fix(codeql): wake required jobs with the exchanged target app token

[seonghobae]

Current authority

Status: OPEN / Draft / Proposed / do not merge.

• protected base: main@37b10243cec3d160ecc9c1be75c71428b160a703
• ordinary reconciliation: dc9739365a0ee0c5860353d74fdf9f6334aa41e7, parents prior fix(codeql): wake required jobs with the exchanged target app token #2040 head 270292cb01852ea4a134fb7373321f5903290daa and protected main
• exact head: 38a1692bd4419d4be3fb800abe70dd44644ac006
• purpose: keep the CodeQL wake/dispatch path on current-user head-derived GitHub App authentication while preserving current queue, GHAS, retry, and security contracts

Current repair evidence

The protected-main reconciliation was mechanically conflict-free and retained every prior commit. The exact reconciled tree exposed two independent fail-closed findings:

1. Trusted uv 36771261554 could not collect four repository tests because the hash-locked environment omitted PyYAML.
2. Security 36771261528 found five inherited dependency/fixture vulnerabilities; these remain blocking and are not suppressed here.

The collection defect was repaired test-first:

• RED: test_full_quality_gate_installs_yaml_parser_used_by_repository_tests failed before the dependency existed.
• GREEN: canonical requirements-opencode-review-ci.txt pins pyyaml==6.0.3 and the lock is regenerated with scripts/ci/compile_opencode_review_lock.sh.
• focused exact-tree evidence: 449 passed across the 11 affected contract files; git diff --check passed.
• complete exact-tree execution: 5,179 passed, 6 skipped, 40 subtests. The 100% coverage gate still fails with 178 uncovered inherited statements, so this is not repository acceptance.

Fresh hosted Checks for exact head 4fc3cbe… are running. CodeQL 36772455306 is skipped, not passing evidence.

Landing boundary

Ready is review admission only. Keep unmerged until every substantive security and coverage failure is repaired at its canonical owner, all exact-head hosted Checks are terminal GREEN, CodeQL evidence is non-skipped where required, and a qualifying independent current-head review exists.

No force push, destructive rebase, self-approval, review dismissal, scanner suppression, gate weakening, source-neutral wake commit, synthetic status, bypass, or predecessor-GREEN transfer is authorized.

Agent Mention / vulnerable-lock continuation (2026-10-01)

• RED Agent Mention Router Quality run 36772455171/job 110081989610: 13 collection errors on missing defusedxml because the full-suite gate installed only the OpenCode lock.
• GREEN contract: both OpenCode and Noema hash locks are trigger/cache/install inputs; 24 focused tests pass with 2 intentional skips.
• RED Security run 36772455105/job 110082051986: vulnerable fast-uri 3.1.7, ip-address 10.7.0, and PyO3 0.22.6 fixture locks.
• GREEN exact head: fast-uri 3.1.8, ip-address 10.7.2, PyO3 0.29.3; production npm audit reports zero vulnerabilities and the locked Cargo fixture passes unit/doc tests.
• Status remains Draft: fresh hosted exact-head evidence, the inherited 100% coverage deficit, and independent approval remain unresolved.

Python audit continuation (2026-10-01)

• RED Python Security run 36774482440/job 110088891537: urllib3 2.7.0 and PyJWT 2.13.0 vulnerabilities in the pip-audit and Strix locks.
• GREEN exact head ca892db24629bb47ee3e3a767f490c71964368ff: explicit urllib3 2.8.0 / PyJWT 2.15.0 inputs, regenerated hash locks, 4/4 source-to-lock contracts, and zero known vulnerabilities in both full lock audits.
• Status remains Draft for fresh hosted evidence, 100% coverage repair, CodeQL admission, and independent approval.

