fix: validate versioned CodeQL head envelope

[seonghobae]

Successor repair for #2043.

owner-session: fast-mlsirm-commercialization

Exact head 3720dd853fe399fd453e093a90944b2b0e78a8e6 (tree 0a097a047426349c09ba8a763e8f91d15cf39471) is an ordinary, non-force two-parent reconciliation of predecessor head bfca56f40fa7c8ef03c1ef2cab28007c68a93d8c and current base #2043@0fb9151f70784a7f0054d82ee8cdcd7b64912034. It is 10 commits ahead / 0 behind and changes only the workflow, its executable contract, CHANGELOG, ADR-0025, and the product-technical Gap baseline.

The current exact head resolves the P1 dual-identity ambiguity: the raw nested pr_head envelope and legacy pr_head_ref / pr_head_sha scalars are captured independently; any partial or unequal dual representation fails closed. Nested-only and legacy-only payloads remain accepted after schema/type validation and live PR-head verification. The current #2043 raw-type and incomplete-envelope checks are preserved.

RED→GREEN lineage is preserved in history:

• 7f0615bc43eeaf3f825faac258a4c20d6007ba55: executable RED conflict/static contracts.
• 4434a5d1e14c81e84cb08caca5e3c50e4c1b1d5c: minimal dual-identity fail-closed implementation.
• bfca56f40fa7c8ef03c1ef2cab28007c68a93d8c: documentation binding.
• 3720dd853fe399fd453e093a90944b2b0e78a8e6: non-force current-base reconciliation preserving both semantic deltas.

Exact integrated-tree verification: focused 39 passed; full 3001 passed / 1 skipped / 21 subtests; statement and branch coverage 100%; public-doc coverage 100%; git diff --check clean. Local actionlint is unavailable, so hosted validation remains a merge gate.

Ready is review admission only. Fresh exact-head hosted Checks and a qualifying independent current-head review are merge gates, not Ready prerequisites. No predecessor Check/review transfers and no automatic merge, approval, or protection bypass is authorized.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9943e6b9-e087-47a3-9352-44cf3f426725

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@codex review

Review only exact head 0caa75a37d8a0f8e57903d3311e11e75a6db1445 as successor to #2043. Verify the execution-based versioned pr_head envelope test exercises the real validation shell, asserts exact emitted ref/SHA, and preserves the predecessor workflow contract. Do not transfer predecessor review or Checks.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T11:46:54.784740Z	0caa75a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0caa75a37d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seonghobae]

Exact-head CodeQL RCA — head 0caa75a37d8a0f8e57903d3311e11e75a6db1445

• failed compatibility job: 102047878547 (actions)
• dispatch outcome: success
• authenticated verdict state: pending
• log error: CodeQL scan dispatched. The dispatch workflow will rerun this exact failed CodeQL job after publishing its terminal verdict.

This is an asynchronous dispatch/terminal-verdict wait-state, not source-vulnerability evidence. The job exited non-zero by contract while awaiting the exact-head dispatch result; no blind rerun or gate weakening performed.

[seonghobae]

Exact-head OpenCode RCA — head 0caa75a37d8a0f8e57903d3311e11e75a6db1445

• job 102049341501 failed because no APPROVED or CHANGES_REQUESTED review from opencode-agent existed on the current head.
• The dispatch contract explicitly exits non-zero and requests a rerun after publishing an authenticated exact-head verdict.
• This is missing current-head review evidence, not a source finding. Previous reviews are not transferred across heads. No dismissal, blind rerun, or gate weakening performed.

[seonghobae]

Exact-head Noema RCA — head 0caa75a37d8a0f8e57903d3311e11e75a6db1445

• Noema job 102049652668 reached the CO sidecar and failed during gateway transport.
• Evidence: HTTPError 429 Too Many Requests; caller attempts 1; duration 145.0s; phase response_error; served model deepseek-ai/deepseek-v4-flash-0731.
• The job also records that gateway owns repair/failover.

This is canonical contextual-orchestrator capacity/transport evidence, not a source-code finding in this PR. Keep the gate failed closed; do not bypass, downgrade the verdict, or add a paid/provider fallback. Repair belongs at the CO owner and must be revalidated on a new exact head.

[seonghobae]

Exact-head CodeQL dispatch RCA — head 0caa75a37d8a0f8e57903d3311e11e75a6db1445

• dispatch scan covered 36/36 GitHub Actions files and produced results=0, medium_plus=0.
• status publish with target-app-token was rejected: HTTP 403 Resource not accessible by integration.
• a status publish using github-token was logged, but the wake step then reported that an Actions-capable canonical wake credential was unavailable/non-canonical, so the exact failed job was not rerun.
• This is a central CodeQL wake-credential/permission contract failure, not a source finding in the successor test. Keep fail-closed behavior; repair the canonical owner and rerun only with a new exact-head evidence chain.

