fix(governance): enforce satisfiable solo-maintainer rulesets

.github/workflows/agent-mention-noema-dispatch.yml

@@ -11,7 +11,6 @@ on:
 concurrency:
   group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
   cancel-in-progress: false
-  queue: max
 
 permissions:
   contents: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -11,7 +11,6 @@ on:
 concurrency:
   group: agent-mention-opencode-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
   cancel-in-progress: false
-  queue: max
 
 permissions:
   contents: read

.github/workflows/agent-mention-router.yml

@@ -24,9 +24,6 @@ jobs:
         contains(github.event.comment.body, '@cwl-noema-review')
         || contains(github.event.comment.body, '@opencode-agent')
       )
-    concurrency:
-      group: review-agent-mention-router-local-${{ github.repository }}
-      queue: max
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

CHANGELOG.md

@@ -35,6 +35,7 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Keep local agent-mention Actions access read-only and remove its replacing concurrency group together with the unsupported `concurrency.queue` key, so every eligible exact-head mention can enqueue while scheduled sweeps remain independently single-flight.
 - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
 - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).
 - Compared the trusted `uv` executable's post-install `--version` output against the real GitHub Releases build's full string, `uv 0.12.1 (x86_64-unknown-linux-gnu)`, instead of the bare `uv 0.12.1` the prior check required; the genuine release binary always prints the target triple, so every installation was failing the pin check immediately after the archive download itself was fixed (ContextualWisdomLab/.github#1109).

README.md

@@ -48,7 +48,7 @@ that means:
 | Mode | What happens |
 | --- | --- |
 | **따로 (this repo alone)** | Clone, test, and operate `.github` as the org profile and workflow source. Local quality gates, Cloudflare dry-run, and this repository's own PRs do not depend on naruon or any sibling product checkout. |
-| **또 같이 (siblings call it)** | A sibling enables the org required-workflow ruleset (already `repository_name.include=["~ALL"]` on default branches). GitHub runs the trusted workflows from `ContextualWisdomLab/.github@main` in that sibling's repository context. Optional reusable callers (`deploy-pages.yml`, `pr-review-fix-scheduler.yml`) are `workflow_call` entry points, not files to copy. |
+| **또 같이 (siblings call it)** | A sibling enables the org required-workflow ruleset (already `repository_name.include=["~ALL"]`, `ref_name.include=["~ALL"]`). GitHub runs the trusted workflows from `ContextualWisdomLab/.github@main` in that sibling's repository context, including stacked PR base branches. Optional reusable callers (`deploy-pages.yml`, `pr-review-fix-scheduler.yml`) are `workflow_call` entry points, not files to copy. |
 
 Do not copy Strix, OpenCode, Noema, or scheduler workflow files into a
 sibling to "satisfy CI." Thick downstream sync PRs are an anti-pattern
@@ -61,12 +61,13 @@ Live work and roadmap live on
 The narrative brief is [docs/CWL-MASTER-CONTEXT.md](docs/CWL-MASTER-CONTEXT.md).
 The last checked-in ruleset ledger is
 [docs/org-required-workflow-rollout.md](docs/org-required-workflow-rollout.md)
-(updated 2026-07-23 KST).
+(updated 2026-08-21 KST).
 
 Checked-in operator facts:
 
-- Ruleset `18156473` is **active**. It targets every repository default
-  branch (`~ALL` / `~DEFAULT_BRANCH`) and sources workflows from this
+- Ruleset `18156473` is **active**. It targets every repository branch
+  (`repository_name.include=["~ALL"]`, `ref_name.include=["~ALL"]`), including
+  stacked pull-request base branches, and sources workflows from this
   repository at `refs/heads/main`.
 - Active required workflow paths: `close-empty-pr.yml`, `noema-review.yml`,
   `opencode-review.yml`, `pr-review-merge-scheduler.yml`,
@@ -89,7 +90,8 @@ workflows into siblings.
    public repositories inherit ruleset `18156473` without a name-list update.
 2. Keep product, build, release, and repo-specific security workflows local.
    Do not add local copies of OpenCode, Strix, Noema, or the merge scheduler.
-3. On each default-branch pull request, GitHub creates the required checks in
+3. On each pull request, including stacked pull requests targeting a feature
+   branch, GitHub creates the required checks in
    the sibling context. Review judgment stays with OpenCode (and the
    independent Noema reviewer). Mechanical branch update and merge stay with
    GitHub Actions in that sibling context, using the configured central

