fix(codeql): wake required jobs with the exchanged target app token by seonghobae · Pull Request #2040 · ContextualWisdomLab/.github

seonghobae · 2026-09-08T08:09:12Z

Owner session: fast-mlsirm-commercialization

Outcome

Canonical combined successor for the central CodeQL producer/handler cycle, exact required-run recovery, strict head-envelope validation, and stacked-PR check admission.

Current authority after non-force reconciliation:

protected central base: main@fb17ef556f94f673234aa557254ae52779e9a7b0;
exact PR head: 85522306949bada2b5939608dc911f6374125f1b;
exact tree: fe8ca79a4fd410e68eb790258820a511fa6cdc70;
fresh compare: 150 ahead / 0 behind, merge base exactly protected main, 29 effective changed files;
state: open, Draft / Proposed because current-head review identifies an unresolved protected-main bootstrap cycle; no merge authorization.

Root causes and repair retained

A handler superseded after initial validation cannot publish a status: publication requires the second live PR/base/head validation to succeed.
The unsafe head-only compatibility context is replaced with base-bound codeql-dispatch/<language>/<base_sha> receipts.
Publication requires exact SARIF preservation and authenticates the returned status creator.
Producer receipts bind exact base/head/run, protected workflow source/title, actor, successful validation/required jobs, gate, SARIF, artifact, and response creator.
One run-wide settlement owner revalidates live PR/base/head, exact required run/jobs, handler gates and unexpired artifacts before one run-level rerun mutation.
Same-ref forward base advancement restarts the exact required run; rewritten/divergent bases fail closed.
Raw nested pr_head schema/types and legacy scalar fields must agree.
The target App → PR_REVIEW_MERGE_TOKEN → OPENCODE_APPROVE_TOKEN → same-repository token fallback remains explicit and authenticated.
Direct evidence authenticates handler runtime source against protected .github/main, not target-PR synthetic ancestry.
Destructive-boundary active-run refresh uses the same host-scoped Actions credential selector as cancellation.
The stacked-PR security contract rejects both branches and branches-ignore filters.
failed dispatch keeps one top-level required_jobs authority compatible with the protected pre-cutover handler; only whole-attempt all uses the nested envelope.
The scheduler no longer manufactures same-tree commits for zero-job workflow startup failures or last-push approval; it reports the exact failed run IDs and waits for a real repair or independent approval on the unchanged head.

The branch continues to carry all valid predecessor delta from #1902, #2004, #2043 and #2044. Those predecessors are not treated as shipped merely because their delta is inherited here.

Protected-main reconciliation

Fresh review found predecessor 6706c231ab06a3c91c43fdb5b989cfcd79fff593 had diverged from current protected main by 144 ahead / 32 behind. The protected-side 32 commits affected eleven effective files and did not overlap this PR's 24 effective files. A concurrent central writer then performed the same ordinary merge-forward tree that had been independently prepared here:

merge commit 3b2de64c2c4c95c56d2f5099a480a0825304d038;
parents: predecessor 6706c231... and protected main@cb0872c9...;
resulting tree eb8d6351193519afca23d448f70b9ab59f5eb5a4;
branch update is ordinary/non-force; no valid proposal delta was discarded.

The independently prepared tree had the identical SHA eb8d635...; its ref update was correctly rejected as non-fast-forward after the concurrent merge landed first. The concurrent commit is therefore adopted rather than rewritten or force-replaced.

Verification boundary

Historical predecessor suites remain diagnostic only after the merge-forward. Local verification for tree da7514aa... is focused 9 passed, scheduler/related 336 passed, repository 3127 passed / 1 skipped / 21 subtests, statement/branch/public-doc coverage 100%, and diff check clean. The exact head must still obtain fresh hosted current-head workflow, security, coverage and independent-review evidence before normal merge. CodeQL run 34629071379 attempt 50 was a zero-job startup_failure on predecessor head 3b2de64c...; it is evidence for this repair, not authorization for the new head.

This branch is the central prerequisite lane for the producer-after-consumer Required CodeQL failure repeatedly reproduced by fast-mlsirm exact heads. Do not repair that defect in product repositories through copied workflows, synthetic statuses, no-op retriggers, or bypasses.

Exact-head replay-gate repair

Current-head OpenCode run 34684439092, coverage job 103528902332, supplied the RED: the trusted pr_head_replay_guard observed the intentional retirement of obsolete restamp tests in tests/test_pr_review_merge_scheduler.py but no added replacement test module, so it failed before coverage measurement.

