fix: harden projection repair workflow guards

Author: PLeVasseur

.github/workflows/reviewer-bot-sweeper-repair.yml

@@ -74,6 +74,7 @@ jobs:
           mkdir -p "$RUNNER_TEMP/reviewer-bot-repair-output-${GITHUB_RUN_ID}-attempt-${GITHUB_RUN_ATTEMPT}"
           uv run --project "$BOT_SRC_ROOT" reviewer-bot
       - name: Upload repair artifact
+        if: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.action == 'repair-review-status-labels' || github.event.inputs.action == 'repair-issue314-state-health') }}
         uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
         with:
           name: reviewer-bot-repair-output-${{ github.run_id }}-attempt-${{ github.run_attempt }}

scripts/reviewer_bot_lib/maintenance.py

@@ -250,6 +250,8 @@ def derive_manual_dispatch_projection_policy(request) -> ManualDispatchProjectio
         return ManualDispatchProjectionPolicy(action, issue_number, False, True, "targeted_status_label_repair")
     if action == "repair-review-status-labels":
         return ManualDispatchProjectionPolicy(action, issue_number, True, True, "broad_status_label_repair")
+    if action == "repair-issue314-state-health":
+        return ManualDispatchProjectionPolicy(action, issue_number, False, True, "issue314_state_health_repair")
     if action in {"preview-check-overdue", "preview-status-label-projection", "preview-issue314-state-health"}:
         return ManualDispatchProjectionPolicy(action, issue_number, False, False, "read_only_preview")
     return ManualDispatchProjectionPolicy(action, issue_number, True, True, "normal_manual_mutation")

tests/contract/reviewer_bot/test_workflow_files.py

@@ -438,6 +438,12 @@ def test_sweeper_repair_workflow_exposes_nonce_identity_and_repair_artifacts():
     inputs = on_block["workflow_dispatch"]["inputs"]
 
     assert workflow["run-name"] == "repair ${{ github.event.inputs.action }} issue ${{ github.event.inputs.issue_number }} nonce ${{ github.event.inputs.validation_nonce }}"
+    upload_step = next(
+        step
+        for step in workflow["jobs"]["reviewer-bot-sweeper-repair"]["steps"]
+        if step["name"] == "Upload repair artifact"
+    )
+    assert upload_step["if"] == "${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.action == 'repair-review-status-labels' || github.event.inputs.action == 'repair-issue314-state-health') }}"
     assert inputs["action"]["options"] == [
         "sync-members",
         "show-state",

tests/integration/reviewer_bot/test_app_repair_issue314_state_health.py

@@ -2,6 +2,7 @@
 
 import pytest
 
+from scripts.reviewer_bot_lib import app
 from tests.fixtures.app_harness import AppHarness
 from tests.fixtures.reviewer_bot import make_state, make_tracked_review_state
 from tests.fixtures.reviewer_bot_fakes import RouteGitHubApi
@@ -31,6 +32,7 @@ def test_execute_run_repair_issue314_state_health_removes_closed_rows_through_st
     monkeypatch.setenv("ISSUE314_STATE_HEALTH_REPAIR_SUMMARY_PATH", str(summary_path))
 
     state = make_state()
+    state["status_projection_epoch"] = "stale_projection_epoch"
     make_tracked_review_state(
         state,
         42,
@@ -59,6 +61,11 @@ def test_execute_run_repair_issue314_state_health_removes_closed_rows_through_st
     harness.stub_load_state(lambda *, fail_on_unavailable=False: state)
     harness.stub_save_state(lambda current: saved.append(json.loads(json.dumps(current))) or True)
     harness.stub_sync_status_labels(lambda current, issue_numbers: (_ for _ in ()).throw(AssertionError("issue314 repair should not broad-sync labels")))
+    monkeypatch.setattr(
+        app,
+        "collect_status_projection_repair_items",
+        lambda bot, state: (_ for _ in ()).throw(AssertionError("issue314 repair broadened through epoch repair")),
+    )
 
     result = harness.run_execute()
 
@@ -77,6 +84,7 @@ def test_execute_run_repair_issue314_state_health_removes_closed_rows_through_st
     assert payload["output_keys"] == sorted(payload.keys())
     assert saved
     assert "42" not in saved[-1]["active_reviews"]
+    assert saved[-1]["status_projection_epoch"] == "stale_projection_epoch"
 
 
 def test_execute_run_repair_issue314_state_health_emits_summary_only_after_state_save(

tests/unit/reviewer_bot/test_maintenance.py

@@ -235,6 +235,16 @@ def test_broad_status_label_repair_collection_is_explicit(monkeypatch):
     assert maintenance.collect_status_label_repair_targets(bot, make_state(), request) == (42, 264)
 
 
+def test_issue314_state_health_repair_policy_does_not_broaden_epoch_repair():
+    policy = maintenance.derive_manual_dispatch_projection_policy(
+        SimpleNamespace(action="repair-issue314-state-health", issue_number=314)
+    )
+
+    assert policy.allow_epoch_repair_expansion is False
+    assert policy.allow_status_label_sync is True
+    assert policy.reason == "issue314_state_health_repair"
+
+
 def test_status_label_repair_summary_writes_machine_readable_artifact(monkeypatch, tmp_path):
     summary = maintenance.StatusLabelRepairSummary(
         schema_version=1,

tests/unit/reviewer_bot/test_reviewer_response_policy.py

@@ -25,7 +25,13 @@ def test_legacy_response_dict_normalizes_to_typed_decision():
 
 
 def test_cadence_overlay_projects_reassignment_needed_once():
-    base = to_reviewer_response_decision({"response_state": "awaiting_reviewer_response"})
+    base = to_reviewer_response_decision(
+        {
+            "response_state": "awaiting_reviewer_response",
+            "current_scope_key": "reviewer=iglesias|head=head-a|cycle=none|anchor=assigned",
+            "current_scope_basis": "assigned_at",
+        }
+    )
     cadence = ReminderCadenceDecision(
         issue_number=264,
         reviewer="iglesias",
@@ -45,3 +51,5 @@ def test_cadence_overlay_projects_reassignment_needed_once():
     assert decision.response_state == "reviewer_reassignment_needed"
     assert decision.suppresses_overdue_reminder is True
     assert decision.reason == "legacy_duplicate_reminders_exhausted"
+    assert decision.scope.scope_basis == "reminder_cadence_exhausted"
+    assert base.scope.scope_basis == "assigned_at"