fix(noema): skip draft sidecar artifact upload - #2563

2026-10-03 action-identity oracle repair (authoritative)

• Exact head: e8becafcf51b0d0063895f9889585eafd45cff49; tree: 4bd922621de35403e9a5cce2d34458e7d9acedc9; parent: 70b297431f8e52a53c79b24a684e858840b447ae; live base: canonical fix(ci): integrate parser, security, response, and coverage gates #2530 at e4fcd3ad277930b02a734302d7a6d0fd9315ec14.
• RCA/RED: the prior YAML oracle selected the first step by display name. A compliant no-op decoy followed by the real fail-open upload-artifact therefore produced 10 passed. Its first action-identity repair was also case-sensitive, so a lower-case decoy plus mixed-case Actions/Upload-Artifact@… actual upload remained accepted until an executable alias mutation made the focused contract fail.
• Smallest GREEN: inspect the parsed job's case-normalized uses identity, require exactly one actions/upload-artifact@ step, and bind that step's name, Draft gate, artifact name, and failure propagation. The alias mutation derives the live pinned reference, proves replacement occurred, and uses a successful CHANGELOG.md decoy upload. Production workflow behavior is unchanged.
• Exact-tree local evidence: focused 10 passed; full branch-coverage suite 5,310 passed, 10 skipped, 40 subtests passed; production 18,767/18,767 statements and 7,648/7,648 branches; production Docstring coverage 100%; git diff --check GREEN.
• Independent review found the case-alias and initially vacuous mutation-fixture defects; both were repaired. Final independent re-review: findings 0.
• Fresh hosted exact-head receipts: Security 37128406643 jobs 111218368569/111218368655 and CodeQL 37128406628 job 111218368304 terminated before executable steps (steps=null); downstream jobs skipped. SAST 37128406727, job 111218369071, also terminated before executable steps (steps=null). These are infrastructure blockers, not acceptance evidence.
• Review state: Ready for review / Proposed / status: blocked / merge HOLD. Fresh executable exact-head hosted Checks and a qualifying independent APPROVED review remain mandatory. No bypass, auto-merge, manual rerun, Force Push, destructive rebase, close, or predecessor retirement is authorized.

Earlier authority sections below are lineage evidence and are superseded by this section.

2026-10-03 canonical-owner restack (authoritative)

• Exact head: 9b4e1dd553382a603ad8f8b7b8dc536bbbec6176; tree: f6a3c911f76bcb35578bb6581edf2dbea0e2d88f; live base: canonical fix(ci): integrate parser, security, response, and coverage gates #2530 at e4fcd3ad277930b02a734302d7a6d0fd9315ec14.
• Ordinary parents are the prior leaf and current fix(ci): integrate parser, security, response, and coverage gates #2530; the branch ref advanced with force=false.
• The restack carries fix(security): refresh shared PyJWT and PyO3 locks #2531's semantic prerelease oracle test, changelog, and exact RED/GREEN Gap evidence without copying or discarding the leaf delta. The effective leaf delta remains exactly four paths: Noema workflow, CHANGELOG, complete Gap baseline, and the Draft-admission regression contract.
• Security 37081020281 and SAST 37081020104 failed before runner steps; CodeQL 37081020279 is Draft-skipped. These results are not acceptance evidence.
• State remains Draft / Proposed / merge HOLD with zero qualifying approval. Fresh exact-head terminal Checks and independent review remain required. No bypass, auto-merge, manual rerun, Force Push, destructive rebase, close, or predecessor retirement is authorized.

Earlier authority sections below are lineage evidence and are superseded by this section.

Goal

Live Draft pull requests already skip contextual-orchestrator provisioning. Keep that intentional skip independent of GitHub Actions artifact storage quota while preserving fail-closed evidence upload for every non-Draft review.

RCA and executable evidence

• Exact failing consumers:
  • .github#2530@153cbabecc067a4c67fc34bdc07e840b6f5b62d7, Noema job 111068439116
  • .github#2543@f5a1d47d0e744dbc2562ed7ce99a38cd18671742, Noema job 111069409132
• Both jobs authenticated the exact live head, read draft=true, skipped every model/sidecar step, then ran Upload contextual-orchestrator sidecar evidence.
• actions/upload-artifact found two pre-existing sidecar files and failed with Failed to CreateArtifact: Artifact storage quota has been hit.
• RED 0141fee7ec11a003ec432c7e6c73dd858d9c30c8: focused contract 1 failed / 9 passed.
• GREEN 3eff240e213c9d2a3e3f382243ffb4c4b6c1ab13: the upload uses the same live-Draft output as provisioning. Non-Draft upload failures remain job failures.

Verification

Exact tree: 1d41b1bcad3e13b5bf305120db4ef9f52d3c135e.

• focused Draft admission: 10 passed
• warnings-fatal full suite: 5,309 passed, 10 skipped, 40 subtests passed
• production coverage: 18,767/18,767 statements; 7,648/7,648 branches (100%)
• production Docstring coverage: 100%
• warning-fatal compileall, YAML parse, and git diff --check: GREEN
• actionlint was not present locally

Fresh exact-head hosted evidence

• Required OpenCode run 37078264466: SUCCESS
• Required Noema run 37078264533: FAILURE in job 111072965472; exact-head admission and live-Draft detection succeeded, model/sidecar provisioning skipped, then the protected main@37b10243… workflow executed the pre-repair upload condition and hit the same artifact-quota failure. A pull_request_target workflow source change cannot validate itself before protected integration.
• Security run 37078264629 and SAST run 37078264618: pre-runner infrastructure failures; failed jobs have no runner and steps=[].
• CodeQL and Strix: skipped while Draft.
• unresolved review threads: 0; qualifying independent approvals: 0.

State

Draft / Proposed / merge HOLD. Fresh protected-source validation and qualifying independent review are required. No force push, destructive rebase, bypass, or paid/model fallback is introduced. Model-backed review remains fixed to orchestrator/free.