The repair moves the two positive no-mutation contracts into tests/test_pr_review_merge_scheduler_source_neutral_commit_contract.py. It retains the complete scheduler test module and makes replacement evidence structurally visible to the protected guard. A transient Git-data upload commit be25a767... truncated the large existing test blob; it was never promoted as valid evidence and the immediate ordinary child 6476b919... restored the full blob. Fresh compare from a9b18b4b... to this head is exactly 46 lines moved out of the existing test module and 60 lines added in the replacement module, with no source or workflow path changed.

Exact-tree verification: focused 9 passed / 325 deselected; full 3127 passed / 1 skipped / 21 subtests; statement and branch coverage 100%; public-doc coverage 100%; git diff --check clean; and the production pr_head_replay_guard reports PASS with one added test file and no reverted protected-main path.

Latest protected-main and Runtime Quality reconciliation

Runtime Quality run 34686471090 on predecessor 798a5d4f... failed because its selected canonical fixture tests/test_javascript_materializer_docstrings.py was absent. Protected main had already merged the owner contract through #2095 and the queue-history contract through #2092. Ordinary two-parent commit 85522306949bada2b5939608dc911f6374125f1b now joins predecessor 798a5d4f... with protected main@fb17ef55... at exact tree fe8ca79a...; the overlapping Runtime Quality workflow preserves both the main-side JavaScript materializer contract and this PR's scheduler selector.

Exact-tree verification is focused 72 passed, repository 3133 passed / 1 skipped / 36 subtests, all scripts/ci/*.py statement/branch coverage 100% (13,155 statements / 5,322 branches), public-doc coverage 100%, compileall PASS, and diff checks clean. Exact-head Runtime Quality 34686930839, Python Security 34686930820, Trusted uv Materializer 34686930788, Security 34686930789, and SAST 34686930806 are GREEN. CodeQL 34686930801 is terminal failure only because actions job 103535474643 and python job 103535474644 both have DISPATCH_OUTCOME=success, VERDICT_STATE=pending; no leaf source finding is inferred.

Landing gate

Current-head review at 85522306949bada2b5939608dc911f6374125f1b confirms the merge-forward itself is valid but the protected-main pre-cutover handler and this post-cutover client cannot yet validate one another. Keep Draft until a backward-compatible protected bootstrap, provenance-bound temporary legacy discovery, one run-wide settlement owner with split-wake fixture, ADR-0025/gap removal condition, ordinary restack, and fresh terminal CodeQL evidence are present. Normal merge requires terminal applicable checks, zero valid unresolved findings, and a qualifying independent current-head approval. No self-approval, auto-merge authorization, protection bypass, manual-rerun loop, synthetic status, force update, destructive rebase, source-neutral commit, predecessor-success transfer, or valid-delta close.

Exact protected-handler prerequisite — 2026-09-12

The canonical owner prerequisite is now #2106 at exact head 50adc03d2afbe4a370782e9b7985636f0fcf12fc, based on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0; its two parents are the prior canonical head 2c163e92983156739bdeeac87bd8c21383c38145 and complete overlapping predecessor #2105 head fde889ad611054cad0c1be5a14289b7eb881b124. It stages the backward-compatible v1/v2 handler, one shared concurrency owner, one run-wide settlement mutation, exact producer/base/head/ordered-parent provenance, split-language evidence, legacy-removal condition, and the credential-response isolation repair. Overlapping #2105 is Draft and remains evidence-preserving until protected integration is verified.

Keep this consumer/producer stack Draft. After #2106 lands through ordinary protection, non-force merge-forward this branch onto the new protected tip, switch the producer to the versioned event, and require fresh exact-head terminal CodeQL plus independent review. The queued runs created by the corrected Ready transition do not waive this dependency and cannot authorize merge.

Preserve the existing four-file rerun recovery delta without emitter or concurrency policy changes. Local contract verification: 144 passed, 2 failed. Existing verdict-reader fixtures still expect the pre-pagination gh invocation; these files and the requester are unchanged from bf732f9. Workflow actionlint and diff checks passed. No hosted dispatch or push performed. Signed-off-by: Seongho Bae <me@seonghobae.me>

Match exact gh arguments and page-shaped responses. Preserve trusted-publisher assertions and exercise second-page success and failure after a full page of forged statuses. Signed-off-by: Seongho Bae <me@seonghobae.me>

Request PR state in GraphQL and preserve it in REST normalization. Reject missing state and empty or malformed heads before OpenCode dispatch, Strix dispatch, or Strix job rerun. Preserve explicit positive fixtures and add fail-closed regressions. Focused RED: 17 failed, 19 passed; final scheduler regressions: 380 passed under both normal and GITHUB_ACTIONS=true environments with warnings treated as errors. No dispatch, permission, queue, or cancellation policy changes. Signed-off-by: Seongho Bae <me@seonghobae.me>

