Block scheduler merges without exact-head independent approval

[seonghobae]

Incident evidence

ContextualWisdomLab/inkspan#60 merged at 2026-08-05T03:30:37Z from exact head b02f1662c7118faf1aaf44b8ea1efb376cfc3a85 into merge commit 45d9bf315a626c686658b3148d3775405c878617 while its PR body still marked Exact-current-head independent approval and protected merge incomplete.

The retrievable review history contains only two dismissed OpenCode CHANGES_REQUESTED reviews, both attached to older head ab32926d84030f0e23cda4a2ca1fd87bf2035761. No approving review attached to the merged head is visible through the PR review API. Direct CI and security success does not substitute for independent approval.

This issue does not assert which actor performed the merge. The available connector does not expose the organization audit-log event, ruleset insight, bypass actor, or merged_by identity. An organization administrator must inspect those records.

Central scheduler defect

scripts/ci/pr_review_merge_scheduler.py currently treats an exact-head OpenCode approval as sufficient to enter direct merge or auto-merge paths. The direct path checks current-head OpenCode evidence, unresolved threads, failed checks, Strix evidence, and mergeability, then invokes gh pr merge --match-head-commit.

It does not require either of these before the mutation:

• reviewDecision == APPROVED; or
• an exact-head independent Noema/non-OpenCode approving review.

GitHub rulesets can designate users, roles, teams, or GitHub Apps as bypass actors. A scheduler credential that is accidentally or intentionally on a bypass list can therefore convert this omitted application-level gate into a real protected-merge bypass. GitHub documents both required pull-request review rules and ruleset bypass actors, including pull-request-only bypass mode.

Immediate administrative action

1. Inspect the organization audit log and Rule Insights for the merge of inkspan#60 at 2026-08-05T03:30:37Z.
2. Identify the merge actor and whether a repository role, organization administrator, user, team, GitHub App, or token source exercised ruleset or branch-protection bypass.
3. Inspect all active organization and repository rulesets targeting inkspan:main, including required approval count, latest-push approval, required OpenCode/Noema workflows, conversation resolution, and bypass actors/modes.
4. Remove merge-scheduler credentials and reviewer Apps from bypass lists unless a separately approved break-glass design requires them. A reviewer identity must not also possess an implicit path around its own gate.
5. Preserve the audit evidence and record the root cause. Do not retroactively synthesize an approval for test: add scheduler decision contract fixtures #60.

Required code repair

Implement test-first, fail-closed merge eligibility:

• require reviewDecision == APPROVED before direct merge and before enabling native auto-merge;
• require an exact-current-head approving review from the configured independent reviewer identity, separate from OpenCode and separate from the last pusher;
• reject stale, dismissed, commented, fallback-only, body/head-mismatched, or unknown-author reviews;
• require the independent review after the current head commit and retain the current unresolved-thread, required-check, Strix, security, freshness, and --match-head-commit guards;
• make absent/unknown review metadata a WAIT, never merge evidence;
• refuse direct mode when the mutation credential is a configured ruleset bypass actor, or eliminate direct mode in favor of GitHub-native auto-merge after all application-level gates pass;
• add an explicit machine-readable reason when reviewDecision or independent approval is missing;
• add regression fixtures reproducing an OpenCode-approved, CLEAN, REVIEW_REQUIRED PR and prove merge_pr()/enable_auto_merge() are never called;
• add a fixture with stale Noema approval and a current OpenCode approval and prove it remains blocked;
• add a positive exact-head OpenCode + independent approval + reviewDecision=APPROVED fixture;
• retain 100% production statement/branch coverage and complete public docstrings;
• update docs/org-required-workflow-rollout.md and CHANGELOG.md with the incident boundary and rollback.

Acceptance

• no scheduler path can merge or queue merge with only OpenCode approval;
• exact-head Noema/independent approval and GitHub review policy must both be satisfied;
• bypass credentials are removed or constrained by a documented break-glass policy that the routine scheduler cannot use;
• exact-head central tests, CodeQL, Semgrep, Python Security, Security Scan, OSV, Scorecard, Secret Scan, SBOM, OpenCode, Noema, independent approval, and branch protection pass;
• the repaired scheduler is replayed against a synthetic and a real target-repository PR without bypassing protections.

Official GitHub documentation

• About rulesets: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets
• Available rules for rulesets: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets
• About protected branches: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
• Creating rulesets and pull-request-only bypass: https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository

No formal GitHub conformity claim is made.