Full quality evidence continuation (2026-10-01)

• RED exact-head runs: Agent Mention 36775249451 lacked the required APA 7th references baseline marker; Trusted uv 36775249483 had the same failure and could not resolve documented ancestor 57477289… from a shallow checkout.
• GREEN exact head bc428a8673069b6bfc448b3c4af5af927c13ac54: the Trusted uv checkout now fetches complete comparison history while keeping credentials non-persistent and the exact PR head selected; the baseline restores the required APA 7th section with primary Git and actions/checkout references.
• The inherited interrogate deficit was repaired without exclusions: 1,467/1,467 documented, 100.0%. Focused changed-surface verification is 165 passed; compileall and diff-check pass.
• Fresh exact-head hosted runs are active. CodeQL run 36776789605 is skipped and is not passing evidence. Status remains Draft until every required hosted Check is terminal GREEN and an independent current-head approval exists.

Published-tree byte repair (2026-10-01)

The first connector-published child bc428a8… truncated two large blobs and reset four executable modes; hosted runs 36776789608 and 36776789623 correctly failed on resulting NUL bytes. Ordinary child 60dd89e2bdcb18b1521769e62a8a6259cd5a49d4 restores those exact blobs and modes. Its tree 6f793d270a57a0992bc6616b624515763f60ac11 byte-for-byte matches the locally verified tree; a fresh fetch, tree comparison, zero diff, and compileall all pass. Only Checks generated for this corrected head may count.

Circular admission repair (2026-10-01)

The 100% coverage deficit on this branch and the stale-event/CodeQL admission defect on #2536 formed a real cycle: #2040 required #2536's coverage/security delta, while #2536 required #2040's wake/dispatch correction. Exact head 720b629ea05f457015fa334a4547b961ccf63ada is an ordinary two-parent merge of corrected #2040 head 60dd89e2bdcb18b1521769e62a8a6259cd5a49d4 and #2536 head 18c886cbb8c41f5f9c2bcae99640b97d53a4806e.

The published tree 53ec2db9beefd9794abd1bcb2951f91425cfa52d exactly matches the locally verified merge tree. Fresh fetch verified both ordered parents and the tree SHA. Conflict resolution retained #2040's full-history Trusted uv checkout, split OpenCode/Noema locks, and PyO3 0.29.3 fixture, while integrating #2536's PyJWT 2.15.1/urllib3 2.8.0 locks, coverage regressions, HTTP lifecycle fixes, and repository-metadata ancestry repair.

Local exact-tree evidence: no unresolved conflicts; git diff --check and compileall passed; focused combined contracts reported 1,603 passed; interrogate reported 1,467/1,467 documented (100.0%). Fresh hosted exact-head Checks alone determine admission. CodeQL run 36778720261 is skipped and is not passing evidence. No bypass, force update, manual rerun, synthetic status, source copy, or predecessor-GREEN transfer was used.

Repository Metadata collection repair (2026-10-01)

Fresh successor run 36778720069, job 110103096014, passed metadata validation, targeted 100% branch coverage, and docstring validation, then failed the repository-wide pytest collection with 13 ModuleNotFoundError: defusedxml errors. The workflow installed only the OpenCode lock even though the full suite imports Noema's released document parser dependency.

Exact head bebf8bfb72cfb9fe5a012f33322d8d4518be4ce9 (tree 4d91c15e385dd4e8fb83f33c2376e7e685a9c734) installs both hash locks and observes both Noema requirement surfaces. RED workflow contract failed before the repair; GREEN focused metadata workflow contracts report 26 passed. Diff-check, compileall, and repository interrogate 100% pass. Remote fetch verified the exact one-parent child of 720b629ea05f457015fa334a4547b961ccf63ada. Fresh hosted Checks alone may authorize this head.

LiteLLM credential-exfiltration / SSRF repair (2026-10-01)

Python Security run 36779036029, job 110104335583, found litellm==1.94.1 affected by CVE-2026-84377 in the Strix hash lock. The finding permits an authenticated proxy user to redirect provider traffic and expose stored provider credentials or reach internal services through nested overrides.

Exact head 4f49718206c7919fc46c2b60118a868818207f49 (tree 9036560e1266d8f9d6664c61cc6f49d99d2fba90) explicitly pins patched LiteLLM 1.94.3, regenerates the cross-platform hash lock, and binds source/lock parity. RED failed before the source pin; GREEN focused dependency contracts report 6 passed, and pip-audit==2.10.1 reports no known vulnerabilities for the regenerated lock. The detailed failure scene, alternatives, residual risk, and APA 7th references are recorded in docs/doctoring/shared-security-baseline-litellm-20261001.md. Fresh hosted exact-head security evidence remains mandatory.

