fix(codeql): stage versioned handler rollout bootstrap

[seonghobae]

Problem

Protected handler run 34686384371 supplies the production RED. Both language shards completed CodeQL analysis, SARIF enforcement, evidence preservation, and authenticated status publication. Actions then woke required run 34685520218; Python's second mutation failed because the required run was already running. This is the protected handler's attempt-wide single-writer defect.

Bounded owner repair

This successor stages only the protected-handler prerequisite:

• one non-matrix settle-required-run mutation owner after every language scan;
• actions: read for shards and actions: write only for settlement;
• authenticated live PR/base/head/run/job/SARIF/status-creator validation;
• versioned nested rerun envelope schema: "1"; legacy top-level inputs remain explicitly legacy-0;
• fail-closed rejection of missing, numeric, unknown, or mixed schemas before checkout or mutation;
• pre-mutation stop at required-run attempt 48 with structured exhaustion telemetry.

RED → GREEN lineage

• RED 952f95fe → GREEN 2351dc13: versioned single-writer handler bootstrap.
• RED a686a488 → GREEN 6308f7aa: settlement cap below the Actions rerun ceiling.
• Documentation: c5b8d004, 99bc9dbd.
• Non-force main reconciliation: fde889ad, with parents prior exact head a5ca9f1c and protected main@fb17ef556f94f673234aa557254ae52779e9a7b0.

Exact evidence

• Exact head: fde889ad611054cad0c1be5a14289b7eb881b124
• Exact tree: 8f0819472eba62d570a5e6743737872ed7d25586
• Focused CodeQL contracts: 66 passed
• Newly inherited protected-main contracts: 2 passed
• Full suite: 3074 passed, 1 skipped, 36 subtests passed
• compileall and git diff --check: clean
• unresolved review threads: zero at publication

All hosted results for predecessor head a5ca9f1c... are diagnostic only and do not transfer.

Bootstrap and landing gate

Ready is review admission, not approval or merge authorization. This repository's protected main currently requires both CodeQL compatibility contexts, and the production RED exists in the protected handler that produces those contexts. Therefore an admin/expected-head bypass, temporary protection weakening, synthetic success/status publication, no-op freshness commit, Draft/Ready retrigger, or manual rerun storm is not an acceptable bootstrap.

Before merge, this owner must establish a normal-protection bootstrap path that lets the unchanged exact head obtain authentic required CodeQL terminal success without trusting mutable PR handler code or weakening repo/PR/base/head/run/job/language/SARIF provenance. If the existing protected handler cannot satisfy that invariant, keep this PR Proposed/Ready-for-review only and document the governance deadlock as such; do not convert the deadlock into bypass authority.

After a qualifying independent current-head review and terminal success for every non-circular exact-head gate, implement or adopt the smallest versioned bootstrap that remains inside normal branch protection, then obtain a fresh exact-head CodeQL generation. Only after #2105 lands normally may #2040 non-force reconcile onto the new protected tip and run a fresh producer → protected-handler canary.

Do not use predecessor evidence, mutable handler source, force update, destructive rebase, predecessor closure, or evidence transfer. Status remains Proposed until normal protected integration and downstream canary evidence.

Canonical successor / lifecycle correction (2026-09-12)

Fresh comparison against protected main@fb17ef556f94f673234aa557254ae52779e9a7b0 shows this exact head fde889ad611054cad0c1be5a14289b7eb881b124 and #2106 are divergent implementations of the same protected-handler responsibility. This branch preserves valid single-settlement, schema-validation, rerun-budget, ADR, Gap, and test evidence, but its own landing section still proves the normal-protection bootstrap unresolved.

#2106 is the canonical writer because it additionally preserves the legacy v1 title/payload/status boundary, adds a shared v1/v2 concurrency owner, requires v2 producer and ordered merge-parent provenance, documents an explicit v1 removal condition, and carries the denied-credential fallback regression repair. This predecessor was closed only after the canonical successor incorporated its exact head by ordinary two-parent ancestry and the successor comparison proved the complete code, ADR, Gap, fixture, and contract delta preserved. Closure retires the duplicate landing vehicle; it does not mark the protected-main integration complete. No predecessor Checks or review transfer to #2106.

