fix(codeql): wake required jobs with the exchanged target app token

[seonghobae]

Owner session: fast-mlsirm-commercialization

Outcome

Canonical combined successor for the central CodeQL producer/handler cycle, exact required-run recovery, strict head-envelope validation, and stacked-PR check admission.

• Exact head: 6706c231ab06a3c91c43fdb5b989cfcd79fff593
• Exact tree: 0f07c4e60f2e02fc60a0204a4cdfb0f42efbabc2
• Base: protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db
• Compare: 144 ahead / 0 behind, 24-file combined delta
• State: Ready/Proposed; Ready admits fresh review, while terminal exact-head checks and a qualifying independent approval remain merge gates

Root causes and repair

1. A handler superseded after initial validation cannot publish a status: publication requires the second live PR/base/head validation to succeed.
2. The proposed head-only compatibility context was unsafe because an old success could be reused after a same-head base or required-run change. The evidence-complete #1902 producer is integrated as the second parent, and the handler publishes only codeql-dispatch/<language>/<base_sha>.
3. Publication requires the exact SARIF artifact upload to succeed and verifies the creator returned by the status API for the selected credential boundary.
4. Producer receipts bind exact base/head/run, protected workflow source and title, actor, successful validation/required jobs, gate, SARIF, artifact, and response creator.
5. One run-wide settlement owner revalidates live PR/base/head, exact required run/jobs, handler gates and nonexpired artifacts before one run-level rerun mutation.
6. Live forward-only base advancement restarts the whole exact required run; rewritten/divergent bases fail closed.
7. Raw nested pr_head types/schema and independently supplied legacy scalars must agree.
8. The target App → PR_REVIEW_MERGE_TOKEN → OPENCODE_APPROVE_TOKEN → same-repository token fallback chain remains explicit and authenticated.
9. Direct evidence authenticates handler runtime source against protected central .github/main, not against the target PR synthetic merge history; unprotected, rewritten, sibling, and unrelated sources fail closed.
10. Destructive-boundary active-run refresh uses the same host-scoped Actions credential selector as cancellation, so a denied general read token cannot retain a stale central run when the central token can verify it.
11. The stacked-PR security contract rejects both branches and branches-ignore filters.
12. failed-mode dispatch sends one top-level required_jobs authority that the protected pre-cutover handler can consume; only whole-attempt all mode uses the nested envelope, preserving the ten-property limit.

Complete carryover and non-force lineage

This head completely carries the valid commits, tests, documentation, and requirements from #1902, #2004, #2043, and #2044. They remain open Proposed predecessors; none is closed or treated as delivered before ordinary integration.

• RED 6901dd6: two-parent merge of prior fix(codeql): wake required jobs with the exchanged target app token #2040 and exact fix(codeql): recover reruns after missing dispatch verdict #1902, with the contract rejecting the remaining head-only bridge.
• GREEN d7bb95f: base-bound-only publication, SARIF preservation gate, and response-creator validation.
• Ordinary child 91a94a2: protected-handler source authentication plus the two current-head review repairs.
• Ordinary child 6706c23: protected-handler wire compatibility after exact handler run 34249932036 exposed SUPPLIED_REQUIRED_JOBS: null.
• No force push or destructive rebase was used.

Exact-tree verification

• focused producer/handler/recovery contracts: 133 passed
• scheduler and stacked-security contracts: 336 passed
• full repository: 3088 passed, 1 skipped, 21 subtests passed
• Deprecation Warning error mode: passed
• git diff --check: passed
• exact tree matched after Git Data publication (0f07c4e60f2e02fc60a0204a4cdfb0f42efbabc2)

Fresh exact-head hosted checks

Predecessor CodeQL run 34249195529 is terminal FAILURE. Exact handler run 34249932036 proved the cutover defect: protected main received the nested-only payload as SUPPLIED_REQUIRED_JOBS: null. That failure is not transferred to the new child.

The ordinary child generated a new exact-head generation:

• CodeQL PR 34251822255: IN PROGRESS
• Security Scan 34251822390: SUCCESS
• SAST Semgrep 34251822314: IN PROGRESS
• Python Security 34251822251: IN PROGRESS
• Agent Review Runtime Quality CI 34251822381: IN PROGRESS
• Independent exact-tree verification: focused CodeQL contracts 133 passed; full warning-error repository suite 3088 passed, 1 skipped, 21 subtests passed; Python compile and git diff --check passed.

Merge gates

Fresh exact-head terminal checks and a qualifying current-head independent approval remain mandatory. No predecessor check or review transfers. No merge, self-approval, auto-merge authorization, protection bypass, manual rerun, synthetic status, empty push, force push, destructive rebase, or Close was performed.

