ops(review): reconcile scheduler inventory with trusted dispatch allowlist

[seonghobae]

Incident

The protected-main organization queue sweep enumerates every active organization repository, but the central OpenCode receiver independently requires the exact repository variable OPENCODE_REPOSITORY_DISPATCH_TARGETS. The two control planes have drifted.

Protected central revision: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

Exact first failing boundaries

• Run 31576674633, job 94050250502: ContextualWisdomLab/9drive#1@8430d78d0c706a0087453e76a8abd94ba4827309 was rejected because ContextualWisdomLab/9drive is absent from the exact allowlist.
• Run 31576329826, job 94049176239: ContextualWisdomLab/argos#425@e40e96c1ce284c1ef490ed9fb30e152d6906ea10 failed at the same boundary.

Actor and sender both matched the configured github-actions[bot] scheduler identity. No source checkout, coverage execution, model secret materialization, or semantic review occurred. These are trusted-dispatch configuration failures, not findings against either target head.

Root and systemic causes

• Immediate cause: both canonical repository names are missing from OPENCODE_REPOSITORY_DISPATCH_TARGETS.
• Technical root: the sweep discovers active repositories dynamically while the receiver uses an operator-maintained exact allowlist.
• Control root: repository creation/enrollment has no atomic contract that updates or intentionally excludes the trusted dispatch list before the fleet sweep reaches the repository.

Required operator action

Repository/organization automation administrator:

1. Verify the OpenCode App and mutation credential are intentionally authorized for each repository.
2. Add only the approved canonical full_name values to OPENCODE_REPOSITORY_DISPATCH_TARGETS; do not broaden to a wildcard.
3. Re-read the variable and the live PR snapshots, then dispatch bounded exact-head review retries.
4. Accept only runs where validate-pr-metadata succeeds and downstream current-head coverage/review evidence is produced.

Durable prevention acceptance

Add a fail-closed enrollment audit that compares the dynamic active-repository inventory with the explicit trusted allowlist and reports approved, intentionally_excluded, or configuration_drift before dispatch. It must not silently authorize new repositories, weaken the actor/sender check, or convert policy/configuration failures into semantic source findings.