Quarantine fleet mutations pending directive enforcement; audit repository policies

[arena-ai-coding-agent]

Summary

Safety-first containment and evidence, not activation of the fleet:

• Quarantine main mutation paths until repository-local directives are enforced: dispatch, live fixes, findings processing, rule/issue publication, fake deployment readiness, and RRA CLI mutations.
• Remove the Rust fleet CLI's simulated-success execution.
• Add containment tests and run them in the E2E workflow.
• Add read-only, commit-pinned directive census tooling with offline regression tests.
• Document wiring defects and a census of 352 visible repositories: 746 bot-directive files and 607 AGENTIC candidates, including nested projects/templates; 512 unique content blobs fetched and hash-verified.
• Preserve evidence metadata and a per-repository matrix. No raw directive bodies or credentials are included in the census artifact.

Why

The audit reproduced successful fix outcomes with no target checkout or executed fixer, and zero-coverage supervised scans returning success. Existing directives contain protected paths, draft-PR-only requirements, approval gates, data-preservation rules, legacy layouts, and retired exceptions. Repairing execution before enforcing these constraints risks destructive estate-wide changes.

Operational impact / review carefully

• This deliberately blocks the guarded entry points; shell quarantine exits with 78, Rust guards return errors. Scheduled learning/processing jobs using this revision may fail visibly instead of claiming success.
• Dispatch is blocked even with --dry-run because that path writes outcome/heartbeat state.
• There is no environment-variable bypass. Removing the guards requires a reviewed change.
• This is not an estate-wide shutdown or a complete policy engine. Direct fix scripts, library callers, enrollment writers, external apps, existing services and old binaries remain outside these CLI guards.
• No target repository directives were rewritten and no repository was approved for mutation. No auto-merge is requested.
• The proposed reusable policy resolver is follow-up work and is not implemented in this PR.

Evidence and limitations

Start with:

• docs/AUTOMATION-QUARANTINE.adoc
• audits/fleet-wiring-2026-09-26.md
• audits/directive-census-2026-09-26/REPORT.md

The census's evidence.json (~2.5 MB) accounts for most of the diff and contains paths, pinned revisions, hashes and retrieval metadata. Human semantic review was selective, not an approval of all fetched content. julia-ecosystem returned a truncated tree; private/inaccessible repositories, submodule contents, local-only guidance and deployed enforcement remain unverified.

Validation

• bash tests/automation-quarantine-test.sh
• bash tests/directive-census-test.sh (offline fixtures; no GitHub calls)
• Shell syntax checks for changed/new scripts
• git diff --cached --check
• bash tests/e2e.sh: 36 passed, after installing the existing PyYAML test dependency in a temporary directory
• Rust compilation/tests: not run locally; cargo/rustc unavailable. Rust guard tests were added and require a Rust-enabled environment before merge.

No executor, deployment or estate-wide workflow was enabled to perform validation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f475eb7c-9e94-4cc2-9148-05b328c0d093

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arena-ai-coding-agent]

Merge-blocker investigation

The missing checks are not passing checks with a naming mismatch: they did not start.

• E2E run 36251355534: annotation “Actor is not allowed to trigger Actions workflows.” No jobs were created.
• Rust run 36251357336: same actor rejection. The triggering actor is arena-ai-coding-agent[bot].
• CodeQL run 36251358967: invalid .github/workflows/actions.lock, with GitHub instructing regeneration using gh actions-lock.
• The lock lists CodeQL b96794f..., while the workflow pins 1c5b675...; it also lists haskell-actions/setup@v2.12.0 while casket-pages.yml uses v2.12.1. This confirms drift, but does not prove these are the only lockfile problems.
• Codeac's commit status description is “Codeac was not able to perform analysis.” It is not evidence of a reported code defect.

The normal and owner-authorized --admin merge attempts were rejected by repository rules. The test-only E2E rerun was refused. Actions-permission inspection returns HTTP 403 for this integration. No rules were changed, no required check was removed, and no success status was manufactured.

Remaining actions

1. Owner/admin: investigate the actor restriction for this GitHub App and restore narrowly scoped CI triggering, or trigger appropriate validation through an allowed owner identity. This session cannot fix the account-side restriction through source edits.
2. In an environment that can install GitHub's official github/gh-actions-lock extension, regenerate the lockfile against this branch's existing workflow refs. Preserve the explicit CodeQL version restriction. Verify with the generator and the repository's scripts/check-lock-sync.sh, including transitive dependencies, before committing to this same branch.
3. Run the actual required tests and address their results before another merge attempt. Rust remains uncompiled in this session.

I attempted installation of the official extension and a direct download of its v0.1.6 Linux release. Both were blocked by connections to release-assets.githubusercontent.com failing (EOF/TLS error). I did not hand-edit the generated lockfile or invent hashes.

The fleet quarantine is unchanged. This investigation neither enables bot execution nor approves repository mutations outside the PR work.