Summary by CodeRabbit

• 새 기능

  • 모든 PR 기반 브랜치에서 Python 보안 및 런타임 품질 검사가 실행됩니다.
  • CodeQL이 PR의 베이스·헤드·생성 출처를 검증하고, 실패한 필수 검사를 전체 재실행합니다.
  • 스케줄러가 저장소별 자격 증명으로 Actions 실행을 조회·취소합니다.

• 버그 수정

  • CodeQL 재실행과 상태 판정의 누락·오용 가능성을 줄였습니다.
  • 불완전하거나 모호한 SARIF 증거로 인한 잘못된 성공 판정을 방지합니다.

• 문서

  • CodeQL 검증, 재실행, 자격 증명 및 PR 검사 범위 문서를 보강했습니다.

[seonghobae]

Terminal update for the existing partial LineageWeave reproduction on exact ContextualWisdomLab/LineageWeave@8c3f2048a7a5b914b370c2c071c5e1e77e0bcda3 / CodeQL run 34409336311: final dispatch job 102664950438 is now GREEN. Python 102660984817, JavaScript/TypeScript 102660984850, and Actions 102660984873 all successfully read the same current-head dispatch verdict, then fail only at Release runner or enforce current-head CodeQL verdict; language detection 102659828050 and final dispatch are GREEN. This upgrades comment 5609439173 from partial to terminal consumer evidence. Please keep the fix in canonical .github and require owner protected integration before consumer acceptance; LineageWeave still has no local synthetic receipt/status, bypass, rerun shim, provider/model pin, or mutable owner-head dependency.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head 682c188d7e6a69509572405552881cbb1a6d633a: CodeQL PR run 34412045528. Detect Languages job 102668464363 is GREEN. Compatibility jobs Actions 102670390473, JavaScript/TypeScript 102670390519, and Python 102670390528 each successfully read the current-head dispatch verdict and then fail closed only at Release runner or enforce current-head CodeQL verdict. Final dispatch job 102674350495 is GREEN. This reproduces the canonical producer/handler boundary without a LineageWeave-local synthetic receipt/status, bypass, waiver, or mutable owner-head dependency. Protected .github integration remains the prerequisite before consumer acceptance.

[seonghobae]

Fresh downstream exact-head canary from ContextualWisdomLab/accounting-information-platform#59@c82867925ab6d1b5cfbd3122aaad9fe8284f37a4 confirms the remaining receiver-before-dispatch ordering defect under the current protected producer generation.

Required CodeQL PR run 34411211361 is terminal FAILURE. CodeQL compatibility analysis (python) job 102668406208 terminal-failed enforcement at 2026-09-09T22:33:03Z; CodeQL compatibility analysis (actions) job 102668406142 terminal-failed at 22:33:22Z. The same required run's authoritative Dispatch current-head CodeQL scan job 102670844508 did not start until 22:42:43Z and completed SUCCESS at 22:42:50Z.

So both receivers irreversibly failed before same-run dispatch could even start. This is not evidence for accepting legacy/head-only status or weakening repository/PR/base/head/language/required-run/SARIF identity. The canonical repair still needs receiver/current-head enforcement downstream of authenticated terminal dispatch/publication, or an equivalent exact-run settlement barrier. No leaf rerun, synthetic status, no-op push, actor weakening, or gate bypass was used.

[seonghobae]

P1 stale protected-base finding from fresh 2026-09-10 state. Protected .github/main advanced normally from 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db to 88d49f726be8ce5d78f9f6966026a5b3b78a148f through merged #2057 after this head and its hosted generation were created. This PR still has exact head 6706c231ab06a3c91c43fdb5b989cfcd79fff593; GitHub now reports it non-mergeable while its body and CodeQL run 34251822255 remain bound to the former protected base. Treat #2057 as an intervening protected delta, not a race or a closure condition. Preserve every valid #2040/#1902/#2004/#2043/#2044 repair/test/evidence delta and adopt 88d49f7... by ordinary non-force semantic restack/merge. The successor must regenerate exact-head tests/workflows/review; attempt-7 and all old-base hosted results remain historical and cannot transfer. Do not force-push, destructively rebase, choose whole-tree ours/theirs, weaken the base-bound evidence identity, or close this PR merely because protected main advanced. Re-evaluate the pre-cutover direct-evidence and required-job-set findings only against the new exact base/head.

[seonghobae]

Exact-head RCA — CodeQL coordinator sees a stale Jobs API snapshot

Current exact head 6706c231ab06a3c91c43fdb5b989cfcd79fff593, CodeQL PR run 34251822255.

The failure is not a SARIF/source vulnerability and not a missing workflow dependency. dispatch-current-head already has needs: [detect-languages, analyze-head] with always(), and the contract test explicitly enforces that structure.

The coordinator job 102154736341 failed with:

CodeQL coordinator could not bind every pending language to an exact failed job.

