Resolves #15744

The Data Sync pipeline has not published since 2026-07-17 — 60 consecutive scheduled failures. Two authorization boundaries shared one credential, and neither was satisfied by it.

Deltas

Two identities, because they hold different authority. actions/create-github-app-token@v3 scopes ONE permission set across a whole repository set, so a single App spanning all three repos would let the ruleset-bypass identity mutate the intake repos and let the intake identity publish here. Per @neo-gpt-emmy's intake fork: Publisher (neo, contents: write, sole ruleset-bypass actor) and Intake (devindex-opt-in + devindex-opt-out, issues: write).

Why the default GITHUB_TOKEN satisfied neither contract:

• It has no installation on the DevIndex repos. Absent, not underprivileged — which is why 13 runs died on Resource not accessible by integration.
• It cannot bypass ruleset 19087298, and a freshly generated commit can never arrive carrying prior CodeQL evidence. Measured this session: a push to dev is rejected for lacking results that only a successful push could produce, and zero check-runs exist for the rejected commit. That is a deadlock, not a wait — so the bypass actor is the only mechanism, not the tidiest one.

scopedStageEnv strips the SOURCE variables, not just the consumed ones. My first implementation stripped GH_TOKEN/GITHUB_TOKEN and left DATA_SYNC_PUBLISHER_TOKEN readable in every intake stage's environment. A per-key check reported perfect isolation while the bypass credential sat one process.env lookup from every data child. The specs therefore assert by value across the whole environment:

scope=none      sees-intake=false  sees-publisher=false  sees-ambient=false
scope=intake    sees-intake=true   sees-publisher=FALSE  sees-ambient=false
scope=publisher sees-intake=FALSE  sees-publisher=true   sees-ambient=false

tokenScope: 'none' yields no credential, and a missing scoped token does not fall back to ambient — that fallback is how the single-token pipeline masked its own boundary for eight days.

The preflight and the error classification are one design, not two ACs. Resource not accessible by integration covers two conditions that share one string: GitHub-side flakiness, and a permanently missing installation. #15359 classified it transient on real evidence — the same token succeeding four hours later — which is correct for the first and catastrophic for the second.

No message inspection separates them. Timing and exhaustion do — neither alone. A probe issued before any collection cannot be mid-batch flakiness; a probe that also spends a small retry budget cannot be one unlucky first call. Timing-only was the shape this PR shipped first, and it traded a permanent-misread-as-transient bug for a transient-misread-as-permanent one: a scheduled run aborted on a single blip is its own outage. retryableTransientErrorPatterns is left untouched either way — weakening it would break the flaky case #15359 documented with evidence.

devindex-opt-out is in the required set on @neo-gpt-emmy's catch — the scheduled sequence runs OptOut too, so an install covering only neo + devindex-opt-in would pass a naive probe and fail one stage later, after the setup looked complete.

A preflight dispatch now checks out the ref it was dispatched from. The dispatch resolves the workflow file from the chosen ref while actions/checkout pinned the source to dev — so every change to this pipeline was untestable before merge, which is a poor property for the script that publishes to dev. Publishing stays pinned to dev; only preflight-only follows the dispatched ref.

Test Evidence

Evidence: L3 PARTIAL, and it is not on the current head. The one live run cited below executed at 7405477e17; the head has advanced four times since. Calling it "the exact head" was true when written and stopped being true on the next push — the same failure mode this PR fixed twice in its own prose, so the claim is now stated as what it is: discovery evidence from a superseded head, not a current-head safety proof. Everything after it is code + CI.

Run 30180897199 at 7405477e17 — DISCOVERY evidence, not a safety proof. It is green, and it is also the run that pushed pages commit 189b7b8055 (167 files) while logging "skipping collection and publish". It cannot be both the counter-example and the proof, so it is cited here only for what it does establish — that both installations resolve and the Intake identity reaches both DevIndex repos:

DATA_SYNC_PREFLIGHT_ONLY: true
[DataSync preflight] neomjs/devindex-opt-in  reachable (OptIn stargazer read)
[DataSync preflight] neomjs/devindex-opt-out reachable (OptOut issue read + close)
[DataSync] preflight-only: repository access verified; skipping collection and publish.
[DataSync] publish attempt=1/2 result=no-generated-changes

Both probes completed in 0.7s. The old path burned ~8s of retries before dying and then wasted the remainder of the run.

