fix(ci): fail closed on unconfigured scheduler mutation budgets - #2267

Draft

seonghobae wants to merge 48 commits into

mainfrom

seonghobae/merge-sched-dispatch-budget-1

Commits on Sep 18, 2026

fix(ci): cap merge-scheduler review dispatches at 1 per run

seonghobae
and
cursoragent
committed
340ed99
fix(ci): differentiate merge-scheduler budgets by trigger

seonghobae
and
cursoragent
committed
6af39ec
fix(ci): fail loud when schedule recovery silently skips dispatch

seonghobae
and
cursoragent
committed
75c3d32
fix(security): allowlist https://api.github.com before urllib urlopen

seonghobae
and
cursoragent
committed
a83d6d3
fix(scheduler): fail closed empty review_dispatch_limit to 1

seonghobae
and
cursoragent
committed
18dbe00
fix(ci): let schedule recovery update despite in-flight checks

seonghobae
and
cursoragent
committed
6000222
fix(sast): clear the three Semgrep findings that fail every PR here

seonghobae
and
claude
committed
5b9e864
test(security): pin GitHub API redirect credential boundary
seonghobae
committed
225260a
fix(security): contain GitHub API redirects to admitted origin
seonghobae
committed
0ae2204
test(security): pin Strix redirect credential boundary
seonghobae
committed
062663a
fix(security): contain Strix GitHub API redirects
seonghobae
committed
2708a6b
test(security): pin Pages caller-input shell boundary
seonghobae
committed
bb9413a
chore(deps): bump anyio from 4.14.0 to 4.14.2
dependabot[bot]
authored
3758b89

Commits on Sep 19, 2026

test(security): align Strix transport seam with dedicated opener
seonghobae
committed
4dcd25c
test(security): execute Pages shell-input regression
seonghobae
committed
4967d66
test(scheduler): require explicit review dispatch authority (RED)
seonghobae
committed
c797f28
test(scheduler): reject implicit dispatch budget in agent contract (RED)
seonghobae
committed
df17dd4
test(scheduler): fail closed unset review budget in Strix gate (RED)
seonghobae
committed
1214600
fix(scheduler): fail closed without dispatch-budget authority
seonghobae
committed
4f76aa0
docs(scheduler): record explicit budget authority and fail-closed absence
seonghobae
committed
d0d91a2
merge(security): carry #2269 urllib GitHub API opener into #2267
seonghobae
committed
1ee8ef1
merge(deps): carry #2278 anyio 4.14.2 into #2267
seonghobae
committed
8b48ec6
fix(sast): silence Bandit B310 on the same two hardened openers

authored and
seonghobae
committed
ba7f41f
test(sast): cover the codeql opener's origin pin, not just strix's

authored and
seonghobae
committed
e0b6e70
fix(scheduler): preserve structured schedule recovery
seonghobae
committed
174592e
test(scheduler): cover structured recovery taxonomy
seonghobae
committed
7694a8d
merge: integrate GitHub API redirect authority successor
seonghobae
committed
3923b19
docs(sast): record lossless successor stack
seonghobae
committed
5896e60
fix(scheduler): integrate canonical GitHub API authority
seonghobae
committed
1a9074b
fix(scheduler): integrate explicit mutation budget authority
seonghobae
committed
338acae
merge: carry current GitHub authority evidence into scheduler
seonghobae
committed
fb202c1
fix(scheduler): restore verified integration tree
seonghobae
committed
71398d9
merge: carry current GitHub authority evidence into SAST repair
seonghobae
committed
5c71e88
test(scheduler): specify zero and unlimited budget contracts
seonghobae
committed
c870496
fix(scheduler): preserve zero and unlimited budget authority
seonghobae
committed
f275c57
docs(scheduler): record zero-budget authority repair
seonghobae
committed
e8252ce
merge: integrate current GitHub API authority owner
seonghobae
committed
5f51355
test(ci): prove G-17 ancestry guard independently
seonghobae
committed
03bc3aa
merge: carry current GitHub authority owner into SAST repair
seonghobae
committed
cd3b41b
merge: align scheduler repair with protected owner
seonghobae
committed
f27626a
fix(scope): leave AnyIO lock update with dependency owner
seonghobae
committed
3eb0a5c
test(strix): require fixture evidence binder
seonghobae
committed
857e788
fix(strix): materialize evidence binder in fixtures
seonghobae
committed
89cee55
docs(strix): record fixture runtime RCA
seonghobae
committed
1eb03c7
test(strix): require complete isolated fixture runtime
seonghobae
committed
8f66ead
merge: adopt protected main before Strix repair
seonghobae
committed
354692e
fix(strix): restore and close isolated fixture runtime
seonghobae
committed
4e8829f
fix(ci): adopt Strix fixture runtime owner repair
seonghobae
committed
0d32464