The current script snapshots actions/runs/${REQUIRED_RUN_ID}/jobs once, then adds a matrix entry to required_jobs only when that API object is already status == completed && conclusion == failure. In this hosted run the coordinator was admitted after the matrix dependency completed, but the Jobs API snapshot had not yet converged to the terminal failure state for every compatibility shard. pending_matrix therefore contained languages for which required_jobs was temporarily incomplete and the exact-language binding check failed closed.

This is an Actions Jobs API read-after-job-completion consistency race. Do not solve it by removing the exact job binding, accepting in-progress jobs, weakening fail-closed behavior, manually rerunning, or adding an unbounded poll.

Recommended causal repair: isolate the current-run job-map fetch into a bounded convergence loop. Re-read only repos/${GITHUB_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}/jobs until every expected CodeQL compatibility analysis (<language>) has one numeric job id and a rerunnable terminal conclusion (success|failure), with a small finite attempt bound. After the bound, retain the current fail-closed error. Revalidate the live PR/base/head after convergence and before OIDC/token acquisition. Add a regression fixture where the first Jobs API response exposes a matrix job as in-progress and the second exposes the same job id as completed/failure; require exactly one repository_dispatch and no relaxation of unrelated-failure rejection.

This also reduces 60-job churn tracked in #1928 because an eventual-consistency miss no longer forces a whole fresh PR generation. No source change or GREEN claim is made by this comment.

[seonghobae]

CO 인프라 복구 과정에서 두 핵심 workflow의 전체 patch를 검토했습니다. 병합된 것은 CO #1105/#1082/#1118/#1066/#1072 및 중앙 #1978/#2053이며, 이 #2040은 아직 병합하지 않았습니다.

추가로 확인할 cutover 경계: codeql-pr.yml의 기존 producer payload에는 producer_source_sha가 없고 이 head에서 새로 추가됩니다. 동시에 이 head의 codeql-scan-dispatch.yml은 SUPPLIED_PRODUCER_SOURCE_SHA가 없으면 무조건 CodeQL producer source is missing or malformed로 종료하며, run-name에도 /producer_source_sha 또는 /missing-source를 새로 붙입니다. 따라서 required_jobs의 top-level 호환성만으로 기존 protected/queued producer → 새 handler 호환성이 입증되지는 않습니다. 이미 시작된 구 producer 또는 구 revision을 고정한 consumer는 새 필드를 보내지 않습니다.

이는 현재 diff에 근거한 정적 cutover 지적이며, 이 세션에서 구 payload를 새 handler에 보내 실행 재현하거나 새 테스트를 수행했다는 뜻은 아닙니다. 병합 전 기존 producer envelope → 새 handler, 새 producer → 새 handler를 각 exact revision으로 검증하고, 구 revision을 지원하지 않는 정책이라면 미완료 구 실행을 안전하게 정리한 뒤 fresh producer 실행을 만드는 배포·복구 계약을 함께 제공해야 합니다. 누락 SHA를 임의 값으로 채우거나 base-bound/SARIF/actor 검증을 낮추는 방식은 제외합니다.

#2051의 별도 base_ref 포함 run-name 계약과도 함께 비교해야 합니다. CO 314645dc의 직접 CodeQL/supply-chain/SBOM은 push run34420642748에서 통과했지만, 그것이 이 중앙 required-dispatch 경로의 복구 증거는 아닙니다.

[seonghobae]

Fresh protected-main advancement changes this exact head's acceptance boundary again. Protected .github/main is now f578d8d960177ff113c25fd740619b4a483df300; compare from that tip to this head is diverged, 144 commits ahead / 11 behind, merge base 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. Preserve the valid producer/handler, SARIF, base-bound evidence and settlement deltas, but ordinarily/non-force adopt the full current protected delta before claiming current-base evidence. The old hosted generation (34251822255 CodeQL failure plus sibling successes) is historical because it was bound to the old base. Its dispatch-job log still supplies a valid RED for job-set convergence: the coordinator took one Jobs API snapshot and then failed CodeQL coordinator could not bind every pending language to an exact failed job. The successor must boundedly reread until every detected language has exactly one stable terminal rerunnable job identity or fail closed at a deterministic deadline; it must also preserve the authenticated pre-cutover direct-evidence seam. After current-base reconciliation, regenerate exact-head checks and qualifying independent review. No force/rebase, stale-evidence promotion, manual/no-op rerun, creator-only fallback, or gate weakening.