Validate selected check, job, run, workflow and publisher before rerunning Strix. Preserve PR-target base-SHA executions through association and target-title checks; defer dispatch runs without authenticated target provenance. Local mock-only regressions: 402 passed in normal and CI environments with warnings treated as errors. No token, permission, queue or cancellation changes. Signed-off-by: Seongho Bae <me@seonghobae.me>

Signed-off-by: Seongho Bae <me@seonghobae.me>

Preserve the complete prior writer history while making the final tree authoritative from protected main plus only the five CodeQL recovery paths. Scheduler/Strix commits 951d0ec, 9bfe575, and fe64f24 are carried to their own successor branch; no valid delta is retired or force-updated.

Block terminal status publication and exact-job wake when SARIF upload does not succeed. Preserve existing finding verdicts and document the unresolved receipt boundary. Co-authored-by: Codex <codex@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>

Compare already-fetched live base identity with event inputs before status consumption. Keep historical verdict provenance and artifact authority as unresolved follow-ups. Co-authored-by: Codex <codex@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>

Supply the real base repository, ref and SHA required by the production dispatch shell. Preserve later-attempt redispatch coverage without weakening the live-base guard. Co-authored-by: Codex <codex@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>

Merge exact 82ca0b8 into the handoff branch. Consolidate equivalent publication regressions and SARIF documentation while preserving live-base validation and rerun fixtures. Co-authored-by: Codex <codex@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>

seonghobae · 2026-09-12T09:52:02Z

Exact-head protected-main reconciliation and Runtime Quality repair

Runtime Quality run 34686471090 on predecessor head 798a5d4f2ceaf6ccc263c87b3f1d9f5e9f97bcbd checked out the exact head and failed before product tests because tests/test_javascript_materializer_docstrings.py did not exist. This was a real integration failure: protected main had advanced and already merged the canonical owner repair in #2095, while #2040 still contained only the workflow selector/step inherited from the newer base shape.

Repaired by ordinary non-force reconciliation with fresh protected main@fb17ef556f94f673234aa557254ae52779e9a7b0:

new exact head: 85522306949bada2b5939608dc911f6374125f1b
exact tree: fe8ca79a4fd410e68eb790258820a511fa6cdc70
ordered parents: predecessor 798a5d4f... + protected main fb17ef55...
compare: 150 ahead / 0 behind; merge base exactly fb17ef55...; 29 effective paths; mergeable
all docs(ci): explain JavaScript materializer trust boundaries #2095 JavaScript materializer docs/test/workflow delta and docs(queue): mark retired org sweep as historical #2092 queue-history contract are preserved; the overlapping runtime-quality workflow also retains fix(codeql): wake required jobs with the exchanged target app token #2040's source-neutral scheduler-test selector
unresolved review threads: 0

Exact-tree verification:

hosted-equivalent focused suite: 72 passed
repository suite: 3133 passed / 1 skipped / 36 subtests
scripts/ci/*.py statement and branch coverage: 100% (13,155 statements / 5,322 branches)
public-doc coverage: 100%
compileall and diff checks: PASS

Fresh exact-head runs were created by this substantive reconciliation (no manual rerun or source-neutral trigger): Runtime Quality 34686930839, Python Security 34686930820, Trusted uv Materializer 34686930788, CodeQL PR 34686930801, Security Scan 34686930789, and Semgrep 34686930806; all are currently queued and are not promoted to GREEN.

The PR remains Draft / Proposed. There is no qualifying independent review for 85522306949bada2b5939608dc911f6374125f1b, so ordinary merge and auto-merge remain closed. No approval, protection bypass, force update, destructive rebase, stale evidence transfer, Draft/Ready retrigger, or manual rerun was used.

seonghobae

P1 current-head carryover for 85522306949bada2b5939608dc911f6374125f1b; this is the same unresolved rollout/admission defect recorded on predecessor review 5185935507, not a second blocker.

The non-force reconciliation onto protected main@fb17ef556f94f673234aa557254ae52779e9a7b0 is valid and preserves the scheduler/replay-gate/Runtime Quality repairs. Fresh compare shows the 17 commits since a9b18b4b... change Runtime Quality, JavaScript materializer, README/queue docs, and test placement only. Neither CodeQL workflow changed. Protected main's handler still has matrix-owned Wake exact CodeQL required job and no run-wide settle-required-run; its client still uses the pre-cutover title without producer_source_sha. This PR's client still admits only the post-cutover title/receipt. The circular self-validation boundary therefore remains unchanged.

