[Fleet incident] Disable orphaned candidate-repair and one-shot workflow identities

[seonghobae]

Live Actions registry drift

The repository's Actions API currently reports 34 workflow identities. Numerous historical candidate-repair, apply, export/publish, lock-refresh, timeout-repair, and one-shot records remain in state: active, including examples such as:

• apply-coderabbit-hourly-development-fixes.yml;
• apply-final-candidate-cleanup.yml;
• apply-outbound-redirect-policy.yml;
• final-candidate repair export/publish/cleanup workflows;
• one-shot-noema-mode-metadata-repair.yml;
• package/undici lock refresh workflows;
• hourly product timeout repair workflows.

Fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/one-shot-noema-mode-metadata-repair.yml. The source is absent, but GitHub still advertises the workflow identity as active.

The supported ci, cd, central-review, hourly-commercial-readiness, Hourly NVIDIA NIM Product Development, maintainer-app readiness, patch-validator image, readiness/release evidence, and current security workflows must be preserved. The central Noema OIDC envelope issue is tracked separately in .github#834.

Root cause

Temporary candidate and product-loop repair workflows were removed from the protected-main tree after their bounded use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level tests cannot detect orphaned control-plane identities after source removal.

Realistic remediation

Noema remains read-only to the fleet incident because its dedicated owner loop is enabled. Under that owner path:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected-main SHA and tree;
3. classify present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intended pending supported integrations, and unresolved records;
4. refetch exact branch/workflow state immediately before mutation;
5. disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
6. preserve all current supported CI/CD/review/hourly/NIM/security workflows;
7. retain immutable before/after evidence.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not add another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority to an untrusted scanner.

Acceptance criteria

• complete paginated inventory and exact protected-main binding;
• every reviewed active repository-path workflow absent from protected main disabled or explicitly justified;
• no current CI/CD/review/hourly/NIM workflow disabled through name-only matching;
• no historical candidate-repair source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a currently present bounded repair still owned by an active PR;
• exact-head CI/security/review gates;
• normal protected-main integration;
• post-remediation live inventory proves orphan identities disabled while supported Noema review and Hourly NVIDIA NIM Product Development remain operational.

This issue belongs to the organization-wide Hourly Product Development fleet incident.