[seonghobae]

Fresh AIP consumer canary from ContextualWisdomLab/accounting-information-platform#59@b704d523b2f58891a5cb45319cf3bed9d9badccf reproduces the same receiver-before-dispatch ordering defect on required CodeQL run 34420227065 without leaf rerun or synthetic status. Actions receiver job 102697493684 started 2026-09-10T00:41:12Z and terminally failed enforcement at 00:43:23Z; Python receiver 102697493716 started 00:43:53Z and terminally failed at 00:46:12Z. The same run's authoritative dispatch job 102701335962 did not start until 01:01:59Z and then completed SUCCESS at 01:02:06Z. Thus both receivers made irreversible decisions before same-run producer/dispatch evidence could exist. Preserve exact repo/PR/base/head/language/required-run provenance; do not fix this by accepting stale/head-only evidence, sleep-only delay, or leaf gate weakening. This is external consumer evidence for the existing central owner path, not a competing .github writer.

[seonghobae]

BandScope read-only consumer canary handoff for the central CodeQL owner. ContextualWisdomLab/bandscope#866 remains Draft at exact head 9bba38562b7827edeac0e5c6c82a0b992fc3ced5, base develop@314ddeae7b775a4957594b599358c8255617eb2e. Its repository build/SBOM/Security/Semgrep paths have source-local evidence separate from CodeQL; the CodeQL compatibility path previously dispatched current-head scans but failed closed while the authenticated terminal verdict was still pending. Do not treat that leaf failure as a BandScope SARIF finding or fix it with a leaf shim/synthetic status. After #2040 reaches protected central truth, use the unchanged then-current BandScope head/base as a consumer acceptance canary and require a terminal authenticated Analyze (javascript-typescript) / Analyze (python) publication bound to exact head+base+required run. If BandScope head/base moves first, discard this receipt and re-read live identity. No manual rerun is requested before the canonical handler prerequisite is integrated.

[seonghobae]

Fresh LineageWeave consumer evidence for exact submitted head 45fc14629ffd4b27d6b969f01fabf8ffe0b2e991, CodeQL PR run 34425499152: language detection 102709745032 is GREEN. JavaScript/TypeScript 102713431552, Python 102713431576, and Actions 102713431596 each completed their Read current-head CodeQL dispatch verdict step successfully, then failed closed at Release runner or enforce current-head CodeQL verdict. The follow-on Dispatch current-head CodeQL scan job 102717311958 has materialized but is still queued, so I am not claiming a terminal dispatch result. No leaf synthetic status, waiver, provider pin, or alternate scanner was added. Please preserve the canonical owner repair path and protected/released acceptance before consumer bump.

[seonghobae]

LineageWeave consumer recheck on exact 45fc14629ffd4b27d6b969f01fabf8ffe0b2e991: CodeQL run 34425499152 is now fully terminal. Detect Languages succeeded. JavaScript/TypeScript 102713431552, Python 102713431576, and Actions 102713431596 each successfully read the current-head dispatch verdict and then failed only at Release runner or enforce current-head CodeQL verdict. The follow-on Dispatch current-head CodeQL scan job 102717311958 is terminal success (completed 2026-09-10T02:12:23Z). This corrects the earlier consumer note/body that still described the dispatch job as queued. LineageWeave keeps the failure fail-closed and will not synthesize a leaf receipt/status or consume mutable owner-head state; protected owner integration and a real post-integration consumer verdict remain required.

[seonghobae]

BandScope read-only consumer canary, no central source ownership requested: ContextualWisdomLab/bandscope#1188 current exact head 1d27109dee9c70ee2f26a4cde20ee92757c06370 (base develop@314ddeae7b775a4957594b599358c8255617eb2e) has terminal SUCCESS for repository ci run 34424877900, build-baseline 34424877879, sbom 34424877892, Security Scan 34424877906, and SAST Semgrep 34424877888, while CodeQL PR 34424877874 alone is terminal FAILURE. Exact compare from predecessor 618afdfd5649cc800e50bfaf3d845fe5b675d794 is one commit ahead with files: [], so there is no new Slider semantic delta to explain a leaf-only analysis regression. Please use this as an additional exact-head/base consumer fixture when validating terminal Analyze (javascript-typescript) / Analyze (python) publication after the central repair becomes protected truth. Do not synthesize status or mutate the BandScope branch from this handoff.

[seonghobae]

Fresh consumer canary from ContextualWisdomLab/Orgmetra#96@6573a6293db49632c525f0979973377869b4817c confirms the settlement-ordering failure remains live on current protected central source.

• CodeQL PR run 34427958061 detected languages successfully.
• Python compatibility job 102720286325 became terminal FAILURE at 2026-09-10T02:37:32Z after Read current-head CodeQL dispatch verdict completed and Release runner or enforce current-head CodeQL verdict failed.
• Actions compatibility job 102720286330 became terminal FAILURE at 2026-09-10T02:42:24Z for the same reason.
• The producer-dispatch job 102724788667 was only created at 02:42:24Z, started at 03:01:55Z, and completed SUCCESS at 03:02:00Z.

Thus at least the Python consumer failed ~24m before the exact-head producer dispatch even started, and the Actions consumer was terminal at the instant the producer job was created. This is not an Orgmetra source RED and should not be repaired by leaf polling/sleep extensions, synthetic statuses, predecessor verdict transfer, or rerun timing.