Keep this Draft/Proposed until the already-recorded RED -> GREEN is implemented: versioned backward-compatible handler bootstrap on protected main, exact provenance-bound temporary legacy discovery, one deterministic full-language settlement owner with the split-wake fixture, then ordinary non-force restack and fresh terminal CodeQL evidence. Update ADR-0025 and the product-technical gap baseline with the staged removal condition.

Fresh runs 34686930839, 34686930820, 34686930788, 34686930801, 34686930789, and 34686930806 were nonterminal at review time except Trusted uv Materializer Quality CI, which was successful. Do not transfer predecessor GREEN or use manual rerun, Draft/Ready retrigger, synthetic status, source-neutral commit, auto-merge, or bypass.

seonghobae · 2026-09-12T09:56:19Z

Hosted follow-up on unchanged exact head 85522306949bada2b5939608dc911f6374125f1b: Runtime Quality 34686930839 has now passed the previously failing Verify JavaScript materializer documentation contract step and is continuing through later contract suites. Python Security 34686930820 and Trusted uv Materializer 34686930788 are terminal SUCCESS; CodeQL PR 34686930801 is in progress; Security 34686930789 and Semgrep 34686930806 remain queued. The run is not yet terminal, and there is still no current-head independent approval, so this is repair evidence only and not merge authorization.

seonghobae · 2026-09-12T10:04:31Z

Handler prerequisite successor #2105 advanced non-force to exact fde889ad611054cad0c1be5a14289b7eb881b124 / tree 8f0819472eba62d570a5e6743737872ed7d25586, incorporating protected main@fb17ef556f94f673234aa557254ae52779e9a7b0. The handler delta is unchanged and remains the bounded bootstrap owner. Keep #2040 Draft/open and do not transfer predecessor checks. After protected #2105 integration, non-force reconcile this producer branch, emit nested rerun schema "1", and require a fresh producer→protected-handler canary.

seonghobae · 2026-09-12T10:05:32Z

Fresh dependency/ownership update from the BandScope downstream canary: handler-bootstrap #2105 has advanced by ordinary non-force reconciliation to exact fde889ad611054cad0c1be5a14289b7eb881b124 on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0 and is now the bounded source owner for the pre-cutover single-settlement/schema/attempt-budget bootstrap. #2040 remains exact 85522306949bada2b5939608dc911f6374125f1b on the same protected base; compare fde889ad... -> 855223... is diverged, so #2105 evidence/semantics are not ancestry and must not be assumed inherited.

Keep #2040 Draft and do not create a second handler-bootstrap implementation while #2105 is mutable. After #2105 reaches protected main through ordinary protection, reconcile #2040 non-force onto that protected tip and preserve only #2040's unique producer/recovery/scheduler deltas. Then require a fresh producer -> protected-handler canary on one exact head/base. Current #2040 CodeQL run 34686930801 remains terminal failure while Runtime Quality/Python Security/Security Scan/SAST/Trusted-uv are GREEN; protected dispatch 34687138251 is still queued, which is non-passing evidence. No manual/no-op rerun, synthetic status, force/rebase, or predecessor GREEN transfer.

seonghobae · 2026-09-12T10:10:20Z

Source-level succession check after the ancestry check: #2040 does not currently subsume #2105's handler bootstrap. On exact #2105@fde889ad..., codeql-scan-dispatch.yml exports rerun_schema, initializes legacy legacy-0, requires nested rerun_request.schema to be a string equal to "1", and rejects missing/non-string/unknown schema before mutation. Exact #2040@855223069... has the same general nested/legacy envelope shape but no rerun_schema output and its nested object accepts only {mode, required_jobs} without a schema field. This is a unique semantic/contract delta, not merely different ancestry.

Therefore keep both PRs: #2105 remains the canonical bounded handler-bootstrap owner until normal protected integration; #2040 must adopt that released/protected contract by ordinary non-force reconciliation afterward. Do not close #2105 as 'already inherited' and do not independently reimplement its schema/attempt-budget contract on #2040 while #2105 is mutable.

seonghobae · 2026-09-12T10:25:41Z

Protected-handler terminal result

Exact producer run 34687138251 for #2040@85522306949bada2b5939608dc911f6374125f1b is now terminal cancelled, not queued. The protected-main handler source remained fb17ef556f94f673234aa557254ae52779e9a7b0; this did not execute #2040's proposed settle-required-run implementation.

