friction: reject stale issue-audit producer revisions before label writes

[ll7]

Archetype Metadata

archetype: workflow
evidence_tier: smoke
linked_policy:
  - docs/context/issue_audit_contract.md
  - docs/maintainer_values.md

Goal / Problem

Observed behavior

On 2026-09-02, one writer using the shared ll7 GitHub credential added
decision-required to 21 already-ruled open issues in a sequential batch between
20:15:43 and 20:16:45 UTC:

#3207, #3287, #6155, #7290, #7382-#7388, #7409, #7411, #7412,
#7457, #7980, #8021, #8064, #8076, #8172, and #8173.

The current-main classifier at aa69d7cdc2150023fca1cf805772807ea1575a85 subsequently read every
complete REST thread and returned decision_required: false with empty decision evidence for all
21. Each issue already had a controlling same-issue ruling or evidence-required/tracker
disposition. A maintainer pass removed only the false label and preserved all independent state,
dependency, domain, evidence, release, and external-input gates.

GitHub timeline events identify only the shared account, not the producing task, worktree, source
revision, or classifier version. The exact producer is therefore unknown. The strongest current
hypothesis, at roughly 80% confidence, is a long-lived worker using pre-fix audit logic or an
alternate write path that did not carry the current ruling regressions. This issue must not assume
that attribution as fact.

Expected behavior

An autonomous issue-audit writer must prove which source and plan produced a label mutation, and it
must fail closed before writing when its audit implementation is stale relative to fetched
origin/main, when the apply-time source differs from the plan-time source, or when producer
identity/provenance is unavailable. Current same-issue ruling suppression and genuine later-reopen
semantics must remain intact.

Parent issue

• workflow: make autonomous issue dispatch machine-checkable and fail closed #7609 owns machine-checkable autonomous dispatch and fail-closed workflow contracts.
• Related but non-duplicate: friction: autonomous issue audit plan/apply races periodic timestamp updates #8295 owns timestamp-only plan/apply races.
• Prior classifier repairs: friction: issue audit re-adds decision-required after canonical ruling comments #7449 / PR fix(audit): honor canonical issue rulings #7463 and PR fix(workflow): keep ruled issues out of decision queue #8247.

Reproduction / Evidence

1. Inspect the issue timeline events for the first and last affected rows:

   gh api --paginate repos/ll7/robot_sf_ll7/issues/3207/events
   gh api --paginate repos/ll7/robot_sf_ll7/issues/8173/events

2. Read all 21 complete issue threads through scripts/dev/gh_issue_rest.py.

3. Run classify_issue from current origin/main after removing only the false
   decision-required label from each input. All 21 currently return no decision evidence.

4. Observe that GitHub's event record contains actor and timestamp but no source commit, task,
   worktree, plan digest, or classifier-contract version.

Scope

In scope:

• Bind every issue-audit mutation plan and apply receipt to the producing source commit, relevant
  classifier/source digest, machine/task identity, and plan digest.
• Before autonomous write mode, fetch origin/main and fail closed when the executing revision
  does not contain current origin/main, unless an explicit maintainer-approved diagnostic mode is
  both read-only and clearly reported.
• Refuse apply when plan-time and apply-time source identities differ, in addition to the existing
  live issue-state compare-and-swap checks.
• Ensure every canonical autonomous issue-audit entry point uses the same provenance guard.
• Add a regression that models a stale producer predating the canonical-ruling fixes and proves it
  cannot write labels.

Non-goals:

• Do not weaken fail-closed handling, REST readback, mutation ceilings, or later genuine decision
  reopening.
• Do not infer which current Codex task produced this batch without direct evidence.
• Do not change any scientific ruling, compute authority, campaign, artifact admission, release,
  publication, Project test_can_load_model_snapshot failed on LeLuGPC WSL2204. #5 field, or independent blocker.
• Do not merge this with friction: autonomous issue audit plan/apply races periodic timestamp updates #8295's timestamp-only semantic-drift equivalence work.

Blocked by: none for implementation. A definitive historical actor attribution may remain
unavailable and is not required to close the workflow gap.

Added Value Estimation

• User impact: prevents already-settled decisions from repeatedly consuming maintainer attention.
• Maintenance value: makes shared-credential mutations attributable and rejects stale audit code
  before it can alter live labels.
• Why now: the recurrence affected 21 issues after both ruling-classifier fixes had merged.

Effort / Complexity / Risk

• Rough estimate: 3-6 hours; best estimate: 4 hours.
• Complexity: moderate, spanning plan schema, apply validation, and autonomous entry points.
• Main risk: an overly strict freshness check could reject a valid current feature worktree.
• Mitigation: require write-capable workers to incorporate fetched origin/main; preserve a
  clearly read-only diagnostic mode for older revisions; test both paths.
• Estimate confidence: 70%; the number of independent issue-audit write entry points is the main
  uncertainty.