Integrated contract reconciliation (2026-10-01)

Repository Metadata run 36779627842, job 110106171836, proved the Noema dependency closure by collecting and executing the full suite: 5,271 passed, 5 optional skips, and 40 subtests. Its two remaining failures were stale test literals: the parser contract read only the OpenCode lock despite the workflow installing split OpenCode/Noema locks, and the Rust fixture contract retained predecessor PyO3 0.29.2 after the reviewed artifact advanced to 0.29.3.

Exact head 19b338a1047166d1a0da6f80e05f902ab044f78f (tree 25b5e2ff2054a9a6e9aed2b84608145c93da8426) aggregates both installed locks and binds the current PyO3 artifact. The unfiltered local repository suite is GREEN: 5,273 passed, 5 optional skips, and 40 subtests in 293.08 seconds. Interrogate 100%, compileall, and diff-check pass. Production behavior and gates are unchanged; fresh hosted exact-head Checks remain mandatory.

Latest review-authority integration (2026-10-01)

Exact head 38a1692bd4419d4be3fb800abe70dd44644ac006 (tree c79e6908a9b1b0b1dd8ba7e5946184fd36bad662) is an ordinary two-parent merge of prior #2040 head 19b338a1047166d1a0da6f80e05f902ab044f78f and current #2536 head 6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3. It preserves #2040's CodeQL wake/dispatch repair while integrating #2536's latest exact-head review authority and associated Noema/Strix security contracts. The sole textual merge conflict was a duplicate LiteLLM 1.94.3 regression name; the more specific SSRF/credential-exfiltration name was retained without duplicating behavior.

Fresh local exact-tree evidence: focused integration contracts 62 passed, 2 optional skips; unfiltered warning-fatal repository suite 5,274 passed, 5 optional skips, 40 subtests in 267.55 seconds; interrogate 100.0%, compileall, diff-check, ordered-parent, and tree-SHA verification all passed. Publication invalidates every predecessor Check and review. Fresh exact-head hosted evidence alone may authorize this head. No force update, bypass, manual rerun, synthetic status, or predecessor-GREEN transfer was used.

[seonghobae]

Fresh exact-head hosted evidence for 19b338a1047166d1a0da6f80e05f902ab044f78f:

• Repository Metadata Reconcile 36780651575: GREEN
• Trusted uv Materializer Quality 36780651692: GREEN
• Agent Mention Router Quality 36780651570: GREEN
• Python Security 36780651585: GREEN
• Security Scan 36780651629: GREEN
• SAST Semgrep 36780651597: GREEN
• Agent Review Runtime Quality 36780651555: still in progress
• CodeQL 36780651646: skipped, not passing evidence

The PR remains Draft/Proposed. No merge or bypass is authorized while Agent Review is non-terminal, CodeQL lacks non-skipped evidence where required, and a qualifying independent current-head approval is absent.

[seonghobae]

Ready-admission rationale for exact head 19b338a1047166d1a0da6f80e05f902ab044f78f:

• all seven applicable exact-head Draft-event workflows are terminal success: Repository Metadata 36780651575, Trusted uv 36780651692, Agent Mention 36780651570, Agent Review 36780651555, Python Security 36780651585, Security 36780651629, and SAST 36780651597;
• the repository-wide exact-tree suite is already recorded as 5,273 passed, 5 optional skips, 40 subtests, with 100% interrogate, compileall, and diff-check;
• there are zero inline review threads, so no unresolved substantive finding is being hidden;
• Draft CodeQL 36780651646 was skipped and is not treated as passing evidence.

This Ready transition starts ordinary CodeQL and independent review admission. It does not authorize merge, auto-merge, bypass, synthetic status, manual rerun, or transfer of predecessor evidence. The PR remains unmergeable by policy until fresh non-skipped exact-head CodeQL, every other required terminal Check, and a qualifying independent current-head approval exist.