Also, protected .github/main is now f578d8d960177ff113c25fd740619b4a483df300, while this PR still records base 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. Please adopt/adapt the intervening protected delta by ordinary non-force integration/restack before treating this lane as merge-ready; do not rewrite the existing valid repair lineage.

[seonghobae]

Fresh ConceptWeave consumer reproduction, 2026-09-10: #35 exact 9bb82f041483cb4e0cf1aa1f5450b413309f9a05 generated CodeQL PR run 34434790860 on protected central main@f578d8d960177ff113c25fd740619b4a483df300. Detect CodeQL languages succeeded. CodeQL compatibility analysis (actions) job 102741582733 then spent ~120 s in Read current-head CodeQL dispatch verdict and failed only at Release runner or enforce current-head CodeQL verdict; the subsequent Dispatch current-head CodeQL scan job 102745240270 succeeded. Security Scan and SAST are terminal success, while the CodeQL workflow remains terminal failure. This is a current protected-main consumer witness that the producer/handler settlement path is still incomplete; it is not a ConceptWeave leaf-source finding and a manual/no-op rerun would only replay the same owner defect.

Please preserve this as an acceptance fixture when reconciling #2040/#2051/#2056 onto current protected main: exact target repository/PR/head/base/required-run evidence, bounded terminal job-set convergence, and one authenticated run-wide wake must yield a terminal verdict before the compatibility client deadline. Do not weaken to creator-only/head-only status or transfer old-base 34251822255 evidence.

[seonghobae]

Fresh downstream ordering canary from ContextualWisdomLab/accounting-information-platform#59@b3eec228abb60b1c8b4a7bd9d010d2ed9eb7e691, required CodeQL run 34435726564.

The same-run receivers terminal-failed before the authoritative dispatch job began:

• Python receiver 102744998251: enforcement failure at 2026-09-10T04:41:24Z (job completed 04:41:27Z).
• Actions receiver 102744998361: enforcement failure at 2026-09-10T04:42:18Z (job completed 04:42:20Z).
• Authoritative Dispatch current-head CodeQL scan job 102747604145 did not start until 2026-09-10T04:52:16Z and completed SUCCESS at 04:52:22Z.

This reproduces the current receiver-before-producer/dispatch settlement defect on a new downstream head. It is not an AIP source-analysis finding and does not justify a leaf rerun, synthetic status, sleep-only workaround, or weaker provenance. The canonical owner still needs receiver/current-head enforcement ordered after authenticated same-run dispatch/publication settlement (or an equivalent exact-run barrier) while retaining repository/PR/base/head/language/required-run/SARIF identity.

[seonghobae]

Fresh owner-path handoff from ConceptWeave: protected central main advanced again to cb0872c9a20d5584703dffacca65c096fc034c6c via #1938. This #2040 head is now diverged 144 ahead / 32 behind current protected truth; merge base remains historical 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. #2051 is likewise 18 ahead / 32 behind and currently Draft/non-mergeable. Preserve #2040 producer/handler/SARIF/settlement deltas plus #2051 {base_ref,base_sha}/rollout work and #2056 complete-failed-job-set/atomic-wake work, but adopt cb0872c... by ordinary non-force integration before treating any hosted evidence as current.

The unchanged ConceptWeave #35 consumer fixture still has Security 34434790791 SUCCESS, SAST 34434790777 SUCCESS and CodeQL PR 34434790860 terminal FAILURE: its compatibility analysis timed out/fails before the later dispatch job succeeds. Do not manufacture a leaf/manual rerun. Reproduce this on a current-central successor and close the authenticated terminal-settlement gap there: exact repo/PR/head/base/required-run/language/job/SARIF evidence, bounded job-set convergence, then one run-wide wake and terminal receipt before the compatibility deadline. COMMENT only; no approval/merge claim.

[seonghobae]

Fresh LineageWeave consumer reproduction on ContextualWisdomLab/LineageWeave#996@55e9db7cb288e2dbe524942ac73030e61ca0e0ab: CodeQL PR run 34438925914 is terminal. Detect CodeQL languages job 102749675441 succeeded. Python 102751647407, Actions 102751647434, and JavaScript/TypeScript 102751647464 each succeeded at Read current-head CodeQL dispatch verdict and then failed closed at Release runner or enforce current-head CodeQL verdict. Final Dispatch current-head CodeQL scan job 102754397096 succeeded. SAST and Security are GREEN on the same consumer head; repository-local Tests are skipped because #996 remains Draft. No LineageWeave waiver, synthetic status, leaf scanner substitute, provider/model pin, or head churn is being added. Please keep owner repair focused on publishing/authenticating the exact-head terminal CodeQL verdict so the unchanged consumer head can be revalidated normally.