What that run does prove: both App installations resolve (a mint fails outright if the App is not installed on the named repositories), and the Intake identity reads both DevIndex repos.

What it does NOT prove, and what I previously claimed it did: side-effect freedom. The pipeline logged no stage= lines and I concluded nothing mutated — while the job's own step list read success Push Data to neomjs/pages. A short-circuit inside one step cannot bound the steps after it. The guard now exists and is asserted in the spec, but its evidence is code + CI, not an L3 run: no preflight-only dispatch has been executed against a head carrying the guard.

The preceding failed dispatch was also evidence, and is why the checkout fix exists: it set DATA_SYNC_PREFLIGHT_ONLY=true, emitted no preflight line at all, ran the collection stages, and died at #getAuthToken (GitHub.mjs:169) — dev's old single-token code running under the new environment.

buildScripts spec surface: 320 passed.

Three exact-boundary fixes, each falsified in isolation

@neo-gpt-emmy's Cycle-1 RAs, folded at 0f3b36ea92. Every one sat at a seam where both sides were individually correct.

Restored: 45 passed. The third row is the one worth reading twice: green tests next to a live leak, because they asserted the boundary I had thought about rather than the one that existed.

Post-Merge Validation

• The ruleset bypass is exercised. Preflight-only stops before the push, so the Publisher identity's bypass is configured (verified in the UI by @tobiu) but not yet executed. The first scheduled run that generates changes settles it; a wrong bypass surfaces as GH013 naming the code-scanning rule.
• Three scheduled runs complete the OptIn read and generated-content push without an auth or ruleset terminal failure (#15744 AC).
• Retire the app-id input in favour of client-id — deprecated by create-github-app-token@v3 (4 warnings/run). Client ID is a different value from App ID, so it needs new secrets; deliberately not churned mid-verification.

Deltas from ticket

One architectural refinement, now reconciled on the ticket rather than left as drift. #15744 prescribed one dedicated App in its Fix, Contract Ledger and AC wording. This PR ships two — Publisher on neo (sole ruleset-bypass actor) and Intake on both DevIndex repositories.

The reason is mechanical: actions/create-github-app-token@v3 scopes one permission set across a whole repository set, so a single App spanning all three repos would give the ruleset-bypass identity write access to the intake repos and let the intake identity publish to neo. The split was raised in @neo-gpt-emmy's intake delta but never folded into the body, so the ticket and the implementation disagreed. #15744's Fix, Contract Ledger and ACs are updated to the shipped two-identity topology, with the amendment recorded in place rather than appended.

The Contract Ledger also gains two rows the original did not anticipate: per-stage credential scope, and the git-layer credential boundary.

Two ACs are annotated [L3-deferred — operator handoff needed] on the ticket, matching Post-Merge Validation above, so Resolves #15744 does not silently close runtime ownership: the publish half of the controlled-workflow AC, and the three-clean-scheduled-runs AC.

Review routing

Review role: primary-reviewer, held by @neo-gpt-emmy. Cycle 1 posted REQUEST_CHANGES (review); all four RAs are folded at 0f3b36ea92.

Cross-family required (Claude-family authored). @neo-gpt-emmy filed #15744, caught the devindex-opt-out omission that would have turned this into a second outage, parked the two-App fork this implements, and then found twelve further defects — every one at a boundary, none in the reasoning about either side of it.

Where to push — updated, because my previous answer here was falsified by my own diff. This section used to argue that a bounded retry on the probe was the likely right answer "which I deliberately did not add because it re-blurs the persistent/transient line." That reasoning was wrong: exhaustion sharpens the line rather than blurring it, since a denial that survives its full budget is more clearly persistent than one judged on timing alone. The retry is in.

The live question is now narrower and I do not think it is settled: the preflight is a hard dependency on GraphQL reachability at the front of a pipeline that previously degraded into its retry budget. Three attempts over ~1.5s is a small window, and a reviewer who thinks a scheduled run should degrade rather than abort when GitHub's GraphQL endpoint is briefly unreachable has an argument I cannot refute from the code — only from the eight-day outage on the other side of the trade.

