Bind final PR body reconciliation to workflow intent

[Wibias]

Summary

Fix the merge-ready workflow defect where update_pr_body is denied with explicit_instruction_required even though final PR-description reconciliation is a mandatory step of an already authorized create-pr-for-issue workflow.

Safety boundary

The intended fix must remain narrow:

• only controller-owned final-gate reconciliation may inherit workflow intent;
• the grant must be bound to the canonical PR, controller head, and exact mutation payload;
• changed PR/head/body must fail closed;
• earlier phases and standalone body edits must still require independent user intent;
• Protection Off may remove only the Authority-host layer, not controller-owned user intent.

Validation

RED-first regression added. Production change follows after the failing behavior is confirmed.

Do not merge yet.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}