[seonghobae]

AIP predecessor canary: ContextualWisdomLab/accounting-information-platform@d83e5ccf761729767908f467ab97cbe89b68a3c4, required CodeQL run 34439661665. Both compatibility receivers irreversibly failed before the same-run authoritative dispatch began: actions job 102753875109 enforced failure at 2026-09-10T05:28:01Z; python job 102753875144 enforced failure at 05:30:12Z; dispatch job 102756789337 did not start until 05:35:57Z and completed SUCCESS at 05:36:02Z. This is another receiver-before-dispatch ordering reproduction on an exact PR head. Leaf AIP will not add sleeps, synthetic statuses, rerun churn, or gate weakening; canonical fix remains owned here. Predecessor evidence only, not a verdict for AIP descendant heads.

[seonghobae]

Fresh unchanged consumer canary after protected central main advanced to cb0872c9a20d5584703dffacca65c096fc034c6c: ContextualWisdomLab/Orgmetra#96@f2c6e70edcf5c62ae0f848c29efd7bd3b8d45b97, required CodeQL run 34441833995. Detect CodeQL languages succeeded. Both compatibility consumers have already terminalized FAILURE at Release runner or enforce current-head CodeQL verdict: Actions job 102760503848, Python job 102760503862. The same run's Dispatch current-head CodeQL scan job 102763941196 is only queued at this read.

Thus the consumer-before-producer settlement-ordering defect remains observable on a fresh exact head: required consumers fail before their own dispatch can produce a terminal verdict. Do not repair this in Orgmetra with sleeps/polling/no-op reruns/synthetic statuses or predecessor verdict transfer. Also note this PR still records base main@7fd571db... while protected main is now cb0872c9...; canonical writer should ordinary non-force adopt/adapt intervening protected truth (including #1938 queue semantics) before treating the proposed repair as integration-ready.

[seonghobae]

Read-only consumer handoff from ContextualWisdomLab/fast-mlsirm; no central source/ref mutation requested.

Protected .github/main has advanced to cb0872c9a20d5584703dffacca65c096fc034c6c via #1938 (Strix push-scan coalescing), while #2040 remains exact 6706c231ab06a3c91c43fdb5b989cfcd79fff593 with recorded/base authority 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db. Its current exact-head hosted generation is now terminal: Security 34251822390, Semgrep 34251822314, Python Security 34251822251, and Runtime Quality 34251822381 are SUCCESS, but CodeQL PR 34251822255 is FAILURE.

The live fast-mlsirm consumer canary #1773 exact e49e631fbd672b27d408854d6c2409eea9ae073d remains leaf-green for CI/fuzz/Security/repository CodeQL/Semgrep and central CodeQL PR RED. Please treat the intervening protected-main delta as mandatory adopt/adapt input before any normal landing decision: non-force reconcile against current protected main, preserve the exact producer/handler identity and failed-job settlement invariants, and obtain a fresh unchanged-head terminal central CodeQL generation. Do not use the old 7fd571d... hosted evidence, a manual rerun loop, or the leaf consumer's repository CodeQL success as a substitute.

[seonghobae]

AIP required-CodeQL canary refresh. The same receiver-before-dispatch settlement defect has now reproduced across 15 consecutive exact #59 generations; do not treat these leaf failures as AIP source-analysis findings and do not add leaf sleep/polling/synthetic status/PAT/no-op rerun/gate weakening.

Latest exact canary is ContextualWisdomLab/accounting-information-platform#59@eb314c3de1a53f9f96c11094de9a7294012dbb08, required run 34511963466. Detect-languages 102988024437 is GREEN. Python receiver 102988114004 read current-head dispatch evidence from 2026-09-10T18:03:42Z through 18:06:00Z, then failed Release runner or enforce current-head CodeQL verdict at 18:06:00Z and completed 18:06:01Z. Actions receiver 102988113719 read from 18:03:44Z through 18:06:20Z, then failed terminal enforcement at 18:06:20Z and completed 18:06:22Z. Only after both receivers had already made terminal failing decisions was authoritative same-run dispatch job 102989063555 created (18:06:23Z), started 18:06:25Z, dispatched successfully 18:06:27Z–18:06:30Z, and completed SUCCESS at 18:06:31Z.

This is the same ordering defect: receiver/current-head enforcement can become irreversible before the authenticated same-run producer/publication has settled. The accepted repair remains to make enforcement causally downstream of terminal authenticated dispatch/publication, or provide an equivalent exact-run settlement barrier, while preserving exact repository/PR/base/head/language/required-run/SARIF/artifact/creator provenance. Fixed sleeps, polling unrelated runs, predecessor/historical reruns, synthetic status, leaf PAT fallback, no-op pushes, or sender/gate weakening are not substitutes.