Both CodeQL analyses and SARIF gates completed successfully. The actions shard also woke its required job successfully. The python shard published its exact base/head/run/source-bound status, then its matrix-owned Wake exact CodeQL required job POST failed with gh: The workflow run containing this job is already running (HTTP 403). GitHub marked that shard cancelled and the producer cancelled. This is the expected protected-handler bootstrap blocker already owned by #2105, not a product-source finding and not evidence that #2040 inherited #2105.

Keep #2040 Draft/open. Merge #2105 through ordinary protection first, non-force reconcile #2040 onto that protected tip, then require a fresh exact producer → protected-handler canary. Do not rerun the unchanged leaf, synthesize status, or reuse the successful actions shard as whole-run settlement.

seonghobae · 2026-09-12T11:06:41Z

Fresh prerequisite correction for this Draft owner: canonical handler bootstrap #2106 has advanced to exact 24bb6591ab7df23558cb793b4af60c567ff9da97 (not 50adc03d...) on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0. #2105 is now closed/unmerged after verified successor carryover. #2106 has also been demoted back to Draft/Proposed because exact-head required opencode-review failed closed without a current-head verdict while the protected-main OpenCode dispatch remains pending and the protected CodeQL dispatch remains queued. Please keep #2040 Draft and absorb the final protected #2106 commit only after normal integration; then ordinary/non-force reconcile, switch to the versioned event, and regenerate fresh producer/handler/downstream evidence. No predecessor check/review transfer.

seonghobae · 2026-09-12T12:02:23Z

BandScope downstream owner-path refresh (read-only dependency handoff): canonical bootstrap prerequisite #2106 is now Open/Ready/mergeable at exact 24bb6591ab7df23558cb793b4af60c567ff9da97 on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0; #2105 is the closed/unmerged verified predecessor. Fresh exact-head CodeQL PR run 34692079677 is terminal FAILURE only in compatibility enforcement for actions/python, while its Dispatch current-head CodeQL scan job succeeded and created protected-main handler run 34692405217, exact tuple #2106@24bb6591.../fb17ef55.../34692079677. That handler run is still queued, so it is not GREEN evidence. Fresh Python Security 34692079678, SAST 34692079701, and Security 34692079700 are SUCCESS. Current-head qualifying APPROVED review is still absent. Please keep #2040 Draft and, after normal protected #2106 integration, ordinary/non-force reconcile #2040 to the new protected tip and reacquire fresh producer/handler canary plus independent review; no bypass, synthetic status, no-op freshness, or predecessor evidence transfer.

seonghobae · 2026-09-12T13:06:37Z

Current protected-main consumer RED — 2026-09-12

The proposed combined owner repair is still required by fresh consumers running protected .github@fb17ef556f94f673234aa557254ae52779e9a7b0:

dispatch 34692961729 for seedream_evasepic#417@6dd154979d7235e1b711d3979763b9305538c467: actions scan/SARIF succeeded, status publication failed HTTP 403 with both configured credentials, then wake failed with WAKE_TOKEN_SOURCE=unavailable.
dispatch 34692975828 for newsdom-api#832@330f21c043948f0cbe75ce5605501a0eabc110b4: identical failure for python and actions.

This strengthens the exact acceptance requirement for #2040: one immutable producer must publish terminal per-language evidence and coordinate the exact-run wake using an Actions-capable least-privilege target credential. A successful scan artifact without publication/wake remains fail-closed. No consumer workflow copy, synthetic status, or blind leaf rerun is acceptable.

seonghobae · 2026-09-12T13:07:01Z

Prerequisite authority refresh for this Draft consumer/producer stack:

bootstrap owner .github#2106 is now 24bb6591ab7df23558cb793b4af60c567ff9da97, Ready/open/mergeable on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0;
replacement Required CodeQL 34692079677 is terminal SUCCESS and both current language dispatch statuses are GREEN, so the old producer-after-consumer RED is now repaired on the bootstrap exact head;
fix(codeql): bootstrap versioned dispatch handler #2106 is still not merge-authorized: OpenCode run 34693400612 reached only contextual-orchestrator/orchestrator/free and ended provider-error/model-pool-exhausted without a validated approval, and no qualifying independent current-head APPROVED review exists;
the central byte-count-only OpenCode failure-diagnostic gap is now tracked as fix(opencode): emit redaction-safe provider failure envelope before approval settlement #2112. That issue preserves fail-closed review semantics and body/secret redaction; it is not permission for rerun storms or provider fallbacks.