[seonghobae]

Latest ordinary integration published on .github#2040:

• exact head: 38a1692bd4419d4be3fb800abe70dd44644ac006
• tree: c79e6908a9b1b0b1dd8ba7e5946184fd36bad662
• ordered parents: prior fix(codeql): wake required jobs with the exchanged target app token #2040 19b338a1047166d1a0da6f80e05f902ab044f78f, current fix(opencode): withhold approval on incomplete coverage evidence #2536 6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3
• local exact-tree evidence: 62 passed / 2 optional skips focused; 5,274 passed / 5 optional skips / 40 subtests repository-wide with warnings fatal; interrogate 100%; compileall and diff-check passed
• current remote state: OPEN / Ready / mergeable, zero review threads; all eight fresh exact-head workflows are queued

The predecessor Ready-event CodeQL failure 36782971130 is retained as self-hosting evidence: both shards reached authenticated pending, while the coordinator's exchanged app token received HTTP 403 on the central repository dispatch. It is not transferred as current-head evidence. No force update, bypass, manual rerun, synthetic status, closure, or merge was used.

[seonghobae]

Exact-head admission result for 38a1692bd4419d4be3fb800abe70dd44644ac006: seven hosted workflows are terminal GREEN (Repository Metadata, Trusted uv, Agent Mention, Agent Review, Python Security, Security, SAST). CodeQL PR run 36784069940 is terminal RED. Coordinator job 110121731055 successfully obtained a nonempty OIDC-exchanged repository-scoped app token, validated the live exact head/base and pending language matrix, then failed the owner dispatch at POST repos/ContextualWisdomLab/.github/dispatches with Resource not accessible by integration (HTTP 403).

This is an installation/permission capability failure at the canonical CodeQL dispatch owner, not a test failure or transient queue result. The PR remains Ready/Proposed and unmerged: no independent current-head approval exists, and the required CodeQL evidence is substantive RED. No bypass, rerun, synthetic status, force update, or predecessor evidence transfer was used.

[seonghobae]

Exact-head CodeQL continuation RCA — 2026-10-01

• Exact head 38a1692bd4419d4be3fb800abe70dd44644ac006 remains preserved.
• CodeQL run 36784069940, coordinator job 110121731055, failed after successful OIDC exchange when posting the central repository dispatch: gh: Resource not accessible by integration (HTTP 403).
• This repeats the same exact operation that failed on predecessor run 36782971130; a success on another PR does not transfer evidence to this head.
• GitHub repository dispatch requires target-repository Contents: write. Broadening or returning that credential to the consumer would violate the least-privilege boundary.
• Canonical owner issue noema#735 and Draft PR noema#736 currently broker only noema-review and strix-scan. Their closed v1 action enum and event map do not admit this workflow's fixed codeql-scan-v2 event or its matrix, required_run_id, required_jobs, and producer_source_sha evidence.

PR #2040 is therefore Draft / Proposed. Do not rerun, merge, bypass, broaden the consumer token, or count another PR/head's successful dispatch. The repair path is: extend the Noema owner contract with a closed CodeQL continuation request and RED tests → exact-head GREEN → immutable versioned release → pin and adopt that release here → revalidate this exact current head.

[seonghobae]

Lifecycle correction after a concurrent state refresh: exact head 38a1692bd4419d4be3fb800abe70dd44644ac006 is now Draft / Proposed / do not merge, still open and mergeable. This is the correct state for the substantive CodeQL 403 and absent independent exact-head approval. The four listed inline threads are all resolved/outdated (zero unresolved).

[seonghobae]

Live downstream acceptance evidence (2026-10-01 UTC): ContextualWisdomLab/clearfolio#659 was converted from Draft to Ready at exact head cd9fe4cbbb457074c6d01882e729aa13017ed25f. All non-CodeQL source/security/review checks are terminal success, but CodeQL PR run 36794407912 remains the earlier Draft-generation skipped run (created 00:05:37Z); the Ready update at 00:09:43Z produced no new CodeQL run. This is a real same-head ready_for_review wake failure, not a leaf-source defect.

