feat(operations): gate orphan workflow disablement by exact evidence

[seonghobae]

Purpose

Advance #226 with a bounded operator boundary for disabling only GitHub Actions workflow-registry orphans that are proven by exact read-only evidence. This is a pure planner/executor module, not a self-modifying workflow and not a batch mutation engine.

Exact identities

• protected/live base: 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40
• original RED head: acaee82abf54ffbe2f50bb50718438f59d33a3ee
• current restacked GREEN head: 8ed0e9e251db358eaeaf3014e1534003981bf83a
• branch: feat/workflow-registry-disable-plan

GREEN contract

The planner fails closed unless all of the following hold:

• evidence is bound to exact ContextualWisdomLab/noema and the expected protected-main SHA;
• the audit is schema v1, has a canonical UTC observation timestamp, and carries complete sequential pagination receipts;
• the failing audit contains one or more active_orphan_workflow failures and no other failure type;
• every orphan failure resolves one-to-one to one canonical active workflow ID/path;
• the immediate live registry has no duplicate IDs or paths and still matches every candidate exactly;
• workflow paths are owned canonical .github/workflows/*.yml|*.yaml paths.

Passing plans and nested records are frozen and registered as process-local authorities. Serialized clones or reconstructed lookalikes remain evidence but cannot authorize mutation. Execution accepts one exact planned candidate, immediately re-reads its live ID/path/state, invokes only the injected disable primitive for that workflow ID, and returns a frozen mutation receipt.

The module is included in owned production coverage and has adversarial tests for repository/SHA drift, malformed schemas, timestamps and pagination, mixed/empty authority, duplicate or stale identities, unsafe paths, forged plans, serialized clones, unplanned candidates, state changes, and one-at-a-time execution.

Restack and verification boundary

The branch was merged with protected main after #272, #266, and #275. The current merge tree overlays only the planner, its two test files, and the owned-coverage configuration on current protected-main bytes.

Historical RED and predecessor evidence does not transfer. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must complete successfully on unchanged current head 8ed0e9e251db358eaeaf3014e1534003981bf83a before merge. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

No workflow is disabled by this PR, no secret or permission is added, and no repair/self-modifying workflow, protection bypass, version bump, release, or deployment claim is introduced.

Related: #226, #267.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 490d66bc-e588-486e-85a8-bcc368aa9b70

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head 8ed0e9e251db358eaeaf3014e1534003981bf83a against protected base 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40. Verify fail-closed evidence authority, canonical workflow identities, immutable process-local plan authentication, immediate live revalidation, and exactly-one injected disable mutation. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 14 minutes and 17 seconds before sending another message.

[seonghobae]

Superseded by clean current-line successor #308, which preserves the bounded exact-evidence orphan-workflow planner/executor, adversarial tests, and owned-coverage contract. Closing this predecessor; its historical checks/reviews do not transfer.