Keep #2040 Draft and do not restack yet. Its canonical next action remains ordinary non-force merge-forward onto the protected commit only after #2106 lands normally, then switch the producer to codeql-scan-v2 and reacquire unchanged-head terminal checks/review evidence.

seonghobae · 2026-09-12T13:14:39Z

Current prerequisite authority correction from downstream BandScope exact-state sweep:

protected central truth remains main@fb17ef556f94f673234aa557254ae52779e9a7b0;
predecessor fix(codeql): stage versioned handler rollout bootstrap #2105 is closed/unmerged only after verified complete carryover;
sole bootstrap landing owner is now #2106@24bb6591ab7df23558cb793b4af60c567ff9da97, Open/Ready/mergeable;
replacement Required CodeQL run 34692079677 is now terminal SUCCESS on that unchanged head, including language detection, actions compatibility, python compatibility, and dispatch. The legacy per-language wake races remain RED lineage, not the current CodeQL blocker;
current blockers on fix(codeql): bootstrap versioned dispatch handler #2106 are review evidence: OpenCode reached the required orchestrator/free route but produced no validated approval after provider/model-pool exhaustion (telemetry owner fix(opencode): emit redaction-safe provider failure envelope before approval settlement #2112), and Noema exact-head verdict preparation failed with HTTP 429 after ~874.4 s (free-pool owner evidence routed to Review sidecar probes and replays spend the per-key free-tier rate budget the review itself needs #1948/Migrate review consumers to released orchestrator/free gateway contract #1759/[CO owner] eliminate orchestrator/free provider-family SPOF before gateway release #1915). No formal qualifying approval exists;
separate Strix run 34692079839 produced internally consistent completed/success terminal evidence + empty SARIF but failed the warning/provider classifier; that production-shaped gate RED is routed to fix(strix): require authoritative report artifacts on success #1563 and is not a fix(codeql): bootstrap versioned dispatch handler #2106 source finding.

Please treat the body section that still names #2106@50adc03d... as historical/stale. This #2040 lane should remain Draft and untouched until #2106 integrates through normal protection. Then ordinary/non-force reconcile onto the new protected main, preserve the unique producer/recovery/scheduler delta, switch to the protected versioned producer contract, and regenerate fresh producer/handler canary + exact-head review/security evidence. No predecessor checks, manual rerun, synthetic status, or leaf workaround transfers.

seonghobae · 2026-09-12T15:11:01Z

Additional exact-current-head consumer evidence (2026-09-12): contextual-orchestrator#1149@684cf28fa59e800c0db4886a08f25dd2edd156fc, CodeQL run 34701111564.

All three compatibility shards admitted the live PR/base/head and returned DISPATCH_OUTCOME=success, then failed closed after the bounded wait with VERDICT_STATE=pending. Actions job 103572985635 and Python job 103572985628 explicitly report that the dispatch workflow will rerun the exact failed job only after publishing a terminal verdict; JavaScript job 103572985650 has the same conclusion. The canonical Dispatch current-head CodeQL scan job 103573576494 is queued.

The consumer's full product suite independently passed 3602 tests, so this evidence is not a leaf test or SARIF finding. No rerun, synthetic status, or copied workflow was introduced.

seonghobae · 2026-09-12T15:49:32Z

Additional exact-current-head settlement-race evidence (2026-09-12 UTC): .github#2114@2a0154bfd0b010e7ac4b2b0a8d085516dbf5f4d9, CodeQL PR 34702734305.

Attempt 1 admitted the exact PR/base/head and dispatched successfully; both python and actions compatibility jobs failed closed with DISPATCH_OUTCOME=success, VERDICT_STATE=pending.
The automatic exact-job rerun started before an authenticated terminal receipt existed. Rerun job 103578501085 (python) has RUN_ATTEMPT=2 and terminates with Exact CodeQL job was rerun without an authenticated terminal verdict; rerun job 103578501972 (actions) also remains failed.
The canonical Dispatch current-head CodeQL scan job 103578827970 completed SUCCESS only after those compatibility jobs had failed. Thus scan dispatch success did not settle/wake the exact required jobs in a usable order.
The same exact head independently has Runtime Quality, Security, Python Security, and Semgrep GREEN plus fresh local 3104 passed / 1 skipped / 36 subtests; this is a producer/settlement ordering defect, not a leaf source or SARIF finding.

Keep fail-closed. Do not manually rerun, synthesize a status, or copy the producer into the consumer. #2040 remains the canonical owner for terminal receipt publication and exact-run settlement.

seonghobae · 2026-09-12T16:17:26Z

2026-09-12 UTC settlement RED after terminal dispatch

contextual-orchestrator#1149@684cf28fa59e800c0db4886a08f25dd2edd156fc had native CodeQL and Dispatch current-head CodeQL scan job 103573576494 terminal success. Because the three initial compatibility shards had ended earlier with VERDICT_STATE=pending, one failed job (103572985635) was rerun once after that cause change.