This owner head also has a separate exact failure: CodeQL PR 36784069940, job 110121731055, reached POST repos/ContextualWisdomLab/.github/dispatches and failed Resource not accessible by integration (HTTP 403) using the exchanged repository-scoped App token. Thus #2040 is correctly still Draft: the live RED now covers both event wake and actual dispatch authority. Preserve the existing exact-head/fail-closed contracts; do not substitute a no-op consumer commit, manual rerun, synthetic status, or bypass. The short-lived cross-repository capability prerequisite remains the noema#736 → immutable release → .github#2540 consumer chain.

[seonghobae]

Cross-repository circular-admission repair ledger — 2026-10-01 UTC

This pass re-fetched live head/base/mergeability/check state and repaired every newly observed non-circular topology or contract defect without force update, rebase, bypass, merge, close, synthetic status, or manual rerun.

• noema#736@81568910dccff168681b9b923e2c7667861b1063: CI, Security, reviewer-ci, and patch-validator-image are terminal GREEN. It remains Ready/open/mergeable with no qualifying approval and no immutable Noema release.
• .github#2540@a4c1c7052d4a78bccc381f943d570ba00acd84f0: repaired its moved-fix(ci): integrate parser, security, response, and coverage gates #2530 conflict through an ordinary two-parent merge with current owner 813f16fad7528b035d6ae4386cd176c9a67413c1; ahead 12 / behind 0, mergeable, exact nine-file delta preserved. Exact-head Security 36804492171 and SAST 36804492204 GREEN; CodeQL 36804492185 Draft-skipped.
• .github#2546@bd05e83c7e4b425a499c488c2b98f1d791d150ce: repaired its moved-fix(ci): integrate parser, security, response, and coverage gates #2530 conflict the same way; ahead 3 / behind 0, mergeable, exact 12-file delta preserved. Security 36804188858 and SAST 36804188797 GREEN; CodeQL 36804188825 Draft-skipped.
• clearfolio#659@ad8c7a583bd9c667d169870f18e1f477b9971382: added RED→GREEN tenant-admin authorization coverage and canonical admin:operate role/API documentation. CI, Security, SAST, and fuzz GREEN; CodeQL 36803783022 is fail-closed pending with successful dispatch, not a terminal source verdict.
• pg-erd-cloud#1246@28a488b8545b93e0d8eadd52c4f4d7f4b683a972: added explicit DEL coverage at both display-field boundaries; CI and SAST GREEN, Security still in progress, CodeQL 36803424295 fail-closed pending after successful dispatch.
• seedream_evasepic#532@104b40b963dd2199c5136cea3727f0d0aab12429: repaired a second concurrent deletion/reordering of fix(opencode): use retry budget across model-pool cycles #530-owned LC_ALL evidence. It is ahead 18 / behind 0 and again exposes only four intended performance paths (+23/-0); Draft with no exact-head hosted run.
• .github#2543@038283d3a6db4954879ed9b7d2f54d51fb08aa3f and .github#2531@7900ba4c4d68c378023592252f2579646fad9aaa: their current CodeQL failures are fail-closed VERDICT_STATE=pending after successful central dispatch; both are Draft and no manual reruns were used.

The original #2040 exact head 38a1692bd4419d4be3fb800abe70dd44644ac006 remains Draft/open/mergeable. Its CodeQL 36784069940 still has the substantive central-dispatch HTTP 403, so the released Noema capability → pinned .github consumer → fresh exact-head evidence chain remains the causal gate. No circular-admission bypass is authorized.

[seonghobae]

2026-10-01 exact-head CodeQL coordinator RCA

Current exact head remains 38a1692bd4419d4be3fb800abe70dd44644ac006. Security 36784069932, Python Security 36784069886, SAST 36784069872, Agent Mention 36784069941, Trusted uv 36784069912, Repository Metadata 36784069882, and Runtime Quality 36784069965 are terminal GREEN.

CodeQL run 36784069940 is a real fail-closed transport blocker, not a source finding. Coordinator job 110121731055 validated the current PR/head/base, constructed the exact language/job payload, obtained OIDC and an exchanged app token, then POST repos/ContextualWisdomLab/.github/dispatches failed with Resource not accessible by integration (HTTP 403). The compatibility shards failed because no authenticated terminal dispatch proof could exist.

