Repository navigation
[PR governance] Enroll html4tree in central OpenCode review dispatch #1003
Description
Problem
ContextualWisdomLab/html4tree is governed by the central required-review workflows, but it is absent from the exact repository allowlist exposed through OPENCODE_REPOSITORY_DISPATCH_TARGETS.
The current html4tree pull requests have completed same-head Strix evidence, and the repository-local scheduler then stops with this fail-closed decision:
Required OpenCode Review dispatch waits for central required workflow materialization; required workflow source is ContextualWisdomLab/.github, but this scheduler run has no cross-repository repository-dispatch credential.
The central scheduler's runtime allowlist currently omits ContextualWisdomLab/html4tree, so the privileged central path cannot target the repository either. A green placeholder check must not be treated as an actual Reviews API verdict.
Affected current pull requests
ContextualWisdomLab/html4tree#435ContextualWisdomLab/html4tree#436ContextualWisdomLab/html4tree#442ContextualWisdomLab/html4tree#444
All four have auto-merge enabled and remain blocked on a real independent current-head review verdict.
Acceptance criteria
- Add
ContextualWisdomLab/html4treeto the organization variableOPENCODE_REPOSITORY_DISPATCH_TARGETSwithout weakening the exact-allowlist or actor validation. - Run the central targeted scheduler for each affected current head after same-head Strix evidence completes.
- Verify that
opencode-agentoropencode-agent[bot]submitsAPPROVEDorCHANGES_REQUESTEDfor the exact current head through the Reviews API. - Do not accept a COMMENTED review, old-head review, status-only check, human-originated
repository_dispatch, or self-approval as satisfying the gate. - Confirm that an approved PR with successful exact-head required checks merges through the existing auto-merge policy.
- Close this issue only after at least one html4tree PR receives a real current-head OpenCode review and the remaining affected PRs are queued through the same path.
Security boundary
This is a configuration enrollment request, not a request to remove fail-closed behavior or bypass independent approval.
Activity
seonghobae commentedon Aug 14, 2026
Updated exact-head enrollment targets after maintainer hardening:
ContextualWisdomLab/html4tree#435—0e54b9f68775bb2f6198065f513a6bf56b7df0e5ContextualWisdomLab/html4tree#436—adf4be984d917570813c227117b7bbf2ac568c3bContextualWisdomLab/html4tree#444—520b1adf2a575f2d66f47911669026917a94f066PR #442 is now Draft and must not enter merge automation: its all-or-nothing failure path cannot safely delete or replace
index.htmluntil the generated-artifact ownership contract in #1004 exists.#435 and #436 now include standards-traceability doctoring and realistic regression tests; #444 includes an observable filesystem-call-count regression. Each exact head has fresh required workflows queued. The unresolved blocker remains a real independent Reviews API verdict from
opencode-agent/opencode-agent[bot]; a status-only check or old-head verdict is not acceptable.seonghobae commentedon Aug 15, 2026
Enrolled
ContextualWisdomLab/html4treein the organization variableOPENCODE_REPOSITORY_DISPATCH_TARGETS.Current allowlist:
ContextualWisdomLab/.github,ContextualWisdomLab/naruon,ContextualWisdomLab/keyverse,ContextualWisdomLab/html4tree.The exact-allowlist and actor validation are unchanged. A current-head OpenCode Reviews API verdict is still required; this does not treat a placeholder check as approval.
seonghobae commentedon Aug 15, 2026
2026-08-15 html4tree queue update:
ContextualWisdomLab/html4tree#444at520b1adf2a575f2d66f47911669026917a94f066.#436at6273b0fba81eb631f542f476cbb6aaf6933742b7— valid code direction but.jules/palette.mdcontains superseded empty-state guidance.#442at24037e2ed75a9218aa154333c7d88e8fda31f295— waits for fix(opencode): ignore review-state gate before approval #453 ownership contract.#453atf1918b3c222fbe34b9528090eafd18cce64f3dc2— representative generated-index ownership PR, currently Draft due valid CodeRabbit findings plus backup-retention hardening.Closed duplicate or unsafe-repeat html4tree PRs in this loop: #446, #447, #448, #449, #450, #451, #452. Do not dispatch merge automation for those closed PRs. The required boundary remains an actual current-head Reviews API verdict from
opencode-agent/opencode-agent[bot]; a status-onlyopencode-reviewcheck is not sufficient.seonghobae commentedon Sep 1, 2026
2026-09-02 exact protected-main RCA update:
.github@4ae90e18b03a3a455e13e501628010cabc5c37a8run33536162528/ job99950870065failed atValidate targeted repository dispatchforContextualWisdomLab/html4tree#507. OIDC/App token exchange completed successfully; the job then failed closed because the liveOPENCODE_REPOSITORY_DISPATCH_TARGETSvalue printed by the runner does not containContextualWisdomLab/html4tree. This is configuration drift/regression: issue history records that html4tree was enrolled previously, while the current runtime value has lost that entry. No review/security gate should be weakened and rerunning before restoring the exact organization-variable entry would only repeat the failure. Root repair remains to restoreContextualWisdomLab/html4treein the organization variable, then rerun the exact targeted scheduler and verify a current-head Reviews API verdict.seonghobae commentedon Sep 8, 2026
2026-09-08 exact canary: html4tree#600 was moved from Draft to Ready at exact head
b7fb8140b6bdcbe3d58defe526408d24d6b2d8d3after all source/security checks were terminal and all inline threads were resolved. No new Actions run or check-run materialized for theready_for_reviewtransition.The only existing OpenCode check (job
101586092792) is a Draft-path success whose log says the review is not requested until Ready. The only existing Noema check (job101580026200) likewise saysPR is draft; Noema verdict preparation skipped.The Reviews API has no exact-headAPPROVEDorCHANGES_REQUESTEDsubmission, while GitHub correctly keepsmergeable_state=blocked.This proves the existing green review check names are not substantive Ready-state evidence. Acceptance must cover
pull_request.ready_for_review(or an exact-head central reconciliation that detects the live Ready state), publish fresh check identities, and obtain a real authenticated Reviews API verdict without treating the Draft skip-success as reusable. The leaf head was not churned or manually redispatched.