state/intent check before any disablement.

[seonghobae]

Critical scope update: the central control plane itself has 256 workflow identities

Fresh live Actions inventory for ContextualWisdomLab/.github reports 256 workflow records. Many historical bootstrap, apply, finalizer, cleanup, branch-patch, and PR-specific records are still state: active, including examples such as:

• bootstrap-npm-workspace-wiring.yml;
• bootstrap-org-sweep-pr.yml;
• bootstrap-pr608-fixes.yml;
• bootstrap-trusted-uv-materializer.yml;
• apply-pr782-artifact.yml;
• apply-pr785-hash-boundary.yml;
• agent-mention-payload-binding-finalize.yml;
• numerous historical cleanup/patch/finalizer identities.

A fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/bootstrap-npm-workspace-wiring.yml. The source is absent, while the central workflow registry still advertises it as active.

This elevates the issue from downstream repository hygiene to a central control-plane integrity incident. The central repository cannot serve as authoritative fleet workflow inventory until its own registry is reconciled.

Additional constraints

• Inventory and remediation must be paginated beyond the first 100 records; total_count=256 proves a single-page implementation is incomplete.
• The central sweep must distinguish live required/reusable workflows from deleted repair identities and GitHub-owned dynamic workflows.
• Before disabling any central record, re-fetch exact protected-main SHA, path presence, current workflow state, and known caller references. A deleted central reusable workflow identity may still be pinned by leaf repositories; those callers need a supported migration path rather than a silent disablement.
• Preserve current agent-mention-*, required review/security, merge-scheduler, ruleset-audit, documentation-quality, and other supported control-plane workflows.
• Do not grant the read-only inventory job organization-wide disable authority. Disablement remains a separate reviewed operator phase.

Acceptance now requires central self-reconciliation plus the downstream owner issues already linked. A fleet sweep that omits the second and third workflow pages is a false success.

[seonghobae]

Further confirmed fleet blast radius

Additional live repository inventories and protected-default-branch source checks confirm the same lifecycle defect in five more repositories:

• fast-mlsirm: 102 workflow records; sampled active apply-reviewed-ho-mc-source-fix.yml is absent from protected main. Owner issue fast-mlsirm#809. The supported read-only Hourly PR Queue Governance workflow remains present and its scheduled run 31585657618 succeeded, so it must be preserved.
• naruon: 99 records; sampled active bootstrap-update-disksage-v4.yml is absent from protected develop. Owner issue naruon#1324.
• contextual-orchestrator: 28 records; sampled active one-shot-nim-default-request-cap.yml is absent from protected main. Owner issue contextual-orchestrator#122.
• inkspan: 48 records; sampled active apply-preparse-envelope-limits.yml is absent from protected main. Owner issue inkspan#278.
• newsdom-api: 22 records; sampled active one-shot-finalize-review-fixes.yml is absent from protected develop. Owner issue newsdom-api#604.

The central inventory must now support repositories whose default branch is not main, distinguish current supported evidence/read-only workflows from deleted writers, and explicitly handle repositories with more than 100 records. The recurrence mechanism is organization-wide and cannot be closed by sampling a few high-profile repositories.

[seonghobae]

Additional confirmed owner repository

ContextualWisdomLab/codec-carver now joins the proven blast radius:

• live registry: 19 workflow records;
• sampled active rebuild-pr-317-clean.yml is absent from protected main;
• several PR-specific rebuild/repair identities remain active;
• owner issue: codec-carver#401.

Preserve CI, fuzzing, Dependabot, CodeQL, and GitHub-owned dynamic agent workflows. This further confirms that lifecycle classification must use exact source presence and owner intent rather than workflow names.

[seonghobae]

Expanded live blast radius and near-complete first-pass repository sweep

Fresh Actions-registry versus exact-default-branch checks now confirm the same orphan-workflow lifecycle defect in additional active product repositories:

• OriginWeave: 37 records; sampled active format-pr1-once.yml absent from protected main. Owner issue OriginWeave#123.
• ThreadWeave: 27 records; sampled active apply-pr20-concurrency-fix.yml absent from protected main. Owner issue ThreadWeave#31.
• RankWeave: 30 records; sampled active apply-hourly-loop-repair.yml absent from protected main. Owner issue RankWeave#38.
• DiagramWeave: 31 records; sampled active one-shot-definition-docs.yml absent from protected main. Owner issue DiagramWeave#27.
• EgressWeave: 23 records; sampled active merge-main-pr39.yml absent from protected main. Owner issue EgressWeave#202.
• four-pillars: 23 records; sampled active one-shot-calendar-repair.yml absent from protected main. Owner issue four-pillars#33.
• keyverse: 42 records; sampled active bootstrap-federation-preflight.yml absent from protected main. Owner issue keyverse#99.
• noema: 34 records; sampled active one-shot-noema-mode-metadata-repair.yml absent from protected main. Owner issue noema#226.
• saju-caldav: active regenerate-radicale-runtime-lock.yml absent from protected main. Owner issue saju-caldav#33.
• scopeweave, semantic-data-portal, xtrmLLMBatchPython, and EmbedRelay have also received exact owner findings; EmbedRelay additionally has a normal retirement PR removing a live protected-main branch-writing materializer.

The first-pass sweep also found clean/small registries in repositories whose inventories contain only current repository workflows and GitHub-owned dynamic identities. Therefore the central implementation must record both positive and negative evidence rather than assuming every repository is affected.