GitHub requires Contents: write for repository dispatch and exposes no narrower dispatch-only GitHub App permission. Returning a broader installation token to a consumer workflow is not the least-privilege repair. The canonical prerequisite is the Noema broker tracked by ContextualWisdomLab/noema#735 / #736 and documented in .github#2540: validate exact OIDC/workflow/PR/head/base authority server-side, perform the one allowlisted central dispatch internally, and return signed exact-revision evidence without exposing a GitHub credential.

Keep this PR Draft and alive. Do not add a PAT, central inherited secret, github.token consumer fallback, synthetic status, permission bypass, empty wake commit, or unchanged rerun. After an immutable Noema broker release, replace the legacy /exchange_github_app_token + local gh api sequence, pin the release, and revalidate exact-head CodeQL.

[seonghobae]

Exact-head RCA, corrected by newer live evidence:

• On fix(codeql): wake required jobs with the exchanged target app token #2040 head 38a1692bd4419d4be3fb800abe70dd44644ac006, CodeQL run 36784069940 reached the coordinator after App exchange, then the central dispatch POST failed at 2026-09-30T22:13:14Z with gh: Resource not accessible by integration (HTTP 403).
• That single failure is not sufficient to prove a permanent authority-boundary defect. On 2026-10-01, the same /exchange_github_app_token + POST /repos/ContextualWisdomLab/.github/dispatches path completed successfully for exact runs 36817399378 (fix(ci): integrate parser, security, response, and coverage gates #2530, coordinator job 110225420987) and 36817318806 (perf(review): scan backward for the last admissible label #2543, coordinator job 110225184270). The newer jobs exchanged the token and completed the direct dispatch step without 403.
• Therefore the durable finding is narrower: fix(codeql): wake required jobs with the exchanged target app token #2040's exact-head run has a reproducible historical 403, while the current deployed capability can dispatch the same repository/event path. The missing evidence is the configuration/deployment change or other causal difference between those executions, plus terminal downstream CodeQL verdicts. Do not widen App permissions or extend the Noema broker solely from the stale 403 inference.

Current action: keep #2040 Draft/HOLD; compare token-installation identity and deployed exchange configuration at the two run times, retain the exact failed log, and rerun only after a causal delta is identified. No merge/bypass/repeated no-op rerun is authorized.

[seonghobae]

Additional exact-run evidence for the wake/dispatch owner

Current owner head remains 38a1692bd4419d4be3fb800abe70dd44644ac006 (open, Draft, mechanically mergeable). A fresh read of downstream .github#2531@7900ba4c4d68c378023592252f2579646fad9aaa adds a distinct retry/settlement case:

• required CodeQL run 36804208074 is on attempt 2;
• python job 110220634762 and actions job 110220634887 fail closed because no authenticated terminal verdict/status or completed handler proof is visible;
• coordinator job 110220685546 completed the OIDC/App-token path and submitted one exact codeql-scan-v2 repository dispatch for both languages;
• the commit currently has no codeql-dispatch/* status.

This does not reproduce #2040's historical HTTP 403 and does not justify widening credentials. It also is not enough to assert that the handler failed: the connected API does not expose the matching repository_dispatch run inventory here. Preserve fail-closed behavior and the existing later-attempt recovery contract; identify the exact handler run/status before changing concurrency or settlement logic. No no-op rerun or duplicate dispatch was issued in this run.

[seonghobae]

Current owner-chain authority — exact head 38a1692bd4419d4be3fb800abe70dd44644ac006

A fresh exact-head/base/comment/check/review read preserves Draft / Proposed / merge HOLD. The PR is open and mechanically mergeable, but the owner dependency is still mutable and no qualifying current-head approval exists.