The resulting attempt created new compatibility jobs 103581168613 (actions), 103581169407 (python), and 103581169326 (javascript-typescript). Python and JavaScript again reached DISPATCH_OUTCOME=success but ended VERDICT_STATE=pending; Actions remained queued at observation. This confirms that a terminal central scan alone is insufficient when the authenticated downstream verdict/status cannot be settled or discovered. No further rerun was requested, and leaf source is not implicated.

seonghobae · 2026-09-12T16:28:17Z

Exact-head downstream settlement reproduction — 2026-09-13

ContextualWisdomLab/.github#2114@5a7f9c3d3257dee0d571eca74d9e79a82f6a6cdf reproduces the central settlement ordering defect on CodeQL PR run 34704914974.

python job 103583359994: DISPATCH_OUTCOME=success, VERDICT_STATE=pending, terminal failure;
actions job 103583360079: DISPATCH_OUTCOME=success, VERDICT_STATE=pending, terminal failure;
coordinator job 103583820572: dispatch succeeded only after both compatibility jobs had already failed.

The same exact head has GREEN Runtime Quality, Security, Python Security, and SAST. This is evidence for the canonical receipt/settlement owner, not a leaf-source finding and not permission to synthesize GREEN or reuse a predecessor verdict. No manual rerun was requested.

seonghobae · 2026-09-12T17:07:39Z

Read-only prerequisite correction for downstream BandScope settlement: this PR body still names #2106 predecessor 50adc03d.... Current canonical bootstrap is #2106 exact 24bb6591ab7df23558cb793b4af60c567ff9da97, Open/Ready/mergeable on protected main@fb17ef556f94f673234aa557254ae52779e9a7b0; replacement CodeQL run 34692079677 attempt 4 is terminal GREEN and remaining admission is Noema/Strix/OpenCode + independent approval. Canonical telemetry successor #2114 is exact 3c43dd165009d503b2ebf56324b975db440e2fdb, Open/Draft/mergeable; #2115 is closed/unmerged after complete carryover. #2114 CodeQL 34706027995 is a no-SARIF protected-handler settlement/order RED, not a leaf source finding. Keep #2040 Draft until #2106 lands normally, then ordinary/non-force reconcile and reacquire the fresh producer/handler canary. No source edit, rerun, merge, bypass, synthetic status or provider fallback is requested here.

seonghobae · 2026-09-12T18:18:37Z

New protected-main canary for the post-bootstrap cutover: fast-mlsirm#1717@ba5e16677d216d3b92940461e86eeeca5de0bfbd produced handler 34710239337 for required run 34710004025. Both language scans and SARIF Medium+ gates succeeded; the handler failed only because protected legacy settlement could not publish target statuses (HTTP 403 Resource not accessible by integration) and each matrix shard reached the wake step without an Actions-capable credential (GH_TOKEN empty, WAKE_TOKEN_SOURCE=unavailable). This is executable evidence for the credential owner that #2040 is intended to provide after #2106 lands; it is not a product-repo CodeQL finding. Keep #2040 Draft until #2106 is protected, then ordinary non-force restack/cutover and require fresh exact-head convergence. Do not copy the credential logic into fast-mlsirm or manufacture a rerun.

seonghobae · 2026-09-12T22:02:36Z

Fresh Orgmetra #64 canary reproduces the producer-after-consumer settlement ordering defect on a new exact head.

Exact consumer:

ContextualWisdomLab/Orgmetra#64
protected base develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f
exact head 77c8e027035f1118ec7b12e01e2855eb2a0a1e55
CodeQL PR run 34720440223

Observed ordering:

Python compatibility job 103625572510: Read current-head CodeQL dispatch verdict completed, then Release runner or enforce current-head CodeQL verdict failed at 21:44:42Z.
Actions compatibility job 103625572549: same sequence, enforcement failed at 21:46:14Z.
Producer dispatch job 103626405883 did not start until 21:50:29Z and completed SUCCESS at 21:50:36Z.