docs/adr/0001-central-review-stacked-pull-requests.md

@@ -0,0 +1,36 @@
+# ADR-0001: Central review for stacked pull requests
+
+- Status: Accepted
+- Date: 2026-08-20
+- Owners: ContextualWisdomLab platform maintainers
+- Figma File ID: N/A — this is a workflow and governance contract with no UI
+
+## Decision
+
+The organization ruleset `CWL Central required workflows` (`18156473`) applies
+to every branch reference (`ref_name.include=["~ALL"]`) in inherited
+repositories. Central OpenCode, Noema, security, and scheduler workflows stay
+owned by `ContextualWisdomLab/.github` at `refs/heads/main`.
+
+## Context
+
+Stacked PRs target another feature branch, so a default-branch-only ruleset did
+not materialize the central required workflow entrypoints. This left buyer-
+visible changes with local checks but without the same independent review and
+security evidence used for main-targeting PRs.
+
+## Consequences
+
+- Every stacked PR receives the same current-head governance entrypoints.
+- The scheduler may dispatch review-only work for non-default base branches;
+  merge automation remains guarded by the PR's actual policy and checks.
+- Branch-scope drift is detected by
+  `scripts/ci/audit_central_required_workflows.py` and its regression tests.
+- No workflow is copied into a product repository, preserving the MSA control
+  boundary.
+
+## Verification
+
+The exact live ruleset was read before and after the change. TEPP PRs #158 and
+#159 were re-read at their current heads before review-only dispatch. Hosted
+Checks remain authoritative for merge decisions.

docs/doctoring/agent-mention-concurrency-isolation.md

@@ -16,7 +16,7 @@ Neither defect is evidence that the requesting maintainer, model, repository all
 The permanent regression contracts were committed before their corresponding production changes.
 
 - `tests/test_agent_mention_dispatch_payload_limit.py` requires both dispatch hops to stay at or below ten top-level payload properties and requires the router to reject an oversized payload before GitHub does.
-- `tests/test_agent_mention_queue_isolation.py` requires the interactive route and scheduled sweep to use different job-level concurrency groups, with `queue: max` on the interactive route and no cancellation of in-progress interactive work.
+- `tests/test_agent_mention_queue_isolation.py` requires the interactive route to have no replacing concurrency group while the scheduled sweep remains independently single-flight.
 
 ## Decision
 
@@ -34,31 +34,37 @@ merge_mode=disabled
 
 The wrapper-to-scheduler payload carries exactly ten fields, including the three values that override unsafe scheduler defaults. The wrapper therefore remains review-only and cannot merge or update a branch.
 
-### Isolated concurrency queues
+### Non-replacing interactive routing
 
-Concurrency is scoped to each job rather than the whole workflow:
+The event-driven local route has no concurrency group, so each eligible
+`issue_comment` event receives its own run. The scheduled sweep remains
+single-flight and cannot cancel an interactive run:
 
 ```yaml
 route-local-agent-mention:
-  concurrency:
-    group: review-agent-mention-router-local-${{ github.repository }}
-    queue: max
+  runs-on: ubuntu-24.04
 
 sweep-organization-agent-mentions:
   concurrency:
     group: review-agent-mention-router-sweep-${{ github.repository }}
     cancel-in-progress: false
 ```
 
-GitHub documents that `queue: max` permits up to 100 pending jobs or workflow runs in one concurrency group and cannot be combined with `cancel-in-progress: true`. The interactive queue therefore retains bounded pending requests instead of replacing the previous pending request. Scheduled sweeps retain coalescing behavior in a separate group and cannot displace interactive work.
+GitHub's supported concurrency contract permits at most one running and one
+pending member per group, and a newly queued member replaces an older pending
+member. The unsupported `queue: max` key cannot provide durability. Omitting a
+local concurrency group is therefore the smallest supported boundary that does
+not discard a trusted mention before its durable invocation claim exists.
+Scheduled sweeps still coalesce in their separate group and cannot displace
+interactive work.
 
 Concurrency is not the idempotency authority. Duplicate forwarding remains governed by the complete canonical invocation key, exact-key downstream concurrency, and the immutable exact-name Actions artifact ledger.
 