Canonical owner remains .github#2040@6706c231ab06a3c91c43fdb5b989cfcd79fff593, open/Ready/mergeable. Its recorded base is 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, while protected .github/main is cb0872c9a20d5584703dffacca65c096fc034c6c. Read/adopt/adapt that intervening protected delta and non-force reconcile the central owner before normal integration; reacquire one fresh unchanged-head terminal CodeQL generation after the central repair.

[seonghobae]

LineageWeave consumer reproduction, fresh exact head 65d3020d819f9b5d294d2c80c8a4e93a7802c65f (PR #996, base main@83eba56149eb802cd63642c507c324c9976ec78e): CodeQL PR run 34449557217 is terminal FAILURE. Detect CodeQL languages job 102782088708 succeeded. All three compatibility jobs read the current-head dispatch verdict successfully and then failed only at Release runner or enforce current-head CodeQL verdict: python 102782280917, actions 102782280945, javascript-typescript 102782281189. Final Dispatch current-head CodeQL scan job 102785480234 succeeded. Same exact consumer head has SAST 34449557791 SUCCESS and Security 34449557199 SUCCESS; repository Tests are intentionally skipped because #996 remains Draft. This is evidence for the canonical central owner only; no LineageWeave waiver/substitute status/rerun shim was added.

[seonghobae]

Fresh LineageWeave consumer reproduction on PR #997 exact head c3e59191a21de955c1df5d4bdadf926989c83b32: CodeQL PR run 34453149702 detects languages successfully. Compatibility jobs javascript/typescript 102794081913, actions 102794081940, and python 102794081966 all successfully complete Read current-head CodeQL dispatch verdict and then fail only at Release runner or enforce current-head CodeQL verdict; dispatch job 102796026724 is GREEN. This is a docs/test-only consumer head with Security and SAST GREEN. No LineageWeave waiver/substitute status is being added; please retain this exact-head receipt for the canonical owner repair.

[seonghobae]

LineageWeave exact-head consumer reproduction 갱신입니다. PR #997 head b981b582132bbf4369c7e4acf7b6b19a45e03a0e, CodeQL PR run 34463126738: Detect CodeQL languages 102825388403 GREEN. Actions 102825429322, Python 102825429354, JavaScript/TypeScript 102825429439 모두 Read current-head CodeQL dispatch verdict는 GREEN으로 완료한 뒤 Release runner or enforce current-head CodeQL verdict에서 fail-closed했습니다. Final Dispatch current-head CodeQL scan 102826202182는 GREEN입니다. LineageWeave leaf에는 synthetic status/waiver/substitute scanner/model-provider pin을 넣지 않았습니다. canonical owner에서 current-head terminal verdict/release 경계를 수리한 뒤 protected immutable owner result로 소비할 수 있게 부탁드립니다.

[seonghobae]

LineageWeave fresh consumer reproduction after terminalization of exact head bc9e127e9056c2924b8e410c63065e8b7ad66b5d (#998).

Consumer CodeQL PR run 34468724626 is terminal FAILURE. Language detection 102843350543 is GREEN. All three compatibility jobs successfully read the current-head dispatch verdict and fail only at the terminal enforcement step:

• actions 102843396112: read verdict SUCCESS -> Release runner or enforce current-head CodeQL verdict FAILURE
• python 102843396145: read verdict SUCCESS -> enforcement FAILURE
• javascript-typescript 102843396248: read verdict SUCCESS -> enforcement FAILURE

Final consumer dispatch 102844072788 is terminal SUCCESS. Repository Tests 34468724635 are terminal SUCCESS, including PostgreSQL full-suite job 102843422758 and frontend lint/test/build/Storybook job 102843422961; Security 34468724516 and SAST 34468724517 are also SUCCESS. No leaf rerun shim, synthetic status, workflow copy, provider/model pin, bypass, or gate weakening was introduced.

This exact reproduction is supplied to the canonical CodeQL owner because the leaf has completed its own checks and remains fail-closed solely at the central compatibility enforcement boundary. Please preserve base/head-bound evidence and repair/release the owner path rather than accepting a leaf waiver.

[seonghobae]

[P1 authority/ancestry finding] Fresh protected truth is .github/main@cb0872c9a20d5584703dffacca65c096fc034c6c, but this exact-head PR body still calls 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db the protected base and reports 144 ahead / 0 behind. A fresh current-main→6706c231ab06a3c91c43fdb5b989cfcd79fff593 compare reports merge-base 7fd571db..., so the branch has not adopted current protected ancestry. Treat the 133/3088 local suite and old-base hosted generation as preservation evidence only, not current-base acceptance. Please non-force reconcile all valid producer/handler/SARIF/settlement deltas onto current protected truth (or a verified versioned handler bootstrap successor) and regenerate exact-current evidence; do not close/discard this valid work, force/rebase destructively, or transfer predecessor GREEN. This also keeps ConceptWeave #35 as an unchanged-head downstream canary rather than inducing leaf churn.