Thus both required consumers terminal-failed before the exact-head producer dispatch even started. This is fresh evidence for the central bootstrap/settlement cycle; no Orgmetra no-op retrigger, copied workflow, synthetic status, or predecessor verdict is being used. Preserve this canary through the #2106 prerequisite and this canonical successor's ordinary reconciliation.

seonghobae · 2026-09-12T22:14:10Z

Fresh immutable consumer canary from ContextualWisdomLab/linux-cluster-ops#306@6ca30fc6ef2c3c02f11fa752a783d1c353a7ee1f confirms the target-token dispatch defect on the protected consumer generation.

Required run: 34683056632
detect job 103525115519: GREEN
actions consumer 103525356684: terminal FAILURE before a verdict
python consumer 103525356787: terminal FAILURE before a verdict
coordinator 103525928667: starts later and obtains OIDC + /exchange_github_app_token successfully, then fails the actual POST repos/ContextualWisdomLab/.github/dispatches with HTTP 403 Resource not accessible by integration at 2026-09-12T08:28:59Z.
exact payload binds target repo, PR 306, base develop@7d6c0e6f488dffb609eded3f8980ded570b54362, head 6ca30fc..., required run ID and both required job IDs.

RCA/acceptance: the exchanged target-repository App token is not sufficient authority to dispatch into the central .github repository. Preserve exact target/base/head/run/job provenance, but the central dispatch mutation must use the versioned backward-compatible owner credential/handler path that is actually authorized for .github; do not repair this consumer with PAT widening, sleep/poll loops, synthetic verdicts, or source-neutral retriggers. After the protected handler/bootstrap lands, this exact leaf class must go RED→GREEN without changing leaf source.

seonghobae and others added 30 commits September 5, 2026 16:34

test(codeql): reproduce rerun dead-end after pre-runner cancellation

4c62031

fix(codeql): recover reruns with no dispatch verdict

fabc998

docs(codeql): trace pre-runner rerun recovery evidence

e47de34

chore(codeql): restack rerun recovery on protected main

db15e4c

chore(codeql): adopt latest verification guidance without force restack

9691960

docs(codeql): align ADR with evidence-driven rerun recovery

67a6bc9

merge(main): adopt concurrent CI governance deltas

510e337

chore(codeql): adopt latest protected main

0599331

chore(codeql): adopt protected main into rerun recovery

2d4624a

chore(codeql): adopt current protected main

e72ae30

test(codeql): require complete status pagination before redispatch

acfa17e

fix(codeql): inspect complete status history before redispatch

7628274

docs(codeql): record complete status-history recovery guard

622ea74

test(codeql): exercise paginated empty-verdict recovery

bf732f9

test(codeql): align verdict fixtures with paginated status reads

4bf80b9

Match exact gh arguments and page-shaped responses. Preserve trusted-publisher assertions and exercise second-page success and failure after a full page of forged statuses. Signed-off-by: Seongho Bae <me@seonghobae.me>

test(ci): cover remaining Strix rerun identity rejections

fe64f24

Signed-off-by: Seongho Bae <me@seonghobae.me>

fix(codeql): require preserved SARIF before status

82ca0b8

fix(codeql): bind terminal verdict receipt to base

1a5957b

test(codeql): prove old-base receipt redispatch

4b025af

test(scheduler): reproduce central Actions credential leakage

8cc62ce

fix(scheduler): scope Actions credentials by run host

7bf3451

test(scheduler): reproduce workflow-token mutation fallback

ebcc671

Merge protected main and restore runtime-quality contract

8552230

seonghobae commented Sep 12, 2026

View reviewed changes

seonghobae marked this pull request as ready for review September 12, 2026 10:06

seonghobae marked this pull request as draft September 12, 2026 10:12

seonghobae mentioned this pull request Sep 12, 2026

fix(strix): admit exact MLLO console and design consumers #2113

Open

seonghobae mentioned this pull request Sep 12, 2026

fix(scheduler): permit same-repository commit status reads #2121

Open

seonghobae mentioned this pull request Sep 12, 2026

fix(opencode): preserve bounded provider failure causes #2114

Open

Uh oh!

Conversation

seonghobae commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Root causes and repair retained

Protected-main reconciliation

Verification boundary

Exact-head replay-gate repair

Latest protected-main and Runtime Quality reconciliation

Landing gate

Exact protected-handler prerequisite — 2026-09-12

Uh oh!

seonghobae commented Sep 12, 2026

Exact-head protected-main reconciliation and Runtime Quality repair

Uh oh!

seonghobae left a comment

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Protected-handler terminal result

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Current protected-main consumer RED — 2026-09-12

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

2026-09-12 UTC settlement RED after terminal dispatch

Uh oh!

seonghobae commented Sep 12, 2026

Exact-head downstream settlement reproduction — 2026-09-13

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Sep 8, 2026 •

edited

Loading