 ## Preserved boundaries
 
 - No model provider, reviewer identity, repository allowlist, token name, credential scope, or branch-protection rule changes.
 - `COPILOT_GITHUB_TOKEN` remains unused.
-- Workflow-default permissions remain read-only; existing bounded jobs keep only their required writes.
+- Workflow-default permissions remain read-only; the local router has read-only Actions access and keeps only the content/comment writes required for dispatch and acknowledgement.
 - Only trusted non-bot `OWNER`, `MEMBER`, or `COLLABORATOR` comments on open pull requests are eligible.
 - Pull request number, exact head and base SHAs, base branch, source comment, requested agent, and requesting actor remain bound to the invocation key.
 - Mention routing remains unable to approve, merge, update branches, publish, or release.
@@ -81,7 +87,7 @@ Do not restore either defective boundary:
 
 - do not increase the first- or second-hop payload beyond GitHub's limit;
 - do not move local and scheduled work back into one workflow-level concurrency group;
-- do not replace `queue: max` with the default single-pending interactive queue unless another independently reviewed durable queue preserves every eligible request.
+- do not add a local concurrency group whose default single-pending contract can replace an eligible interactive request before the durable claim exists.
 
 A safe emergency degradation may suspend the scheduled sweep while retaining the isolated interactive route.
 

docs/org-required-workflow-rollout.md

@@ -1,6 +1,6 @@
 # ContextualWisdomLab central required workflow rollout
 
-Updated: 2026-07-23 06:35 KST
+Updated: 2026-08-21 03:30 KST
 
 ## Decision
 
@@ -9,7 +9,7 @@ Use an organization repository ruleset instead of copying workflow files into ea
 - Ruleset: `CWL Central required workflows`
 - Ruleset ID: `18156473`
 - Enforcement: `active`
-- Target: branch rules on every repository's default branch (`repository_name.include=["~ALL"]`, `ref_name.include=["~DEFAULT_BRANCH"]`)
+- Target: branch rules on every repository branch (`repository_name.include=["~ALL"]`, `ref_name.include=["~ALL"]`), including stacked pull-request base branches
 - Required workflow source repository: `ContextualWisdomLab/.github`
 - Required workflow source repository ID: `1274066402`
 - Active required workflow paths:
@@ -31,6 +31,19 @@ reports another ref, treat that as operations drift and restore ruleset
 
 This keeps Strix security evidence, OpenCode and independent Noema review evidence, and merge/update automation sourced from the central `.github` repository. Target repositories do not need local copies of these workflows for the organization required workflow rule, and new repositories inherit the rule without a repository-name list update.
 
+### Stacked pull-request coverage
+
+On 2026-08-20, live PRs #158 and #159 in `ContextualWisdomLab/TEPP` targeted
+`feat/lineageweave-live-consumer-contract` rather than `main`. They had product
+checks but no centrally materialized OpenCode or Noema workflow runs because
+the ruleset was scoped to `~DEFAULT_BRANCH`. Ruleset `18156473` now uses
+`ref_name.include=["~ALL"]`; the existing scheduler already enumerates open
+PRs across base branches and dispatches exact-head review-only work for
+stacked PRs. The audit script and regression test enforce this scope so a
+future ruleset rollback fails closed. The live repair also restored the
+checked-in two-approval contract; workflow source, repository exclusions, and
+stale-review/thread-resolution/last-push protections were preserved.
+
 ## OpenCode required workflow posture
 
 The central `.github/workflows/opencode-review.yml` is now part of the active organization required workflow ruleset.

scripts/ci/audit_central_required_workflows.py

@@ -112,8 +112,8 @@ def audit_ruleset(payload: dict[str, Any]) -> list[str]:
 
     ref_names = conditions.get("ref_name")
     ref_names = ref_names if isinstance(ref_names, dict) else {}
-    if "~DEFAULT_BRANCH" not in (ref_names.get("include") or []):
-        errors.append("central ruleset does not target every default branch")
+    if "~ALL" not in (ref_names.get("include") or []):
+        errors.append("central ruleset does not target stacked and default-branch PRs")
 
     workflow_rules = _typed_rules(payload, "workflows")
     if len(workflow_rules) != 1:

tests/test_agent_mention_downstream_idempotency.py

@@ -11,8 +11,8 @@
 UPLOAD_ARTIFACT_SHA = "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
 
 
-def test_router_can_read_durable_central_artifacts() -> None:
-    """Both local routing and sibling sweeping receive actions read access."""
+def test_router_uses_read_only_actions_access_for_durable_artifacts() -> None:
+    """Both local routing and sibling sweeping only read Actions artifacts."""
 
     text = ROUTER_WORKFLOW.read_text(encoding="utf-8")
     local, sweep = text.split("\n  sweep-organization-agent-mentions:\n", 1)
@@ -33,7 +33,7 @@ def test_downstream_workflows_claim_artifacts_and_bind_exact_key() -> None:
         assert "source_comment_id" in text
         assert "requested_agent" in text
         assert "cancel-in-progress: false" in text
-        assert "queue: max" in text
+        assert "queue: max" not in text
         assert "cancel-in-progress: true" not in text
         assert "^[0-9a-f]{64}$" in text
         assert "^[1-9][0-9]*$" in text

tests/test_agent_mention_queue_isolation.py

@@ -22,13 +22,15 @@ def _job_block(workflow: str, job_name: str, next_job_name: str | None) -> str:
 def _concurrency_block(job: str) -> str:
     """Return the job-scoped concurrency mapping before ``runs-on``."""
 