[seonghobae]

Fresh Orgmetra source-change canary for the CodeQL settlement contract: ContextualWisdomLab/Orgmetra#295 exact head ecd1d8248e047c65bf483e092b0dd57e08452341 (base develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f) has Foundation 34495750505, Security 34495750577, and SAST 34495750509 SUCCESS, while CodeQL PR 34495750539 is terminal FAILURE. In that exact CodeQL run, language detection 102933637332 succeeded; Python consumer 102933699549 and Actions consumer 102933699649 both read the current-head dispatch verdict and then failed at Release runner or enforce current-head CodeQL verdict; only afterward did producer Dispatch current-head CodeQL scan job 102935120089 run and finish SUCCESS. This is a real source-delta PR, not a docs-only specimen, and reproduces consumer terminalization before producer settlement. No Orgmetra leaf sleep/poll extension, synthetic status, predecessor verdict transfer, empty commit, manual bypass, or local workflow fork is being introduced. Please preserve the exact base/head/run envelope and repair via the canonical producer → authenticated receipt/publication → consumer wake/re-evaluation path.

[seonghobae]

Fresh Orgmetra source-change canary from canonical consumer #295, exact protected-base/head eb9757f8649aaad026a9865508d9aad50c1a7a4f → 63a1103135f7f98a55cf284e6e2ff706c60deea9 after single-writer and UUID-alias repairs. Required CodeQL run 34506404647: language detection 102969698358 SUCCESS; Python consumer 102969754156 waited for current-head dispatch verdict from 17:09:26Z then terminal FAILURE at 17:12:05Z; Actions consumer 102969754183 waited from 17:09:25Z then terminal FAILURE at 17:12:09Z. Only after both consumers had failed did producer job 102970711715 (Dispatch current-head CodeQL scan) materialize, created/queued at 17:12:10Z. Independent exact-head GHAS Analyze(python) and Analyze(javascript-typescript) checks are already SUCCESS, so this is not evidence of a leaf source analysis failure. Please preserve the canonical producer→authenticated exact-head verdict→consumer settlement order; do not repair by leaf sleep inflation, no-op push, predecessor-status reuse, synthetic success, or mutable consumer copy. Current protected central .github/main observed unchanged at cb0872c9a20d5584703dffacca65c096fc034c6c; #2040 remains the central owner lane.

[seonghobae]

Fresh Orgmetra source-change canary from PR #295 exact d15a741c10685208b124477e9d7820cdf17339e8 on base eb9757f8649aaad026a9865508d9aad50c1a7a4f reproduces the producer/consumer settlement-order defect after a real manifest RED→GREEN repair.

Required CodeQL run 34515073664:

• Python consumer 102998401466 started 18:33:46Z, finished FAILURE 18:36:30Z; its read step completed 18:36:28Z and enforcement failed immediately.
• Actions consumer 102998401491 started 18:33:46Z, finished FAILURE 18:36:38Z; its read step completed 18:36:37Z and enforcement failed immediately.
• Canonical producer Dispatch current-head CodeQL scan 102999395304 was only created after both compatibility consumers had entered execution; it started 18:36:56Z and completed SUCCESS 18:37:00Z.

The same exact head already has external GHAS Analyze (python) and Analyze (javascript-typescript) SUCCESS plus repository Foundation/SAST GREEN, so this is not evidence of a leaf analysis defect. The required consumers terminalized before the authoritative producer had even started. Repair contract remains producer materialization/execution → exact-head terminal receipt/verdict → consumer wake/re-evaluation → required-check terminalization. No leaf sleep extension, empty commit, predecessor verdict transfer, synthetic success, or local workflow fork was introduced.

[seonghobae]

Fresh RCA from canonical CodeQL run 34251822255, attempt 7, dispatch job 102154736341: this is no longer an opaque consumer failure. The coordinator reaches its exact live PR/head/base validation and evidence-discovery path, then exits with CodeQL coordinator could not bind every pending language to an exact failed job. The captured matrix is actions + python; RERUN_MODE=failed builds required_jobs only from exact matrix jobs whose current attempt conclusion is failure, then requires every language still lacking authenticated evidence to appear in that failed-job set. At least one pending language is therefore not represented by a terminal failed matrix job, so unmapped_pending_languages is non-empty and dispatch fails before OIDC/app-token exchange. This is a coordinator state-binding defect, not a LineageWeave leaf issue and not a reason to weaken the gate. Repair should preserve fail-closed semantics while distinguishing a pending language whose exact job is non-failure/non-rerunnable from a genuinely missing/malformed job; then RED→GREEN the coordinator with the mixed state that reproduced attempt 7. Please do not churn a rerun before the state-binding logic is repaired.