• Foundation Noema#737 is open/Ready/mergeable at 5d9b4d00f1b692f3b911f4a56d834831d5b65bee; exact-head CI 36827780015, reviewer-ci 36827780022, Security 36827779881, and patch-validator-image 36827780026 are terminal GREEN. Unresolved threads: 0; APPROVED: 0.
• Broker Noema#736 is open/Ready/mergeable at 7487485a858f3d26827cabf153bdad3925ab577d, stacked on that exact fix(coverage): materialize trusted uv lock dependencies #737 head. Exact-head CI 36834849920, reviewer-ci 36834849874, and patch-validator-image 36834849867 are terminal GREEN. The three review findings are resolved; unresolved threads: 0; APPROVED: 0. A current-head Security run is absent because the stacked feature base is outside the protected-main Security ruleset, so no four-GREEN claim is made.
• Downstream .github#2540 remains Draft/open/mergeable at d8bc25753dcec4cb83b816835568c0e11a27f4e5; Security 36814718513 and SAST 36814718496 are GREEN, while Draft-gated CodeQL 36814718724 is skipped and is not acceptance evidence.
• Live consumer contextual-orchestrator#1346 is Ready at d6061498756a2e30e7d759c5e44f5233860da17b. Its source/security lanes are terminal GREEN, but CodeQL 36877037449 failed closed with authenticated VERDICT_STATE=pending; the bound central dispatch 36877580698 / job 110420869944 is queued. This confirms the terminal-settlement gap without introducing a source/SARIF finding.

Ordinary integration and immutable release must proceed in dependency order before the consumer pin. No wider credential, branch pin, source copy, duplicate wake, manual rerun, bypass, state toggle, merge, or Close was used.

[seonghobae]

Fresh ready_for_review stale-event reproduction

Consumer feelanet-adfs#30 now provides a distinct exact-head event-generation case:

• exact head: 02af2ab368b45d676060c7c98b94c7622437271f
• the branch push while Draft created CodeQL PR run 36911450601, which completed SKIPPED
• source remediation is independently evidenced: Security Scan 36911450746 and Semgrep 36911450456 are terminal SUCCESS, and the remote dependency contract is 12/12 GREEN
• the PR was moved Draft → Ready exactly once after a fresh head/comment/check/review read
• subsequent exact-head workflow refresh still exposes only the pre-Ready skipped CodeQL run; no fresh CodeQL admission run is associated with the unchanged SHA

This is evidence of a ready_for_review wake/admission gap, not a leaf source or SARIF finding. The consumer was not toggled again, no manual rerun or synthetic status was created, and merge remains held for independent review and CodeQL acceptance evidence.

[seonghobae]

Noema prerequisite-chain reconciliation — exact evidence

Central owner head remains 38a1692bd4419d4be3fb800abe70dd44644ac006 (open, Draft, mechanically mergeable); no state mutation is authorized by this note.

The Noema prerequisite chain is no longer stale against its immediate base:

• Noema fix(coverage): materialize trusted uv lock dependencies #737 remains Ready at exact 95f8b284f92bece8d1611cafe340e02cbc172d67, mergeable, with Security Scan 36937992916, patch-validator-image 36937993041, reviewer-ci 36937993042, and CI 36937992976 all SUCCESS; unresolved threads and qualifying independent approvals are both zero.
• Noema fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base #736 advanced non-destructively to exact a5d65a47b1c4a34cdf9768206fc918c38980c3a7 through a force=false two-parent merge. It is 40 ahead / 0 behind fix(coverage): materialize trusted uv lock dependencies #737, mechanically mergeable, and preserves both continuation-dispatch and scanner-retry deltas. Current hosted state: reviewer-ci 36938560034 completed/success; ci 36938559982 completed/success; patch-validator-image 36938560100 completed/success.
• fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base #736 correctly remains Draft because fix(coverage): materialize trusted uv lock dependencies #737 is an unmerged mutable prerequisite and immutable Noema release/deployment evidence does not yet exist.

This removes the stale stack-ordering defect only. It does not satisfy #2040's substantive source/security/coverage gates, Noema independent approval/ordinary merge/release, protected-main revalidation, or downstream version pin. No bypass, blind rerun, wake commit, release, deployment, or merge was performed.

[seonghobae]

Correction by newer concurrent authority: the immediately preceding Noema-chain note was exact when written at #736 a5d65a47b1c4a34cdf9768206fc918c38980c3a7, but #736 then advanced non-force to 9e8bd9bad04623ca17686fd2704a6ed8173ed3cd (tree 45a4aad42d43e243bc885e1f7b56542d350b9d88) to reconcile three stale Gap-register claims with the merge evidence.

