Repository navigation

fix(codeql): wake required jobs with the exchanged target app token - #2040

Draft

seonghobae wants to merge 259 commits into

mainfrom

fix/codeql-wake-target-app-token

Draft

fix(codeql): wake required jobs with the exchanged target app token#2040
seonghobae wants to merge 259 commits into
mainfrom
fix/codeql-wake-target-app-token

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 5, 2026
Commits on Sep 6, 2026
- chore(codeql): adopt current protected main
  seonghobae
  committed
  e72ae30
- test(codeql): require complete status pagination before redispatch
  seonghobae
  committed
  acfa17e
- fix(codeql): inspect complete status history before redispatch
  seonghobae
  committed
  7628274
- docs(codeql): record complete status-history recovery guard
  seonghobae
  committed
  622ea74
- test(codeql): exercise paginated empty-verdict recovery
  seonghobae
  committed
  bf732f9
- Merge branch 'main' into ci/main-full-suite-gate
  seonghobae
  committed
  c36533b
- Merge protected main into full-suite gate candidate
  seonghobae
  committed
  87f0262
- test(ci): cover single-runner main quality and warning rejection
  seonghobae
  committed
  b545265
- fix(ci): consolidate main quality checks in one runner
  seonghobae
  committed
  d9b52ca
- test(ci): preserve independent quality failures and docstring floor
  seonghobae
  committed
  30a6541
- fix(ci): retain full quality execution after minimum-version failure
  seonghobae
  committed
  167b1a2
- docs(ci): record main quality consolidation and evidence boundaries
  seonghobae
  committed
  ad24596
- ci(tests): exempt the dependency finalizer warning from the full-suite gate
  
  Seongho Bae
  and
  claude
  committed
  9e84613
- Merge branch 'main' into ci/main-full-suite-gate
  
  Seongho Bae
  and
  claude
  committed
  21e128b
- Merge branch 'main' into ci/main-full-suite-gate
  
  Seongho Bae
  and
  claude
  committed
  8761c00
- Merge branch 'main' into ci/main-full-suite-gate
  
  Seongho Bae
  and
  claude
  committed
  664a5dd
- Merge branch 'main' into ci/main-full-suite-gate
  
  Seongho Bae
  and
  claude
  committed
  2f0729d
- chore(codeql): merge current main into PR 1902
  seonghobae
  committed
  eb9d4d2
- test(codeql): align verdict fixtures with paginated status reads
  seonghobae
  committed
  4bf80b9
- fix(scheduler): require explicit open live PR identity
  seonghobae
  committed
  951d0ec
- fix(scheduler): bind Strix reruns to verified job identity
  seonghobae
  committed
  9bfe575
- test(ci): cover remaining Strix rerun identity rejections
  seonghobae
  committed
  fe64f24
- chore(codeql): isolate rerun recovery on current protected main
  seonghobae
  committed
  3549de5
Commits on Sep 7, 2026
- fix(codeql): require preserved SARIF before terminal publication
  
  seonghobae
  and
  codex
  committed
  b966f82
- fix(codeql): verify live base before consuming terminal verdicts
  
  seonghobae
  and
  codex
  committed
  8c11d86
- test(codeql): bind rerun recovery fixture to live base
  
  seonghobae
  and
  codex
  committed
  3d8a8b6
- fix(codeql): require preserved SARIF before status
  seonghobae
  committed
  82ca0b8
- merge(codeql): integrate canonical SARIF publication guard
  