Affected Files

• scripts/dev/issue_audit_core.py - source/provenance fields and fail-closed apply guard.
• Canonical goal/autonomous audit entry points discovered by rg - current-main freshness check.
• tests/dev/test_issue_audit_core.py - stale producer, source mismatch, current source, and later
  genuine-reopen regressions.
• docs/context/issue_audit_contract.md - mutation-provenance and freshness contract.

Definition of Done / Acceptance Criteria

• Every write-capable audit plan and receipt records source commit, classifier/source digest,
  task or machine identity, and plan digest.
• Apply refuses all mutations if plan-time and apply-time source identity differ.
• Autonomous write mode refuses to run from a revision that has not incorporated freshly
  fetched origin/main; read-only diagnostics remain available and explicit.
• A regression using pre-fix(audit): honor canonical issue rulings #7463/fix(workflow): keep ruled issues out of decision queue #8247 behavior cannot add decision-required through any
  canonical write entry point.
• Current-main fixtures shaped like all 21 affected issues produce no decision-label addition.
• A regression preserves the existing explicit post-ruling-request behavior.
• Existing issue drift checks, mutation ceilings, and REST readback remain fail closed.
• A complete live read-only replay reports no recurrence before implementation handoff.

Success Metrics

• No live label mutation can be produced without an attributable source/version receipt.
• A stale long-lived worker fails before its first GitHub write and emits a concrete refresh
  command.
• The current ruling queue remains empty unless new post-ruling decision evidence exists.

Validation / Testing

• Add red/green focused tests for stale source, source mismatch, current source, and genuine later
  reopen behavior.
• Run the focused issue-audit test module, Ruff, format check, and git diff --check.
• Run the repository workflow/tooling readiness path required for schema or automation changes.
• Generate one complete read-only live audit from fresh origin/main, then inspect its plan and
  provenance receipt; no production label mutation is needed for validation.

Claim Boundary

This is workflow-integrity evidence only. It authorizes no issue ruling, blocker removal, compute,
campaign, merge, artifact admission, release, publication, benchmark conclusion, or scientific
claim.

Project Metadata

• Priority: P1 because one stale producer can recreate the entire maintainer decision queue.
• Effort: 4 hours best estimate.
• Reviewed: no; triage remains required.

[ll7]

#8307: tracker-not-a-decision

This issue defines a bounded workflow-integrity implementation contract; it does not ask the
maintainer to choose among policy alternatives. On exact current origin/main
88b7188644adb05629551c94d70353d2dce3302f, the classifier re-enters the decision path solely
because the acceptance criterion says that a regression must preserve the behavior where a
genuinely later explicit request must remain recognized by tests. That sentence describes a test case, not
a live request.

Consequences:

• remove decision-required and add ruled;
• retain needs-triage and the existing workflow/friction scope;
• add the self-labeling fixture to the implementation evidence for this issue, alongside the
  already-recorded stale/alternate-producer recurrence;
• do not infer which long-lived task caused the earlier 21-issue batch without direct evidence.

This ruling grants no issue-audit mutation authority, blocker removal, Project change, merge,
compute, campaign, artifact admission, release, publication, benchmark conclusion, or scientific
claim. Reopen a maintainer decision only if implementation exposes two incompatible write-mode
freshness policies that deterministic tests and the existing fail-closed contract cannot resolve.

[ll7]

Recurrence evidence — 2026-09-03

A second sequential false-routing batch was observed under the shared ll7 credential:

• architecture parent: sequence behavior-preserving refactor children after characterization #4770 at 19:43:58Z;
• benchmark: run S10 ORCA/PPO nominal-vs-stress discriminability calibration #6095 at 19:43:59Z;
• release: publish and independently verify 0.0.5 #6155 at 19:44:01Z;
• research: promote Flint result surfaces from fixtures to pinned release evidence #6720 at 19:44:02Z;
• workflow(7520): stabilize PR metadata before expensive integration checks #7649 at 19:44:03Z.

Every complete thread already carried a controlling ruling, and the exact current-main classifier
returned no choice evidence for each row after the queue label was removed. GitHub still exposes no
producer task, worktree, source commit, or plan digest, so attribution remains unknown.

A separate self-labeling path on #8307 was reproduced exactly: the classifier treated wording in
an acceptance-test sentence as an active maintainer request. The sentence and its ruling summary
were rewritten without changing the test contract; exact-current-source classification now returns
decision_required=false for #8307.

Post-reconciliation proof at origin/main=800be570faf17ba060a9a95fef1d3027a62ac90f:

• 206 open issues classified;
• complete closed-pull-request coverage;
• zero truncated or unavailable sources;
• zero pending maintainer choices.

This strengthens the need for both parts of this issue: producer/source provenance for unexplained
write batches and fixtures that distinguish policy/test descriptions from active requests. No
independent blocker, scientific state, campaign, artifact, release, or publication authority was
changed by the reconciliation.