Required central data model refinement

A binary present/orphan flag is insufficient. The fleet now contains at least these states:

1. present_supported_active — current production workflow, e.g. DiagramWeave/ThreadWeave hourly paths;
2. orphan_active_retire — completed temporary writer, source absent, owner confirms disablement;
3. orphan_active_pending_integration — intended production workflow exists only on an active PR, e.g. Clearfolio hourly development;
4. present_temporary_active_pr_owned — bounded repair source still present and attached to live work;
5. dynamic_github_owned — CodeQL, Dependabot, Pages, Copilot/agent identities with no repository path;
6. disabled_historical;
7. unresolved_visibility_or_race — incomplete pagination, permission loss, branch movement, or ambiguous 404/403/5xx.

Disablement must require an exact second refetch plus owner intent and caller-impact analysis. In particular, central deleted reusable-workflow identities may still be pinned by leaf repositories; caller migration must precede disablement. A read-only detector should never hold organization-wide mutation authority.

The systemic RCA is now strongly supported across repositories with main, develop, and legacy default branches, registries above 100 records, and both current and historical hourly/product workflows. Closure requires a complete paginated organization ledger, owner-path remediation, central self-reconciliation of its 256 records, and post-disablement operational proof that supported hourly/review/security/release workflows still run.

[seonghobae]

BandScope downstream evidence is now complete for this fleet class. Against protected ContextualWisdomLab/bandscope develop@acdbea6344fe1231c39535b575f4de35e4c607c9, the live Actions registry was paginated to 59 active identities (20 + 20 + 19). Exact-tree reconciliation yields 10 present repository workflow sources, 7 GitHub-owned dynamic/* identities, and 42 active repository-path identities whose exact source path is absent from that protected tree. The full workflow-ID → path ledger and revalidation caveats are recorded on bandscope#847 (comment 5305656768).

The BandScope pass remained read-only, as required here: no registry state was mutated. The ledger deliberately classifies by exact path presence rather than workflow-name heuristics. Two entries (dependency-review.yml and opencode-review.yml) especially require provider-ownership revalidation immediately before an authorized disable because current required checks with similar names may now be centrally supplied even though the stale repository workflow identity/path is absent. The operator step should refetch workflow ID/state, exact protected default-branch SHA/tree, and provider ownership immediately before each mutation, then publish a complete after-inventory proving supported CI/security/release/dynamic workflows remain intact.

[seonghobae]

Fresh Inkspan owner evidence adds ContextualWisdomLab/inkspan#278 to this fleet class. On protected inkspan/main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03, the Actions registry currently reports 63 workflow identities. Workflow id 326648609 (.github/workflows/apply-preparse-envelope-limits.yml) remains state: active, while an exact contents read of that path at the protected SHA returns 404. Inkspan #278 owns repository-level operational remediation; this central issue should include Inkspan in the read-only inventory/ledger and lifecycle-prevention acceptance. Do not disable by name heuristic: revalidate each workflow id/path/state against the exact protected tree immediately before any reviewed operator mutation.

[seonghobae]

BandScope exact-evidence refresh — live dynamic-path contract and expanded orphan blast radius

Fresh BandScope evidence on 2026-08-17 materially updates the earlier #847 handoff:

• protected default branch remains develop@acdbea6344fe1231c39535b575f4de35e4c607c9;
• the live Actions registry now reports 59 workflow identities (the earlier central comment recorded 44);
• protected develop contains only the current checked-in workflow set, while many historical bootstrap/finalizer/repair identities remain state: active with paths absent from that exact tree;
• the live GitHub API also proves GitHub-managed workflows are represented without a separate source field, using paths such as:
  • dynamic/agents/anthropic-code-agent;
  • dynamic/agents/openai-code-agent;
  • dynamic/dependabot/dependabot-updates;
  • dynamic/dependabot/update-graph;
  • dynamic/github-code-scanning/codeql.

This matters to the central contract: a classifier that depends on a synthetic source == github field will falsely label real GitHub-managed identities as unresolved. Conversely, accepting an arbitrary source: github field as an ownership override is unsafe because registry input is untrusted and it could mask an absent repository workflow. The reliable observed discriminator is the API's dynamic/ path namespace, while any other active non-.github/workflows/*.yml|yaml path should fail closed unless separately proven.

BandScope PR #895 now carries a repository-owned read-only detector and two regression layers for this exact contract. Current exact head 7f1e5cae02f497b58c51744e596633f8d3a95e20:

1. recognizes a real-shaped dynamic/agents/openai-code-agent record with no source field as GitHub-managed;
2. rejects forged source: github metadata on an absent .github/workflows/deleted-repair.yml record and still classifies it as an orphan;
3. keeps unknown external/... active paths unresolved.

Actual organization-wide inventory and disablement authority remain owned here; BandScope does not add privileged cleanup or suppress the control-plane defect.

Central acceptance tests added by this evidence

• {id: 297018635, name: "OpenAI Codex", path: "dynamic/agents/openai-code-agent", state: "active"} with no source field must classify as GitHub-owned dynamic evidence, never orphan_active and never an unresolved repository-path failure.
• {id: 1, name: "workflow", path: ".github/workflows/deleted-repair.yml", state: "active", source: "github"} with that path absent from the exact protected tree must remain an orphan; auxiliary metadata cannot override path/tree authority.
• An active unknown path such as external/workflows/example must fail closed pending explicit ownership evidence.