[Fleet incident] Disable orphaned federation and product-loop bootstrap workflow identities

[seonghobae]

Live Actions registry drift

The repository's Actions API currently reports 42 workflow identities. Numerous historical federation, OIDC, OpenCode product-loop, dependency-refresh, coverage, and desired-state bootstrap records remain in state: active, including examples such as:

• bootstrap-federation-preflight.yml and URL-hardening variants;
• bootstrap-finalize-coverage.yml;
• the OpenCode product-loop finalization/reconciliation bootstrap series;
• bootstrap-https-review-remediation.yml;
• OIDC federation preflight versions through v5;
• bootstrap-upgrade-cryptography.yml;
• one-shot dependency-refresh/consolidation workflows;
• historical desired-state and coverage materializers.

Fresh protected-main contents lookup returns 404 Not Found for sampled active path .github/workflows/bootstrap-federation-preflight.yml. The source is absent, but GitHub continues to advertise the workflow identity as active.

The supported ci, CodeQL, Hourly PR steward, and Hourly product development workflows must be preserved. PR #74's egress repair is already on protected main; this issue tracks a separate workflow-lifecycle defect.

Root cause

Temporary federation and product-loop bootstrap workflows were removed from the protected-main tree after their bounded use, while their independent GitHub Actions registry records were not disabled. File deletion was treated as complete workflow lifecycle cleanup. Current tree-level tests cannot detect orphaned control-plane identities after source removal.

Realistic remediation

Keyverse remains owned by the enabled general CWL Autonomous Development writer lease. The fleet incident loop must remain read-only and must not race it. Under that owner path:

1. paginate the complete Actions registry;
2. bind evidence to the exact protected-main SHA and tree;
3. classify present repository workflows, active orphan records, disabled records, GitHub-owned dynamic workflows, intended pending supported integrations, and unresolved records;
4. refetch exact branch/workflow state immediately before mutation;
5. disable active orphan repository-path identities through an authorized operator or normal reviewed control-plane action;
6. preserve all current supported CI/security/hourly workflows;
7. retain immutable before/after evidence.

Coordinate with central lifecycle issue ContextualWisdomLab/.github#945 and AppGuardrail detector issue ContextualWisdomLab/appguardrail#929. Do not add another PAT, COPILOT_GITHUB_TOKEN, broad secrets: inherit, or workflow-disable authority to an untrusted scanner.

Acceptance criteria

• complete paginated inventory and exact protected-main binding;
• every reviewed active repository-path workflow absent from protected main disabled or explicitly justified;
• no current CI/security/hourly workflow disabled through name-only matching;
• no historical federation/product-loop bootstrap source reintroduced;
• read-only recurrence detector emits workflow ID, path, state, default-branch SHA, observation time, and pagination receipts;
• adversarial tests cover pagination truncation, permission loss, transient 403/404/5xx, branch movement, path case/encoding, renamed/reused workflow IDs, GitHub dynamic workflows, and a currently present bounded bootstrap still owned by an active PR;
• exact-head CI/security/review gates;
• normal protected-main integration;
• post-remediation live inventory proves orphan identities disabled while supported Hourly PR steward and Hourly product development remain operational.

This issue belongs to the organization-wide Hourly Product Development fleet incident.

[seonghobae]

Related control-plane drift found during the 2026-08-20 PR queue audit (separate from the orphaned identity cleanup): active ruleset CWL Central required workflows (ID 18156473) requires .github/workflows/close-empty-pr.yml, opencode-review.yml, pr-review-merge-scheduler.yml, security-scan.yml, strix.yml, sast-semgrep.yml, and noema-review.yml from main, but main currently contains only ci.yml, codeql.yml, hourly-pr-steward.yml, and hourly-product-development.yml. The required workflow paths return 404 from the repository Contents API, while new PR runs still create queued check contexts for those deleted workflow identities; run view/watch also returns 404 for the queued workflow run. This leaves protected PRs waiting on non-existent workflow definitions. Acceptance: reconcile the ruleset required-workflow paths with active main workflow definitions through the authorized control-plane owner, or restore equivalent definitions through a normal reviewed PR; then verify a fresh exact-head PR reaches terminal required checks. Do not transfer historical green checks or bypass protection.

[seonghobae]

Correction to the previous audit note: repository ID 1274066402 in ruleset 18156473 resolves to ContextualWisdomLab/.github, not ContextualWisdomLab/keyverse. The seven required workflow source files do exist in the central .github repository, so their absence from Keyverse main is expected and is not by itself ruleset drift. The remaining observed symptom is narrower: Keyverse PR #100 exact-head required-workflow run 32356529260 (workflow identity 309130044) is queued, its target-repository workflow view returns 404, and its job remains queued; this requires central required-workflow execution tracing, not restoring local stubs. No protected setting was changed.

[seonghobae]

Keyverse exact workflow-lifecycle evidence - 2026-08-20

Read-only complete registry/tree reconciliation against protected main:

• exact protected main SHA: ce207df;
• Actions registry: 43 workflow identities, all 43 active;
• exact protected tree contains 4 active repository-path identities: ci.yml, codeql.yml, hourly-pr-steward.yml, hourly-product-development.yml;
• 37 active repository-path identities have no source at that exact tree SHA;
• 2 active dynamic/* identities are classified as GitHub-owned dynamic workflows, not deleted repository files.

No workflow state was mutated. The 37 missing repository paths are evidence for the authorized lifecycle owner to classify and revalidate by workflow ID immediately before any disablement; supported CI/security/hourly paths remain preserved. This is registry/tree evidence only and does not alter the Keyverse protected merge gate.