fix(scheduler): prove workflow-starting mutation token

[seonghobae]

Root cause

An allowlisted mutation credential source did not prove that the selected GH_TOKEN was present and distinct from the workflow github.token. GitHub suppresses new workflow runs for events produced by GITHUB_TOKEN, so an empty App/PAT secret could fall back to that token while the source label still authorized a head mutation. The moved head would then require checks that its mutation credential cannot start.

This is a bounded successor for a second valid delta preserved in historical Draft #1231. It is stacked on #2002 because both touch the scheduler credential boundary.

RED → GREEN

• RED: ebcc6715e68d6bd4dc78f1ce6c3e473a2dfef899
  • rejects missing selected-token evidence, missing workflow-token comparison evidence, and selected-token equality with github.token
  • requires later guidance to preserve the originally recorded decision reason
• GREEN: e2204eeb1ec2789ff791036140ba1672995d25f5
  • validates actual token evidence at the final head-mutation boundary
  • passes SCHEDULER_WORKFLOW_TOKEN only to the scheduler mutation job
  • makes self-test credential fixtures coherent and restores all affected environment values
  • updates CHANGELOG, APA-style doctoring, and docs/product-technical-gap-baseline.md

Authority and safety

• Base: fix/scheduler-central-actions-credential-routing@7bf3451a47768dbda903115a393b1da1d98e1dba
• Both commits are normal fast-forwards; no force push or rebase
• No reviewer, status, ruleset, timeout, provider, or cross-repository permission is weakened
• Missing capability fails closed
• Status remains Proposed until the parent lands and this exact head has terminal clean checks plus independent review

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Baseline reproduction confirms credential/fixture failure exists before #2005

Independent clean-detached reproduction was completed at parent stack head 14f7c85ca56be3297fa4d090d39d487d7be9bf14 using the existing .venv and no source mutation.

.venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=short

Result: 4 failed, 330 deselected / 13.60s / terminal 1.

For #2003 ownership specifically, workflow_starting_credentials_allow_head_mutations is already false at this parent head. Treat this as a regression/fixture-contract mismatch inside the #2002→#2003 credential stack until proven otherwise, not as a #2005 child-delta effect.

Required repair boundary:

• Keep fix(scheduler): prove workflow-starting mutation token #2003's real safety invariant intact: a workflow-starting mutation credential must be actually present and proven distinct from the workflow GITHUB_TOKEN; missing comparison evidence or same-token fallback must still fail closed.
• Determine whether this test's synthetic environment failed to supply coherent selected-token/workflow-token evidence, or whether production logic incorrectly rejects a valid workflow-starting credential.
• If fixture drift: repair the fixture/expectation to model the intended present/distinct-token state. If production behavior is wrong: repair implementation test-first. Do not relax head_mutation_credential_problem() or bypass the proof.
• Re-run this exact focused baseline and then the broader review-repair suite on the combined parent stack.

The other three focused failures are cancellation mocks that reject the new stdin= kwarg and belong primarily to the #2002 host-scoped Actions callable boundary. The remaining 11 failures seen on #2005 hosted run 34082563712 are not declared to share this root cause without separate reproduction.

[seonghobae]

Exact-head repair receipt — 71e76785b9f7ce900a4a85c23a49d5da4684a262

• Parent is exact #2002@b18b7ca77ba6a8cb733a4661c00d1035408c5eec; normal merge history preserves both PR deltas, with no rebase or force update.
• Runtime Quality RCA from the prior stack head: the autouse fixture declared an allowlisted source name but omitted the actual selected-token/workflow-token comparison introduced by this PR, so 12 otherwise-valid head-mutation tests failed closed.
• Repair: the fixture now supplies distinct non-secret test values for GH_TOKEN and SCHEDULER_WORKFLOW_TOKEN; production fail-closed proof is unchanged.
• Current comparison: 5 ahead / 0 behind its exact parent; Draft/Proposed; mechanically mergeable; unresolved review threads 0.
• Fresh exact-head hosted evidence remains authoritative.

[seonghobae]

Exact-head source review for 71e76785b9f7ce900a4a85c23a49d5da4684a262 on parent #2002@b18b7ca77ba6a8cb733a4661c00d1035408c5eec: no new substantive finding in the six-file stacked delta.

The final head-mutation boundary now proves four distinct facts instead of trusting a source label: the declared source is workflow-starting, selected GH_TOKEN is present, the workflow-token comparison value is present, and the two values differ. The caller exposes SCHEDULER_WORKFLOW_TOKEN only to the scheduler mutation job. Missing/equal evidence fails closed, while operator guidance renders the immutable recorded decision rather than mutable later environment state.

The parent-baseline credential fixture is coherently repaired to supply distinct selected/workflow tokens. No timeout, provider, review, permission, ruleset, or production safety check is weakened.

This is an independent source review, not approval or hosted GREEN. Preserve #2002 as the explicit prerequisite and regenerate exact-head checks/reviews after any parent movement; no predecessor evidence transfers.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• .github/workflows/pr-review-merge-scheduler.yml — GitHub Actions review job
• CHANGELOG.md — repository behavior
• docs/doctoring/workflow-starting-mutation-credential-proof.md — operator or user guidance
• docs/product-technical-gap-baseline.md — operator or user guidance
• scripts/ci/pr_review_merge_scheduler_core.py — review and security gate shell path
• tests/test_pr_review_merge_scheduler.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Repository file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_merge_scheduler_core.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_merge_scheduler_core.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test: test_pr_review_merge_scheduler.py"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test: test_pr_review_merge_scheduler.py"]
  R5 --> V5["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 71e76785b9f7ce900a4a85c23a49d5da4684a262
• Workflow run: 34179686961
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Repository file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: workflow-starting-mutation-credential-proof.md (2 files)"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_merge_scheduler_core.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_merge_scheduler_core.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test: test_pr_review_merge_scheduler.py"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test: test_pr_review_merge_scheduler.py"]
  R5 --> V5["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 71e76785b9f7ce900a4a85c23a49d5da4684a262
• Workflow run: 34179686961
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(scheduler): prove workflow-starting mutation token #2003 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Exact-head repair receipt for 1cb80abc53362fd9441bf0e3e17a23a065474ab7.

The hosted RED remains run 34179686961, job 101918724013: pr_review_merge_scheduler_core.py:497 was the sole missed production statement at the 100% coverage gate. The repair is fixture-only: the existing valid workflow-starting credential test now executes the defensive credential_reason is None RuntimeError. Production credential presence/distinctness checks and fail-closed behavior are unchanged.

Non-force lineage:

• test/docs commit 88bca677fc24ddf39da61d07ea57774891ecaba3
• two-parent merge 1cb80abc53362fd9441bf0e3e17a23a065474ab7, preserving current parent fix(scheduler): scope Actions credentials by run host #2002@1528aa50c82eb46367b084faa310845c3d644cf6
• exact tree ba840d3f0307037c1909bdd2cec7861bb68e9f6c, independently matched before ref update

Local exact-tree evidence:

• focused credential guard: 1 passed
• scheduler suite under coverage: 334 passed; line 497 is no longer missing
• combined scheduler + inherited CodeQL contracts after parent integration: 379 passed
• full repository under branch coverage: 2998 passed, 1 skipped, 21 subtests passed; 13215/13215 statements and 5342/5342 branches, 100%
• GITHUB_ACTIONS=true, -W error, and git diff --check: PASS

The PR remains Draft/Proposed. Fresh exact-head hosted checks and independent review are still required; no predecessor evidence transfers.