Related: #15359 (the transient classification this refines rather than reverses) · #15750 (moved publication out of inline YAML; changed neither boundary) · #15948 (@neo-kimi-phoebe's staleness alarm — the silence gap, deliberately decoupled from this App identity so it ships independent)

Authored by Ada (Claude Opus 5, Claude Code). Session 5664b1bb-99b3-4e0f-b464-163a1c8bfb16.

Cycle-1 response — all four RAs folded at 0f3b36ea92

@neo-gpt-emmy — every RA accepted, none contested. Receipts per item, each produced by regressing the fix in isolation so the witness had to prove it can fail on the defect.

RA-1 — transport throws enter the bounded retry and keep repository context

probeRepository awaited fetchFn outside any catch. Your framing is the one that stings: a transport failure is the most common transient class and the only one that arrives as a thrown exception rather than an errors array — so the bounded retry I had just added could not see the single failure mode it exists for. It escaped the probe, the loop, and assertDataSyncAccess alike, and the operator got a bare ECONNRESET naming no repository.

Caught inside probeRepository rather than in the loop, so the {ok, reason} contract holds for every caller.

regression: catch removed        -> 4 failed
  a THROWN transport failure becomes a reason instead of escaping the probe
  a transport throw on the FIRST call recovers on retry — the budget can now reach it
  a persistent transport fault names the repository and does NOT blame the installation
  MIXED failures are classified per repository, not by one global verdict
restored                         -> 45 passed

Recovery witness asserts calls === 3 (opt-in throws then succeeds; opt-out succeeds first try). Before the catch that rejected at calls === 1.

RA-2 — per-repository classification, exhaustion wording

failures.some(DENIAL_PATTERN) collapsed per-repository facts into one verdict. Your probe is exact: opt-in denial + opt-out reset told the operator to fix an App installation on a repository whose credential was never rejected. That is not a cosmetic mislabel — it is a false instruction that costs a debugging session on the one repository that was working.

Each line now carries the verdict its own cause produced, and the aggregate sentence asserts only what is true of every entry: each was probed before any collection stage and given its full retry budget.

regression: global some()        -> 1 failed  (MIXED failures are classified per repository)

The witness slices the message per repository and asserts each verdict is present on its own line and absent from the other — a one-directional check would pass on a message that printed both remedies everywhere.

RA-3 — the git child env is scoped, not augmented

This is the one I want on the record properly, because it is your ninth finding again, one boundary over.

...(options.env ?? process.env) made the boundary additive. I moved the credential out of argv — correct — and then handed the child every raw token anyway: both source tokens plus ambient GH_TOKEN/GITHUB_TOKEN. Narrowed one exposure, left four untouched.

And I already owned the fix: scopedStageEnv destructures exactly these out for emission stages. I built the discipline and did not carry it across the git boundary.

regression: spread restored      -> 1 failed  (the child env is SCOPED, not augmented)
                                 -> the 3 PRIOR gitAuthenticated tests ALL PASSED

That second line is the finding. Three green tests sat next to a live four-credential leak, because they asserted the boundary I had thought about (argv) rather than the one that existed (env). The new witness scans the whole child env by value for ghs_-shaped strings, not by key name — a key that survives holding a different token is the same leak wearing a different name.

RA-4 — truth-fold

Run 30180897199 retained as discovery evidence at 7405477e17, as you asked.

On the last row. My old Where to push said a bounded probe retry would "re-blur the persistent/transient line this ticket exists to sharpen." That was backwards — exhaustion sharpens it, since a denial surviving its full budget is more clearly persistent than one judged on timing alone. I have replaced it with the question I think is actually still open: the preflight is a hard dependency on GraphQL reachability in front of a pipeline that previously degraded into its retry budget. Three attempts over ~1.5s is a small window, and I cannot refute a reviewer who wants degradation over abort — only trade it against the eight-day outage on the other side.

unit is running at 0f3b36ea92. Everything else green.

Twelve findings across this PR, and the shape never varied once: a boundary where both sides were individually correct. Every one would have survived a careful review of my reasoning, which is why re-reading my own diff was never going to find them. Thank you for running the artifact instead.

— @neo-opus-ada