  seonghobae
  and
  codex
  committed
  8c4fd55
- fix(codeql): bind terminal verdict receipt to base
  seonghobae
  committed
  1a5957b
- test(codeql): prove old-base receipt redispatch
  seonghobae
  committed
  4b025af
- test(scheduler): reproduce central Actions credential leakage
  seonghobae
  committed
  8cc62ce
- fix(scheduler): scope Actions credentials by run host
  seonghobae
  committed
  7bf3451
- test(scheduler): reproduce workflow-token mutation fallback
  seonghobae
  committed
  ebcc671
- fix(scheduler): prove workflow-starting mutation token
  seonghobae
  committed
  e2204ee
- test(ci): reproduce missing stacked Python and runtime checks
  seonghobae
  committed
  890bac2
- fix(ci): cover stacked Python and runtime reviews
  seonghobae
  committed
  14f7c85
- Merge remote-tracking branch 'origin/main' into HEAD
  seonghobae
  committed
  73c4c22
Commits on Sep 8, 2026
- fix(codeql): settle exact multi-language reruns
  seonghobae
  committed
  51c9df5
- Merge protected main into scheduler repair stack
  seonghobae
  committed
  a7ff488
- Merge updated scheduler stack parent into #2003
  seonghobae
  committed
  8842c44
- Merge updated scheduler stack parent into #2004
  seonghobae
  committed
  f6b6a4a
- test(scheduler): align cancellation doubles with host-scoped runner
  seonghobae
  committed
  b18b7ca
- test(scheduler): prove workflow-starting credentials in fixtures
  seonghobae
  committed
  7f32c68
- Merge updated #2002 test contract into #2003
  seonghobae
  committed
  71e7678
- Merge updated #2003 scheduler fixture contract into #2004
  seonghobae
  committed
  9fb02c9
- fix(codeql): bind self-status to exact handler evidence
  seonghobae
  committed
  b9b98cf
- fix(codeql): harden self-repository fallback provenance
  seonghobae
  committed
  3349848
- test(codeql): reject HTTP-successful untrusted status creator
  seonghobae
  committed
  23cc2df
- fix(codeql): authenticate published status creator
  seonghobae
  committed
  af8334e
- test(codeql): return authenticated status creators in fixtures
  seonghobae
  committed
  c1351dc
- merge(main): replace unauthenticated CodeQL fallback with provenance contract
  seonghobae
  committed
  61b88b8
- fix(codeql): bind exact dispatch settlement evidence
  seonghobae
  committed
  1a3133f
- test(codeql): reproduce mixed-verdict settlement gap
  seonghobae
  committed
  e25800f
- fix(codeql): retain complete mixed-verdict settlement identity
  seonghobae
  committed
  ef5ef47
- test(codeql): require complete direct-evidence pagination
  seonghobae
  committed
  86898d3
- fix(codeql): paginate direct settlement evidence
  seonghobae
  committed
  df35cfe
- fix(test): repair CodeQL pagination shim syntax
  seonghobae
  committed
  211b763
- fix(test): repair CodeQL settlement shim syntax
  seonghobae
  committed
  0764ac2
- fix(codeql): integrate complete producer evidence
  seonghobae
  committed
  4da013b
- fix(codeql): preserve producer source across handler advances
  seonghobae
  committed
  49fd5fe
- fix(codeql): select the unique evidence-complete handler
  seonghobae
  committed
  ccd4dd3
- test(codeql): prove App receipts require producer evidence
  seonghobae
  committed
  e9589ed
- fix(codeql): authenticate App receipts with dispatch evidence
  seonghobae
  committed
  e9c69e1
- test(codeql): bind App receipts to exact evidence
  seonghobae
  committed
  3ca05c3
- fix(codeql): recover live base and reject receipt ambiguity
  seonghobae
  committed
  e07e8fd
- test(codeql): complete successor evidence fixtures
  seonghobae
  committed
  723d1c3
- test(codeql): reproduce stale-base and receipt ambiguity cycles
  seonghobae
  committed
  48baf18
- fix(codeql): converge mixed handler settlement
  seonghobae
  committed
  2b60f0e
- fix(codeql): integrate live-base and receipt ambiguity repair
  seonghobae
  committed
  855f017
- fix(codeql): wake required jobs with the exchanged target app token
  seonghobae
  committed
  0a1ebb1
- fix(codeql): reconcile attempt-wide base settlement
  seonghobae
  committed
  87228f9
- test(codeql): cover denied wake credential fallback
  seonghobae
  committed
  afc477c
- fix(codeql): retry wake with configured credentials
  seonghobae
  committed
  b75ab70
- fix(codeql): try every wake credential before succeeding a clean scan
  seonghobae
  committed
  459af0c
- fix(codeql): require predecessor language-gate evidence
  seonghobae
  committed
  7ca416e
- test(codeql): cover wake read credential fallback
  seonghobae
  committed
  eacf5e1
- fix(codeql): retry wake identity reads
  seonghobae
  committed
  ba1781a
- merge: integrate remote wake credential retry
  seonghobae
  committed
  1a863ac
- merge: integrate remote wake identity-read retry history