+    if "    concurrency:\n" not in job:
+        return ""
     start = job.index("    concurrency:\n")
     end = job.index("\n    runs-on:", start)
     return job[start:end]
 
 
-def test_interactive_mentions_and_sweeps_use_independent_queues() -> None:
-    """A scheduled sweep cannot replace a pending trusted mention request."""
+def test_interactive_mentions_run_without_a_replacing_concurrency_queue() -> None:
+    """Every trusted mention receives a run while sweeps stay single-flight."""
 
     workflow = WORKFLOW.read_text(encoding="utf-8")
     header = workflow.split("\njobs:\n", 1)[0]
@@ -44,28 +46,23 @@ def test_interactive_mentions_and_sweeps_use_independent_queues() -> None:
     )
 
     assert not any(line.startswith("concurrency:") for line in header.splitlines())
-    assert _concurrency_block(local_job) == (
-        "    concurrency:\n"
-        "      group: review-agent-mention-router-local-${{ github.repository }}\n"
-        "      queue: max"
-    )
+    assert _concurrency_block(local_job) == ""
     assert _concurrency_block(sweep_job) == (
         "    concurrency:\n"
         "      group: review-agent-mention-router-sweep-${{ github.repository }}\n"
         "      cancel-in-progress: false"
     )
 
 
-def test_interactive_queue_retains_pending_requests_without_cancellation() -> None:
-    """The bounded interactive queue retains work and never cancels in progress."""
+def test_interactive_route_has_no_unsupported_or_replacing_queue_controls() -> None:
+    """Interactive work is neither invalid YAML nor a replaceable pending run."""
 
     workflow = WORKFLOW.read_text(encoding="utf-8")
     local_job = _job_block(
         workflow,
         "route-local-agent-mention",
         "sweep-organization-agent-mentions",
     )
-    concurrency = _concurrency_block(local_job)
-
-    assert "queue: max" in concurrency
-    assert "cancel-in-progress: true" not in concurrency
+    assert _concurrency_block(local_job) == ""
+    assert "queue: max" not in local_job
+    assert "cancel-in-progress" not in local_job

tests/test_central_required_workflow_ruleset_audit.py

@@ -28,7 +28,7 @@ def ruleset_payload() -> dict:
                 "include": ["~ALL"],
                 "exclude": ["noema", "IRT-bibliography-set", ".github"],
             },
-            "ref_name": {"include": ["~DEFAULT_BRANCH"], "exclude": []},
+            "ref_name": {"include": ["~ALL"], "exclude": []},
         },
         "rules": [
             {
@@ -94,6 +94,15 @@ def test_inherited_ruleset_and_organization_scope_probes_pass() -> None:
     assert audit.audit_ruleset(inherited_ruleset_payload()) == []
 
 
+def test_default_branch_only_scope_rejects_stacked_pull_requests() -> None:
+    payload = ruleset_payload()
+    payload["conditions"]["ref_name"]["include"] = ["~DEFAULT_BRANCH"]
+
+    assert audit.audit_ruleset(payload) == [
+        "central ruleset does not target stacked and default-branch PRs"
+    ]
+
+
 def test_inherited_scope_allows_private_exclusion_outside_token_visibility() -> None:
     payload = inherited_ruleset_payload()
     payload[audit.INHERITED_SCOPE_FIELD].pop("IRT-bibliography-set")
@@ -204,7 +213,7 @@ def test_audit_reports_all_structural_and_protection_drift() -> None:
         "central ruleset enforcement is not active",
         "central ruleset does not include all repositories",
         "central ruleset repository exclusions drifted: expected ['.github', 'IRT-bibliography-set', 'noema'], got []",
-        "central ruleset does not target every default branch",
+        "central ruleset does not target stacked and default-branch PRs",
         "expected one workflows rule, found 0",
         "missing central required workflow .github/workflows/close-empty-pr.yml",
         "missing central required workflow .github/workflows/noema-review.yml",