The newer head remains open, Draft, mechanically mergeable, and 41 ahead / 0 behind #737 exact 95f8b284f92bece8d1611cafe340e02cbc172d67. Fresh exact-head Checks are ci 36938969091 in_progress, reviewer-ci 36938969090 in_progress, patch-validator-image 36938969083 in_progress; nonterminal is not GREEN. The existing Draft / Proposed / merge HOLD authority is preserved. No lifecycle toggle, rerun, wake event, bypass, merge, release, or deployment was performed.

[seonghobae]

Additional Ready-admission stale-event reproduction

Current owner head remains 38a1692bd4419d4be3fb800abe70dd44644ac006 (open, Draft, mechanically mergeable); this note does not change its lifecycle.

appguardrail#1324 provides a fresh exact-head case:

• exact head 6cb854cf247b42c9459ac60bd32e8eb706bed460, tree 21a806b13a4731162a88f249898557dd33023188;
• source regression repaired: protected-base diff restored to three files, 24 ahead / 0 behind, mixed import removed, all review threads resolved;
• eight non-CodeQL exact-head workflows are terminal SUCCESS;
• Draft-era CodeQL 36943413398 is terminal SKIPPED;
• after a legitimate one-time Draft→Ready review-admission transition, no fresh CodeQL run/event generation appeared.

This is the same causal class as other ready_for_review stale-event cases: Ready is correct, but the required current-head scan is absent. Preserve the consumer state and repair the central admission/wake owner; do not use a second toggle, manual rerun, no-op commit, bypass, or synthetic status.

[seonghobae]

Fresh unchanged-head CodeQL settlement failures

Two Ready, mechanically mergeable consumers reproduce the central first-attempt→settlement gap without leaf-source changes:

• LineageWeave#1129@950a6b78c9b9d78e1aa7d520e9999f9dfa544a03: CodeQL run 36947092229; coordinator job 110652100066 completed SUCCESS after exact PR/head/base validation and dispatch. JavaScript/TypeScript, Actions, and Python compatibility jobs failed with the documented first-attempt pending verdict. The exact head has no authenticated codeql-dispatch/* status and the required run has no attempt-2 settlement.
• EmbedRelay#4@4ccfe7b921e9e8eeae6a6c60da49e8d42b8ae0b1: CodeQL run 36946858996; coordinator job 110651090581 completed SUCCESS after dispatch. Actions and Python compatibility jobs likewise remain first-attempt pending failures, with no exact-head codeql-dispatch/* status and no attempt-2 settlement.

Both cases were re-fetched after the dispatch window; no head/base drift, unresolved review thread, or consumer CodeQL source verdict explains the missing settlement. This is exact evidence for the owner path, not authorization to toggle Ready/Draft, issue a manual rerun, create a wake commit/status, widen credentials, bypass, or merge. #2040 remains Draft because independent approval and its owner prerequisites are unresolved.

[seonghobae]

새 consumer regression specimen (2026-10-03): ContextualWisdomLab/appguardrail#1372 exact head d462cc359e26b92481d33717fd8dc59fb9b39d28, CodeQL PR run 36937798757.

• dispatch coordinator job 110628210838: success
• actions receiver job 110628125450: failure
• python receiver job 110628125270: failure
• 두 receiver 모두 attempt 2에서 terminal authenticated verdict를 찾지 못해 Exact CodeQL job was rerun without an authenticated terminal verdict로 종료했습니다.
• 같은 consumer head의 Tests/Security Scan/Security Process/SAST 및 나머지 보안 workflow는 success이며, 변경은 SHA-pinned github/codeql-action/upload-sarif 4.37.6→4.38.2 한 줄입니다.

이 표본은 source defect보다 #2040의 wake/dispatch authority 경계에 해당합니다. #1372는 Draft로 유지했고 blind rerun/no-op wake는 하지 않았습니다. #2040이 정상 보호 통합된 뒤 consumer fresh exact-head terminal verdict로만 회귀 해소를 판정해야 합니다.