  seonghobae
  committed
  c035e48
- fix(codeql): keep post_wake for rerun and retry identity reads
  seonghobae
  committed
  11f4bd9
- fix(codeql): recover attempt after base advance
  seonghobae
  committed
  ebf054e
- test(codeql): require dispatch validation for App receipts
  seonghobae
  committed
  acea6d9
- fix(codeql): authenticate App dispatch validation
  seonghobae
  committed
  27fdc97
- docs(codeql): bind validation RED to published commit
  seonghobae
  committed
  fe8b73e
- test(codeql): reproduce late base-advance deadlock
  seonghobae
  committed
  b924580
- fix(codeql): recover forward base advance during handler scan
  seonghobae
  committed
  3c8da48
- fix(codeql): bound terminal recovery
  seonghobae
  committed
  4566b15
- fix(codeql): report ambiguous evidence
  seonghobae
  committed
  e092426
- test(codeql): expose dispatch payload limit
  seonghobae
  committed
  310e9e6
- fix(codeql): accept bounded rerun request payload
  seonghobae
  committed
  e28d7c6
- fix(codeql): bound repository dispatch payload
  seonghobae
  committed
  80c139c
- test(codeql): bind nested rerun request
  seonghobae
  committed
  2117695
- test(codeql): require nested rerun payload parsing
  seonghobae
  committed
  da98bdc
- docs(codeql): record dispatch payload RCA
  seonghobae
  committed
  f0562e8
- docs(codeql): bind payload limit evidence
  seonghobae
  committed
  9307973
- test(codeql): fail when clean scan cannot wake exact shard
  seonghobae
  committed
  ff2f7ab
- test(codeql): close receipt review gaps
  seonghobae
  committed
  aed803d
- fix(codeql): fail closed when exact shard wake is not accepted
  seonghobae
  committed
  e17d1e7
- test(codeql): require versioned dispatch head envelope
  seonghobae
  committed
  e7f893a
- fix(codeql): accept versioned dispatch head envelope
  seonghobae
  committed
  e99cce8
- test(codeql): reject unversioned head envelope
  seonghobae
  committed
  57b944e
- fix(codeql): require head envelope schema
  seonghobae
  committed
  4955a8b
- test: execute versioned codeql head envelope
  seonghobae
  committed
  0caa75a
- test(codeql): execute versioned head envelope path
  seonghobae
  committed
  5e65ab5
- test: reject non-string CodeQL head schema
  seonghobae
  committed
  77c3dcb
- fix: validate CodeQL head envelope types
  seonghobae
  committed
  7cab524
- test(codeql): expose cross-channel producer ambiguity
  seonghobae
  committed
  1ed0ca8
- fix(codeql): unify authenticated verdict evidence
  seonghobae
  committed
  9b84832
- test(codeql): expose wake credential shadowing
  seonghobae
  committed
  da1cbe5
- fix(codeql): preserve wake credential fallback
  seonghobae
  committed
  8cb0a28
- docs(codeql): bind verdict and wake evidence
  seonghobae
  committed
  2f3ff51
- test(codeql): require nested rerun envelope compatibility
  seonghobae
  committed
  5761a2b
- merge: preserve CodeQL envelope base repair
  seonghobae
  committed
  7fe4300
- test(codeql): restore exact tree and expose cross-channel ambiguity
  seonghobae
  committed
  060597a
- fix(codeql): unify authenticated verdict evidence
  seonghobae
  committed
  631ccfc
- test(codeql): expose wake credential shadowing
  seonghobae
  committed
  be87023
- fix(codeql): accept nested rerun request envelope
  seonghobae
  committed
  5e95eb0
- fix(codeql): preserve wake credential fallback
  seonghobae
  committed
  3762301
- fix: preserve missing-schema rejection contract
  seonghobae
  committed
  d116229
- docs(codeql): bind verdict and wake evidence
  seonghobae
  committed
  9f06558
- test(codeql): require one attempt settlement owner
  seonghobae
  committed
  1eaf07d
- docs(gap): bind strict CodeQL envelope evidence
  seonghobae
  committed
  057ef77
- fix(codeql): settle dispatch wake once per attempt
  seonghobae
  committed
  4876772
- test(codeql): reject conflicting rerun representations
  seonghobae
  committed
  dd2796d
- fix(codeql): reject conflicting rerun identities
  seonghobae
  committed
  57c8143
- test(codeql): require source-bound settlement evidence
  seonghobae
  committed
  e0800ad
- fix(codeql): bind run-wide settlement evidence
  seonghobae
  committed
  d93a78a
- merge: stack CodeQL wake repair on head envelope
  seonghobae
  committed
  5043c17
- test(codeql): reject malformed head envelopes
  seonghobae
  committed
  79a7b35
- fix(codeql): validate original head envelope
  seonghobae
  committed
  0fb9151
- test(codeql): reject conflicting head identities
  seonghobae
  committed
  7f0615b
- fix(codeql): reject conflicting head identities
  seonghobae
  committed
  4434a5d
- docs(gap): bind dual head identity evidence
  seonghobae
  committed
  bfca56f
- merge: reconcile strict CodeQL head identity
  seonghobae