[seonghobae]

Exact-head CodeQL RCA — 057ef77deffcdebea1c5cc55046b3193f4d70abe, run 34225208827

• Python job 102058665310: dispatch succeeded, but the authenticated exact-head verdict was still pending; it failed closed by contract.
• Actions job 102058663889: the job was already a rerun and still found no authenticated terminal verdict, so dispatch outcome was failure and it failed closed rather than creating another unbounded dispatch.
• Handler dispatch job 102059169139 itself succeeded. Security Scan and Semgrep are GREEN.

This is exact settlement/recovery evidence, not a source-analysis GREEN. No blind rerun or gate weakening is appropriate. Keep Draft until the canonical #1902/#2040 settlement and wake-credential deltas are integrated with this versioned head-envelope contract, then generate a fresh combined exact-head CodeQL verdict and independent review.

[seonghobae]

Post-admission exact-head RCA (2026-09-08)

Ready transition generated a new exact CodeQL run, so the earlier GREEN is no longer merge authority. Current exact head remains 057ef77deffcdebea1c5cc55046b3193f4d70abe.

Required run 34227288794 and dispatch 34227606169 prove both language analyses and SARIF gates succeeded, but concurrent per-language wake caused Python to receive HTTP 403 (workflow run containing this job is already running) after Actions had already started attempt 2. The Python required shard remains failed; Actions is non-terminal. The only recorded review is COMMENTED on predecessor 0caa75a..., not a qualifying current-head approval.

This consumer should not work around the central recovery defect. Exact canary evidence is routed to canonical #1902. Returning to Draft until unchanged-head CodeQL settles terminal GREEN and a qualifying independent current-head review exists.

[seonghobae]

Review-admission rationale — exact head 057ef77deffcdebea1c5cc55046b3193f4d70abe

Draft 전환 뒤 CodeQL PR run 34227288794이 attempt settlement를 거쳐 terminal GREEN으로 회복했고, 같은 exact head의 Security Scan 34227288716과 Semgrep 34227289035도 GREEN입니다. Run-wide wake race canary와 root-cause repair 의무는 canonical #1902에 보존되어 있습니다.

현재 유일한 Codex review는 predecessor 0caa75a37d에 대한 COMMENTED 기록이므로 current-head approval로 이전하지 않습니다. 이제 Ready로 전환하는 목적은 exact-head independent review admission뿐입니다. 전환 후 새로 생성되는 Checks와 qualifying approval가 모두 충족되기 전에는 merge하지 않습니다.

[seonghobae]

P1 exact-head protocol ambiguity on 057ef77deffcdebea1c5cc55046b3193f4d70abe.

The raw-object/type checks correctly reject numeric schema, but the handler cannot detect a conflicting dual representation. SUPPLIED_HEAD_REF and SUPPLIED_HEAD_SHA are computed with pr_head.ref || pr_head_ref / pr_head.sha || pr_head_sha; when both shapes are present, the nested value shadows the legacy scalar before validation. The later equality check therefore compares the envelope to values already extracted from that same envelope, and a payload such as pr_head={schema:"1",ref:"feature-a",sha:"<A>"} plus pr_head_ref="feature-b", pr_head_sha="<B>" is accepted instead of failing closed. This contradicts ADR/body language that the compatibility bridge does not authorize conflicting shapes, and it leaves two authenticated-looking head identities in one dispatch receipt.

Required RED→GREEN:

• serialize the legacy head scalars independently (without || shadowing) and reject any payload where both representations are present but not exactly equal;
• retain nested-only and legacy-only acceptance, raw JSON type validation, unknown/missing-schema rejection, and live PR head verification;
• add executable fixtures for equal dual representation and conflicting ref, conflicting SHA, and partial mixed representation;
• keep this PR in review admission only until fresh exact-head Checks and independent review are terminal.

Current Security Scan and Semgrep are GREEN; CodeQL run 34229065428 remains in progress. This COMMENT is not approval or merge authority.

[seonghobae]

Single-writer / complete-successor coordination

This strict-envelope delta is valid, but fresh live state shows #2040@5043c171bc94641b6b60fcfa50e91a6e716a0c5d now stacks on your base #2043@5e65ab56bf57f711503e32987dd84c4c10cbeed7 and modifies the same handler/test/Gap paths with nested/legacy normalization, source binding, and one run-wide settlement owner. Your current branch does not carry that #2040 delta; #2040 does not yet carry your strict raw-JSON type/complete-output delta.

Keep this PR open and preserve its exact commits, but do not treat it as an independently mergeable successor. The canonical integration must non-force carry both valid deltas, then reacquire hosted exact-head Checks and qualifying review. Current production evidence on required run 34229065428 produced repeated dispatches 34229328823 and 34229688649, including HTTP 403 sibling-wake and ambiguous/missing exact job identity failures, confirming the run-wide settlement prerequisite remains live.

No lifecycle/status/base/head mutation was made here.

[seonghobae]

Lifecycle correction at unchanged exact head 057ef77deffcdebea1c5cc55046b3193f4d70abe:

• converted Ready → Draft after the current-head dual-representation P1 was recorded in review 5142093298;
• the predecessor substring-only P2 thread is resolved because the current test parses GITHUB_OUTPUT and asserts exact head_ref/head_sha records;
• current Security Scan 34229065425 and SAST 34229065447 are SUCCESS; CodeQL PR 34229065428 is queued and is not promoted from predecessor GREEN;
• no valid predecessor delta was closed or discarded.

The body’s earlier “Ready only to admit review” sentence is superseded by this unchanged-head Draft receipt. Merge remains blocked on RED→GREEN dual-shape fixtures/repair, fresh exact-head Checks, and qualifying independent review.

[seonghobae]

Ready admission restored on the current exact head after direct fresh verification.

• exact head: 3720dd853fe399fd453e093a90944b2b0e78a8e6
• exact tree: 0a097a047426349c09ba8a763e8f91d15cf39471
• current base: #2043@0fb9151f70784a7f0054d82ee8cdcd7b64912034
• ancestry: ordinary non-force two-parent reconciliation of bfca56f40fa7c8ef03c1ef2cab28007c68a93d8c and the current base
• compare: 10 ahead / 0 behind, five expected paths only, mergeable
• review threads: 0 unresolved
• P1 repair: nested and legacy head identities are independently captured; unequal or partial dual representations fail closed while nested-only/legacy-only remain accepted
• RED→GREEN: 7f0615bc... → 4434a5d1...
• local exact-tree evidence: focused 39 passed; full 3001 passed / 1 skipped / 21 subtests; statement+branch 100%; public-doc 100%; diff check clean; local actionlint unavailable

The pre-Ready CodeQL run 34232234733 failed exactly at the designed pending verdict boundary after a successful dispatch; its logs say that the dispatch workflow will rerun the exact failed job after terminal publication. It is not treated as GREEN or manually rerun.

Ready event: 2026-09-08T13:33:50Z. It generated fresh exact-head runs: CodeQL PR 34232738174, SAST Semgrep 34232738228, Security Scan 34232738247. They are merge gates and are currently queued; current-head independent approval is also still absent. Ready is review admission only, not approval/merge authority. No stale evidence transfers.

[seonghobae]

Lifecycle reconciliation — 2026-09-08

This exact head 3720dd853fe399fd453e093a90944b2b0e78a8e6 contributes valid exact-output and typed-envelope coverage, but remains stacked on #2043's conflicting dual-identity behavior. The full valid delta has been carried into .github#2040@5c309930baba08606df16d037ce38b37896ff12c, where nested/legacy disagreement fails closed and producer provenance is bound to the live synthetic merge commit. Keeping this PR open for evidence, but returning it to Draft until the canonical combined owner reaches protected GREEN.

[seonghobae]

Correction to the lifecycle note: current #2044 head 3720dd853fe399fd453e093a90944b2b0e78a8e6 itself does repair #2043's dual-identity ambiguity. The reason to keep it Draft is not an unfixed source defect in #2044; it is the now-verified complete carryover into the canonical combined settlement owner .github#2040@5c309930baba08606df16d037ce38b37896ff12c. That head preserves #2044's typed/raw envelope, exact output, and nested/legacy equality requirements while adding the live synthetic merge-parent provenance and run-wide settlement contract. The earlier sentence implying #2044 still retained the conflict was inaccurate; this comment supersedes it.

[seonghobae]

P1 exact-base integration finding for 3720dd853fe399fd453e093a90944b2b0e78a8e6.

The dual-representation validator repair remains a valid five-file delta, but the live parent lane moved to #2043 exact 45ef97c71d2684e0c5437fd8e799fd8fcf7e6dc1. A fresh ancestry comparison is now ahead 10 / behind 14 / diverged, with merge base 0fb9151f70784a7f0054d82ee8cdcd7b64912034. This head therefore does not contain #2043's later stacked Python Security / Runtime Quality integration or its current status-first stale-base finding/repair lineage. Its current CodeQL run 34232738174 also still entered with VERDICT_STATE=pending for Actions; Security and Semgrep success do not transfer across a restack.