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c2b389e0-d76f-4d36-a741-a3e8b5395304

📥 Commits

Reviewing files that changed from the base of the PR and between fb17ef5 and fde889a.

📒 Files selected for processing (6)

• .github/workflows/codeql-scan-dispatch.yml
• CHANGELOG.md
• docs/adr/0025-codeql-required-workflow-dispatch-architecture.md
• docs/product-technical-gap-baseline.md
• tests/test_codeql_scan_dispatch_workflow_contract.py
• tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact publication receipt: head a5ca9f1c04e73ed653f2bb3ddced4182349edddb, tree c99c98d0ebd2e6dd69bdce8c56cb1d6461cc0e8f, protected base 691fb78932eff5fbe52db69077848134b0b4e053. Every uploaded blob and intermediate tree matched the locally verified Git object SHA. Focused contracts: 66 passed; inherited README contract: 4 passed plus 15 subtests; full suite: 3072 passed, 1 skipped, 36 subtests; compileall and diff-check clean. Draft/Proposed pending exact-head hosted Checks and independent review.

[seonghobae]

Exact-head bounded review completed against a5ca9f1c04e73ed653f2bb3ddced4182349edddb / tree c99c98d0ebd2e6dd69bdce8c56cb1d6461cc0e8f. Reviewed the six-file delta and rollout dependency: the handler is the causal owner; matrix shards are read-only; one settlement job owns mutation; rerun schemas fail closed; attempts 48–50 stop before mutation; docs remain Proposed. No additional substantive source finding. This COMMENT is not approval or merge authority; hosted exact-head checks and independent review remain required.

[seonghobae]

@opencode-agent review

BandScope downstream prerequisite review request. Read-only review exact a5ca9f1c04e73ed653f2bb3ddced4182349edddb against protected main@691fb78932eff5fbe52db69077848134b0b4e053; do not commit/push/restack or alter gates. Verify the six-file handler-bootstrap delta: matrix shards remain mutation-free, exactly one settle-required-run owns required-run mutation, nested rerun schema: "1" and legacy-0 cannot be ambiguously mixed, attempts 48–50 fail closed before mutation with structured diagnostics, and live PR/base/head/run/job/SARIF/status-creator validation is preserved. Do not transfer predecessor evidence. If source-clean, submit formal current-head APPROVED; otherwise submit concrete CHANGES_REQUESTED. Current CodeQL run 34685520218 attempt 2 is still queued and is not approval or merge authority.

[seonghobae]

Fresh hosted evidence turns the remaining rollout problem into a concrete bootstrap-cycle finding. Exact a5ca9f1c... CodeQL PR run 34685520218 attempt 2 is terminal FAILURE: CodeQL compatibility analysis (actions) failed while reading/enforcing the dispatch verdict; CodeQL compatibility analysis (python) read the verdict successfully but failed the final enforce step; Dispatch current-head CodeQL scan then succeeded and spawned protected-main dispatch run 34686384371 for the same PR/head/run, which is queued. Protected main@691fb789... itself requires both compatibility contexts, so #2105 cannot normal-merge while its required evidence is produced only through the old protected handler that #2105 is intended to replace. Treat this as a bootstrap-cycle defect, not a reason for bypass/manual rerun/no-op freshness. The causal repair needs a bounded, auditable handler-upgrade bootstrap that lets the required contexts validate the proposed handler behavior without weakening protection or synthesizing status; preserve exact PR/base/head/run/job/SARIF provenance and do not let arbitrary consumer PRs select mutable handler source. After repair, require a fresh exact-head run and then the planned protected #2105 integration → #2040 non-force reconciliation/canary. Do not count the queued dispatch or the successful dispatch-enqueue job as GREEN.

[seonghobae]

Exact-head review after non-force protected-main reconciliation: fde889ad611054cad0c1be5a14289b7eb881b124 / tree 8f0819472eba62d570a5e6743737872ed7d25586. The five protected-main commits change disjoint runtime-quality/materializer/queue-documentation paths; the six-file handler delta remains byte-identical. Focused handler contracts: 66 passed; inherited new-main contracts: 2 passed; full suite: 3074 passed, 1 skipped, 36 subtests; compileall and diff-check clean. Production RED remains handler run 34686384371: both scans/status publications succeeded, Actions wake succeeded, Python duplicate wake failed. No additional source finding. This COMMENT is not approval or merge authority.

[seonghobae]

@opencode-agent review

Read-only independent review request for exact fde889ad611054cad0c1be5a14289b7eb881b124 against protected main@fb17ef556f94f673234aa557254ae52779e9a7b0. Do not commit, push, restack, rerun, or alter gates. Verify the six-file handler prerequisite and production RED run 34686384371: matrix shards must remain mutation-free; exactly one settlement owner must authenticate all terminal scan/gate/SARIF/status evidence before one run-level mutation; nested schema "1" and legacy-0 must reject ambiguity; attempts 48–50 must stop before mutation. Submit formal current-head APPROVED only if source-clean, otherwise concrete CHANGES_REQUESTED. Use the configured orchestrator/free gateway path; no provider/model override or paid fallback.

[seonghobae]

@opencode-agent review

Fresh exact-head read-only review request for fde889ad611054cad0c1be5a14289b7eb881b124 against protected main@fb17ef556f94f673234aa557254ae52779e9a7b0. Please return a formal GitHub review on this unchanged head: APPROVED only if the six-file handler bootstrap plus ordinary protected-main reconciliation has no actionable source finding, otherwise concrete CHANGES_REQUESTED tied to current code. Do not promote predecessor a5ca9f1c... evidence, queued/cancelled hosted runs, or the circular CodeQL bootstrap itself into success. Do not commit, push, rerun, bypass, weaken protection, or synthesize statuses as part of this review.

[seonghobae]

Canonical successor carryover update: #2106@50adc03d2afbe4a370782e9b7985636f0fcf12fc is a non-force two-parent commit whose second parent is this exact predecessor fde889ad611054cad0c1be5a14289b7eb881b124. Its exact tree 6db1d1484d681616f020fef789aae5979a3db74a retains this branch's nested rerun schema "1" validation and attempt-48 pre-mutation cap while preserving #2106's legacy/v2 bridge and credential-fallback repair. Local exact-tree evidence is 71 focused contracts and 3079 passed / 1 skipped / 36 subtests, with compileall and diff-check clean. Keep this PR open Draft/Proposed until #2106 is ordinarily integrated, protected main is re-fetched, and the carried delta plus downstream canary are verified. This is carryover evidence, not completion or Close authority.

[seonghobae]

Verified complete successor carryover before retirement.

• Predecessor exact head: fde889ad611054cad0c1be5a14289b7eb881b124 (6 changed paths).
• Canonical successor: fix(codeql): bootstrap versioned dispatch handler #2106 at 24bb6591ab7df23558cb793b4af60c567ff9da97.
• Git ancestry and GitHub compare agree that the predecessor head is the successor merge base; fix(codeql): bootstrap versioned dispatch handler #2106 is 16 commits ahead / 0 behind, so every predecessor commit and delta is reachable without force-push, cherry-pick loss, or inferred equivalence.
• fix(codeql): bootstrap versioned dispatch handler #2106 keeps all six predecessor paths and adds only its dedicated doctoring/contract surface. Its exact remote tree passes 72 focused contracts and the full suite at 3,080 passed / 1 skipped / 36 subtests, plus compileall and git diff --check.
• fix(codeql): bootstrap versioned dispatch handler #2106 remains open and is the sole canonical landing vehicle. It is not merge-authorized yet: the protected-predecessor CodeQL cycle and independent formal approval remain open gates.

Closing this Draft predecessor only because complete successor carryover is mechanically proven. No valid delta is discarded; continue review/repair/merge on #2106.