fix(lifecycle): route PR comments without recovery authority

[Niko4417]

Scope

• Accepted issue: Defect: Route PR comments without issue-bound recovery authentication #162
• Accepted planning-contract version: v2
• Automated readiness record: Defect: Route PR comments without issue-bound recovery authentication #162 (comment)
• Actual source branch: codex/162-pr-comment-routing-v2
• Accepted target branch: dev
• Parent epic and Quality Envelope rows: None — standalone defect; it restores lifecycle reconciliation required before epic Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49 can continue, without changing that epic's scope.
• Change classification: defect
• Product decision, finding, or incident: ADR-0012 Option A accepted by decision Decision: Separate PR-comment wakes from issue-side lifecycle recovery #163 and merged through PR Decision: separate PR-comment wakes from issue recovery #164; accepted fingerprint 6c5e4a5c947a27c8fcaf68788140e8c610b8e8e9e209a26939efbc4d46051057.
• In scope: separate plain-issue recovery authentication from ordinary pull-request-comment reconciliation; validate positive safe comment IDs for both resource classes; cover created, edited, deleted, and malformed inputs.
• Out of scope: lifecycle schema, state topology, permissions, provider budgets, activation, effects, merge authority, ADR changes, and native product behavior.
• Native targets, contracts, or trust boundaries affected: protected lifecycle wake routing and the recovery-authentication boundary only; no native target changes.

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no
  semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality
  Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records
  why Existing Keiko evidence is not applicable.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing
  Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native
  layer.
• Any durable architecture change is recorded in an ADR.

Existing Keiko evidence is not applicable: this fixes a repository-owned GitHub lifecycle routing defect against accepted Native ADR-0012.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1	Router tests cover created, edited, and deleted PR comments, stable PR mapping, and empty recovery metadata	203625d74b48abdd91f9d8025399853b44cc968b	Passed
AC2	Wake and router tests retain the exact canonical recovery ID for a direct plain-issue comment	203625d74b48abdd91f9d8025399853b44cc968b	Passed
AC3	Both resource classes reject missing, null, zero, negative, fractional, string, and unsafe IDs; PR validation precedes provider reads	203625d74b48abdd91f9d8025399853b44cc968b	Passed
AC4	Focused suites, full quality, and audit are green; activation and effect code are unchanged	203625d74b48abdd91f9d8025399853b44cc968b	Passed locally; protected post-merge proof remains

Acceptance journey evidence

• Applicability: Not applicable — issue #162 is repository governance with no desktop or user-facing surface; its accepted observable contract is deterministic protected routing behavior.

• Automated checks exercise user-visible outcomes rather than incidental implementation
  details.

• Required failure, recovery, accessibility, visual, and platform observations are settled.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is
  covered.
• The actually wired production composition was tested where this change crosses layers.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is
  attached or linked.
• Excluded quality areas retain the rationale accepted in the issue.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source,
  tests, logs, evidence, artifacts, issues, and this pull request.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high
• Every declared native target-specific gate passed on its authoritative platform.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure
  modes.

Additional affected checks and concise results:

node --test --test-name-pattern="comment" quality/lifecycle-wake.test.mjs quality/lifecycle-wakeup-router.test.mjs quality/lifecycle-github-provider.test.mjs
  PASS — 7/7 selected comment tests
node --test quality/lifecycle-wake.test.mjs quality/lifecycle-wakeup-router.test.mjs quality/lifecycle-github-provider.test.mjs quality/workflow-structure.test.mjs quality/contract.test.mjs
  PASS
npm run quality
  PASS — control plane and every declared native gate with Node 24.18.0 and npm 11.16.0
npm audit --audit-level=high
  PASS — 0 vulnerabilities
git verify-commit 203625d74b48abdd91f9d8025399853b44cc968b
  PASS — good ED25519 signature for niko.vasilopoulos96@gmail.com

Independent audit and findings

• Audit scope and dimensions: accepted v2 scope; ADR-0012 Option A; recovery trust boundary; malformed inputs; stable PR mapping; provider-read budget; unchanged schema, lifecycle, activation, effects, and merge authority.
• Audited commit: 203625d74b48abdd91f9d8025399853b44cc968b

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
None	Full four-file diff and accepted verification commands	No confirmed local findings	Exact-head remote checks and requested Codex review are being collected before promotion

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to
  a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Not applicable — standalone defect #162 restores lifecycle reconciliation needed by epic #49 but does not itself deliver that epic's integrated acceptance surface.
• Production-composition result: direct locator validation and protected router composition pass locally.
• Machine-enforced acceptance result: focused and complete accepted suites green; full quality green; audit reports zero vulnerabilities.
• macOS evidence: every locally declared native gate passed through npm run quality; no native source changed.
• Windows evidence: no platform-specific source changed; exact-head remote matrix is authoritative.
• Manual usability, accessibility, visual, signing, or packaging evidence: usability, accessibility, and visual evidence are not applicable; signed commit and repository packaging gates passed.

Delivery

• Target path: standalone -> dev
• The target branch matches the delivery path accepted in the issue; no direct push, force
  push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected
  producer.
• Advisory tools are not treated as required merge authority under the current quality-gate
  policy.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current.
• A draft pull request was not promoted to Ready for Human Review before every required
  Acceptance Journey result and exact-head gate was complete.

For an epic or standalone pull request targeting dev, complete only by Niko or Oscharko. Agents
must leave this subsection untouched, stop at Ready for Human Review, and must not enable
auto-merge.

• I reviewed the linked issue and pull request, including scope, acceptance criteria, Quality
  Plan, evidence, checks, findings, conversations, and residual risks on the commit above.
• I am manually initiating the merge into dev; no automated actor is performing it.

Residual risks and follow-ups

• After a maintainer manually merges this PR, request the accepted protected post-merge proof against PR Governance: add exact migration inventory and dry-run orchestration #156 and record successful ordinary reconciliation with empty recovery metadata before closing Defect: Route PR comments without issue-bound recovery authentication #162.

Refs #162

[Niko4417]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 573eccb1d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Niko4417]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 203625d74b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud