CodeQL quality suites: measured before any setup change; keep default setup (plan M4)

[seathatflowsinourveins]

Scope

• Measures the CodeQL quality suites before any setup change (plan M4), and records the decision: keep default setup, do not switch to advanced security-and-quality now, keep the PATCH to extended deferred, and leave the ruleset unchanged.
• No workflow file or repository setting changes.
• Base commit: ba1700ad; main merged in at f508ffba per the docs/lanes.md hot-file protocol.
• Lane: lane:foundation.
• Owned paths:
  • docs/decisions/2026-09-27-codeql-quality-suites.md
  • evidence/artifacts/codeql-quality-measure-20260927/
  • manifests/evidence.json

SOTA sources

• https://github.com/github/codeql-action release codeql-bundle-v2.27.1. It is the CLI version the live default setup used at ba1700ad, and it was verified with the API digest, the checksum asset and gh release verify-asset.
• https://github.com/github/codeql query suites python/javascript/actions *-code-quality.qls and *-security-and-quality.qls.
• GitHub docs on CodeQL query suites, default setup and Code Quality availability. The paid Code Quality product is Team/Enterprise only, so it does not apply to this user-owned repository.

Evidence-class table

Claim	Evidence class	Command / receipt
Local default-suite SARIF equals live default setup at ba1700a (python 16=16, js 1=1, actions 0=0)	native_proven	evidence/artifacts/codeql-quality-measure-20260927/
Result counts: code-quality python 979, js 188, actions 0 (0 queries selected); security-and-quality python 1072	native_proven	same receipt
20-alert stratified sample: 8 false positive, 8 real and actionable (7 hygiene, 1 reliability), 4 real but not actionable	source_review	triage table in receipt
Recommendation and overturn condition	decision	docs/decisions/2026-09-27-codeql-quality-suites.md

Local commands run

$ codeql database create/analyze (2.27.1) for python, javascript-typescript, actions; 4 suites each
$ gh release verify-asset codeql-bundle-v2.27.1 codeql-bundle-linux64.tar.gz --repo github/codeql-action
exit 0 (negative control fails)
$ python3 scripts/validate.py
passed

Decision record

docs/decisions/2026-09-27-codeql-quality-suites.md. It records:

• the alternatives: switch to advanced security-and-quality; PATCH the default setup to extended; keep as is;
• the measured signal: the quality gate would add about 1,250 open alerts, mostly noise or hygiene that the gate ignores;
• the overturn condition.

The 8 real actionable findings are listed for follow-up. They are not fixed here.

Review

• Claude evidence-reviewer: no changes needed. Minor residuals are recorded in the receipt.
• Cross-family GPT-6 review (codex exec -s read-only -m gpt-6-astra, effort max, on 90dbf097, 2026-09-28): changes-needed.
  • P2: alternative 4 claimed the same gate effect as security-and-quality, but it omits 43 Python results, including 30 error-level py/uninitialized-local-variable.
  • P2: a bare wait in run.sh let a replay exit 0 with ALL DONE after failed steps.
• Repair round (8424dc33):
  • Alternative 4 now states the measured difference.
  • run.sh waits on each PID and stops the analysis loop on a failed step. It was probed with a stub codeql.
  • The retained logs show that every step of the recorded run exited 0, so the recorded counts stand.
  • A Claude stack-verifier re-ran the probes, including an exact 12-SARIF comparison: pass.
• Residual: with no argument, set -u stops run.sh before it clears steps.tsv. This predates the change.

Checklist

• No Actions changed.
• No secrets.
• No paid hosting.
• Peer files preserved.

🤖 Generated with Claude Code