Keep Draft. Ordinary/non-force adopt the final #2043 tree, preserve the five exact #2044 paths and RED→repair ancestry, resolve the status-first base-binding prerequisite at the canonical owner, then regenerate all exact-head Checks and current review. Do not close or drop the valid dual-identity rejection delta.

[seonghobae]

Verified successor carryover evidence — 2026-09-08

This PR's valid requirement is not lost: #2040 exact head 9054b5e664d1540736c6b83a7c4a2bb9399651a3 independently contains the same fail-closed dual-identity contract.

Current source serializes SUPPLIED_LEGACY_HEAD_REF/SHA independently, rejects partial or unequal nested/legacy tuples with conflicting nested and legacy pr_head identity, and retains nested-only and legacy-only compatibility. #2040's exact tree passed 385 focused contracts and the full 3023-pass suite; its CHANGELOG, ADR-0025, doctoring, and Gap baseline bind the behavior.

#2044 remains open Draft/Proposed until the combined successor is ordinarily integrated; this is evidence-preserved carryover, not a Close or predecessor-check transfer.

[seonghobae]

Current-state handoff for exact head 3720dd853fe399fd453e093a90944b2b0e78a8e6.

• Exact-head CodeQL PR 34232738174, Semgrep 34232738228, and Security Scan 34232738247 are terminal success; unresolved review threads are 0.
• The branch is currently Draft after a concurrent same-head lifecycle transition. I did not toggle it again because no source delta or new review justified repeated lifecycle churn; the separate Ready-materialization defect is tracked by fix(review): materialize exact-head review jobs after Ready transition #2045.
• Every valid delta is now explicitly reachable as the second parent of the canonical combined successor #2040@a22dd5b7108698f5ae0c8dc0541c4dcc7b61abae. fix(codeql): wake required jobs with the exchanged target app token #2040 adds the complete unequal/partial dual-head fixture matrix and restores the inherited 100% coverage invariant.
• This predecessor remains open Proposed evidence until the successor integrates ordinarily. Current-head independent approval is absent, so neither PR has merge authority.

No close, merge, approval, auto-merge authorization, bypass, manual rerun, empty push, force push, or destructive rebase was performed.

[seonghobae]

OpenCode attempt-2 exact-head RCA for 3720dd853fe399fd453e093a90944b2b0e78a8e6:

• Run 34232876208 / job 102094100804 completed sidecar provisioning, free-route admission, gateway preflight, repository-scoped publication setup, and exact-head binding.
• The deployed workflow pins protected contextual-orchestrator 414f22973658c4ddc3d4320fcf7acd9b4e8ba991. It admitted 59 routes but reached the substantive review with one ready candidate; one allowed cycle produced no valid control conclusion and ended exhausted.
• Fail-closed behavior was correct: MODEL_OUTPUT_UNAVAILABLE, no deterministic approval, no exact-head review receipt, and the failure status was published successfully. This is not a fix: validate versioned CodeQL head envelope #2044 source or permission defect.
• The downstream evidence is bound to canonical owner contextual-orchestrator#1094. No further consumer rerun is justified until an owner release/pin change. fix: validate versioned CodeQL head envelope #2044 remains Draft with its valid delta already preserved in the canonical fix(codeql): wake required jobs with the exchanged target app token #2040 successor.

[seonghobae]

Exact-head follow-up for 3720dd853fe399fd453e093a90944b2b0e78a8e6:

• The previously reported dual-representation P1 is repaired. RED 7f0615b is followed by production repair 4434a5d; the handler now parses the original pr_head JSON, requires schema "1" with typed ref/40-hex sha, rejects partial or conflicting legacy scalars, and uses the scalar fallback only when the nested object is absent. The executable contract covers nested-only, legacy-only, equivalent dual, conflicting dual, partial dual, missing schema, and malformed types.
• The current stacked base ref fix/codeql-dispatch-head-envelope has meanwhile advanced to 45ef97c71d2684e0c5437fd8e799fd8fcf7e6dc1. Compare against this PR head is behind_by=14, ahead_by=10, merge base 0fb9151f70784a7f0054d82ee8cdcd7b64912034; therefore the current exact-head GREEN checks predate integration of 14 canonical-owner commits.

Keep this PR Draft. Before review admission, non-force merge/restack the current base ref into this branch, preserve the conflict-rejection delta, and obtain fresh exact-head source/security/CodeQL and independent review. The source finding is resolved; stack integration evidence is the remaining lifecycle blocker.