fix(automation): isolate interactive review-agent queues

[seonghobae]

Incident

Trusted @cwl-noema-review and review-only @opencode-agent issue comments can remain unacknowledged because protected main places interactive comment routing and the five-minute organization sweep in one workflow-level concurrency group. GitHub's default single-pending semantics allow a newer sweep to replace an already-pending interactive run before exact-head resolution, durable invocation claiming, reviewer dispatch, or acknowledgement.

This direct-main replacement supersedes conflicted historical #815 and the now-closed stacked development container #824. No predecessor check, review, approval, comment, or synthetic-merge evidence transfers.

Test-first evidence

• Protected base: 1131b1bbafb24e455fc8619cdf316813e8721861.
• RED a319d513a2f67b707737651a9eb7fdbfe4bc23c4: changed only tests/test_agent_mention_workflow_contract.py; inherited agent-mention-router.yml still had one workflow-level concurrency group.
• Production c1c012c2817b131a76479aef91aabb41fbc6eba1: moved concurrency to separate local/sweep job groups without changing the credential, dispatch, model, or permission contract.
• Doctoring 75a3bbd65515da81a2463fe1815f604ac4c8bc75: recorded current GitHub queue semantics, rollback, data/authority flow, privacy separation, CSAP/SOC 2 readiness evidence, and APA 7 primary references.
• Ledger-contract alignment a6a2d18e5f3ea5994efd8df7bced6d5a316c9b70: made the existing executable 30-day exact-name artifact assertions read the new authoritative doctoring record.
• Exact current head: a1b64a784610f23cecabc2c307d986d49d47c511, adding only the authoritative [Unreleased] changelog entry.

Any result anchored to an earlier head is historical only.

Bounded repair

• remove workflow-level concurrency;
• route local trusted comments under review-agent-mention-router-local-${{ github.repository }} with queue: max;
• run scheduled sweeps under the separate review-agent-mention-router-sweep-${{ github.repository }} group with cancel-in-progress: false;
• preserve deterministic invocation keys, exact-name 30-day artifact ledger, reviewer identities, token names/scopes, repository allowlist, dispatch payloads, permissions, models, and branch protection;
• keep concurrency as scheduling control only; the durable artifact ledger remains the forwarding authority.

Gate boundary

Exact-current-head checks and reviews are authoritative only for a1b64a784610f23cecabc2c307d986d49d47c511. Queued, pending, cancelled, skipped-required, absent, failed, predecessor-head, status-only, author-only, or synthetic-merge evidence is not acceptance.

Keep Draft until Agent Mention Router Quality CI proves the complete suite plus exact 100% production statement/branch/public-docstring coverage, all security/supply-chain workflows succeed, valid unresolved findings are zero, exact-head automated review and a qualifying independent non-author approval exist, and branch protection permits merge without bypass.

Closes #814 only after protected merge.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2febcbfb-b710-4707-b952-b9b89feec724

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Reconcile this queue-isolation repair onto current protected main without rewriting history. Exact PR head is a1b64a784610f23cecabc2c307d986d49d47c511; current protected main tip is 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The authoritative agent-mention-router.yml blob is b922ba5abda434b14b666e73de8e57c6cc39f00f on the PR head and f14667a9302b8d59a3e5934118449309981def7e on current main. Do not write if any of those identities move.

Use a trusted checkout and normally merge exact protected main into this existing branch. Resolve only actual conflicts and preserve all newer main behavior plus this narrow scheduling contract:

• no workflow-level concurrency shared by interactive and scheduled paths;
• trusted local comments use their own review-agent-mention-router-local-${{ github.repository }} group with queue: max;
• scheduled organization sweeps use separate review-agent-mention-router-sweep-${{ github.repository }} with cancel-in-progress: false;
• durable exact-name artifact/invocation claiming remains the forwarding authority;
• reviewer identities, repository allowlists, token names/scopes, dispatch payload semantics, permissions, models, branch protection, and current-main security behavior stay unchanged.

Do not force-push, use -X ours/-X theirs, create temporary/self-modifying/write-capable workflows, or race #826's separate payload-limit branch. After the merge commit, rerun Agent Mention Router Quality CI, the complete central suite and Strix quick gate, exact 100% production statement/branch/public-docstring contracts, plus all security/supply-chain workflows on the resulting exact head. Keep Draft until current-head automated and independent review gates are satisfied. Do not merge or synthesize approval.

[seonghobae]

Current-main replacement is now PR #835 at exact head 4881c7860a1ed503917e68cc096dbfb1cdb75b36, rebuilt directly from protected main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba after confirming the stale-base→current-main delta did not touch the mention router or its tests. Treat this #825 branch as read-only historical provenance while #835 validates. No check, review, approval, comment, or synthetic-merge evidence transfers. Close #825 as superseded only after #835 proves its own exact-head gates and bounded five-file equivalence; #814 still requires protected-main runtime receipt/dispatch evidence.