Add Ota execution governance and non-blocking matrix

[bobaikato]

Scope

This draft intentionally contains only:

• a reviewable ota.yaml for contributor-facing Elixir, MCP, Rust worker, site, and non-credentialed conformance lanes;
• a separate non-blocking Ota workflow.

It changes no Pythia implementation code, formatting, dependencies, or existing workflows.

Exercised matrix

The fork pressure matrix used released Ota v1.6.27 and retained declaration, Ubuntu, macOS, Windows, and Linux-container evidence:

https://github.com/bobaikato/pythiaLabs/actions/runs/33517820099

Confirmed passing surfaces include contract validation and discovery, the Linux Node container lanes, MCP smoke on Ubuntu/macOS, Rust worker build/test, site build, and the non-credentialed Python conformance suites.

A separate combined repair matrix verified the two proposed Windows repository fixes without adding them to this adoption PR:

https://github.com/bobaikato/pythiaLabs/actions/runs/33540883165

Its Windows artifact records verify-elixir-test=0 and verify-mcp-smoke=0. Existing Elixir-format and Prettier deviations remain unchanged.

Repository findings kept outside this PR

• Windows worker executable resolution: Fix Windows worker executable resolution #266
• Windows MCP process portability: Make MCP Mix invocation portable on Windows #265
• macOS ARM64 Rustler/NIF linker evidence: macOS arm64: Rustler NIF link fails with undefined enif symbols #267
• existing Prettier deviations remain unchanged

Boundaries

Credentialed CAEP/provider calls, GitHub merge, Gmail/GitHub communication, the Liminal multi-repository lifecycle, provider authority, agent-safe execution, deployment, and repository-global governance remain unproved. Pythia ALLOW is input evidence only and never Ota execution authority.

Nothing in this draft implies merge approval, endorsement, representation, or a public design-partner announcement.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 2b67e762-6b47-4ab7-b07b-35efd13a127e

📥 Commits

Reviewing files that changed from the base of the PR and between 17df877 and 587e722.

📒 Files selected for processing (2)

• .github/workflows/ota-adoption.yml
• ota.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Exact-head review: 587e722c7c7af9dfcfa12a16104a35f8690171ce.

Workflow preflight found:

• pull_request, not pull_request_target;
• explicit contents: read permissions;
• no credentialed provider lane or repository mutation;
• Ota setup pinned to 493cba84bf7f7c11c9e8e996d832d93a89c62184;
• agent.safe_tasks, writable paths, and verify-after-change remain empty;
• networked setup is declared and remains maintainer-reviewed.

That is a defensible boundary for ephemeral CI execution. One proof caveat remains load-bearing: jobs use continue-on-error: true, so an overall green workflow is not evidence that every selected lane passed. Review the per-lane .exit artifacts and preserve failures explicitly.

Advisory status: HOLD / NOT_RUN. The run is currently action_required; source review supports allowing it, but execution evidence does not yet exist on this head.

[safal207]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.