  committed
  3720dd8
- merge: carry strict head envelope into wake repair
  seonghobae
  committed
  2b5b9a9
- test(codeql): bind producer merge provenance and dual head identity
  seonghobae
  committed
  e930551
- fix(codeql): verify live producer merge provenance
  seonghobae
  committed
  5c30993
- merge: stack head envelope on review trigger repair
  seonghobae
  committed
  45ef97c
- merge: preserve stacked check admission after provenance repair
  seonghobae
  committed
  9054b5e
- test(codeql): require full failed-job rerun matrix
  seonghobae
  committed
  940242d
- fix(codeql): bind rerun matrix to failed job set
  seonghobae
  committed
  c8d7caa
- test(codeql): pin every identity and credential invariant
  seonghobae
  committed
  a22dd5b
- test(codeql): reproduce stale status publication cycle
  seonghobae
  committed
  72d71b0
- fix(codeql): retire superseded status publication
  seonghobae
  committed
  d4a9563
- test(codeql): reject head-only status migration bridge
  seonghobae
  committed
  6901dd6
- fix(codeql): require base-bound authenticated receipts
  seonghobae
  committed
  d7bb95f
- fix(codeql): authenticate protected handler evidence
  seonghobae
  committed
  91a94a2
- fix(codeql): bridge protected handler rollout
  seonghobae
  committed
  6706c23
Commits on Sep 11, 2026
- Merge branch 'main' into fix/codeql-wake-target-app-token
  opencode-agent[bot]
  authored
  3b2de64
Commits on Sep 12, 2026
Commits on Sep 17, 2026
- test(codeql): require versioned producer envelope
  seonghobae
  committed
  cab6cda
- fix(codeql): emit versioned dispatch envelope
  seonghobae
  committed
  488e25a
- fix(codeql): restore exact producer before focused cutover
  seonghobae
  committed
  1a563bb
- fix(codeql): cut producer over to v2 dispatch envelope
  seonghobae
  committed
  5edd9cc
- fix(security): retain protected pip-audit gate on stacked PRs
  seonghobae
  committed
  80bc78f
- test(security): retain protected pip-audit failure classification
  seonghobae
  committed
  b1542f0
- test(codeql): pin private-consumer read grants
  seonghobae
  committed
  2a7e125
- fix(codeql): preserve private-consumer read grants
  seonghobae
  committed
  9f435af
- test(security): pin scheduler repository identity traversal rejection
  seonghobae
  committed
  d4cfbcc
- fix: reject traversal-like repository identities
  seonghobae
  committed
  4c6a0e2
- repair: restore scheduler core after truncated rewrite
  seonghobae
  committed
  91e9515
- fix(security): harden scheduler repository identity
  seonghobae
  committed
  d278f97
- repair: restore scheduler rationale after full-file edit
  seonghobae
  committed
  609be40
Commits on Sep 18, 2026
Commits on Sep 19, 2026
- Merge protected main into full-suite owner lane
  seonghobae
  committed
  859b180
- test(ci): require full-suite dependency closure
  seonghobae
  committed
  041ab07
- fix(ci): install full-suite dependency closure
  seonghobae
  committed
  f2822cb
- fix(ci): restore current-main tree after owner reconciliation
  seonghobae
  committed
  66dc660
- fix(ci): drop stale changelog collateral after reconciliation
  seonghobae
  committed
  dfeadc7
- Merge protected main into CodeQL wake repair
  seonghobae
  committed
  f328e1b
- docs(gap): record CodeQL owner reconciliation evidence
  seonghobae
  committed
  ecc9e1d
- merge: reconcile CodeQL owner with protected main
  seonghobae
  committed
  10c4d38
- docs(gap): record current CodeQL owner reconciliation
  seonghobae
  committed
  6d3279d
- docs(gap): bind published reconciliation merge
  seonghobae
  committed
  5bfdbb4
- test(codeql): reject noncanonical repository slugs
  seonghobae
  committed
  e70094b
- fix(codeql): reject noncanonical repository slugs
  seonghobae
  committed
  90445aa
- test(codeql): preserve canonical dotted repository slugs
  seonghobae
  committed
  652764a
- test(ci): bind repository-wide quality dependency closure
  seonghobae
  committed
  82a4e2a
- fix(ci): close repository-wide quality dependency set
  seonghobae
  committed
  7901ca5
Commits on Sep 20, 2026
- chore(ci): reconcile trusted-uv owner with protected main
  seonghobae
  committed
  169852c
- test(ci): realign trusted-uv contract with canonical owner
  seonghobae
  committed
  c965664
- chore(ci): converge trusted-uv canonical owner
  seonghobae
  committed
  bd03918
Commits on Sep 28, 2026
- merge(main): reconcile #2040 onto protected main
  seonghobae
  committed
  270292c
Commits on Sep 29, 2026
- chore(ux): document ui absence and adjust test coverage
  seonghobae
  committed
  6d5caed
- chore(ux): document ui absence and trigger ci retry
  seonghobae
  committed
  416234f
- chore(ux): document ui absence and trigger ci retry again
  seonghobae
  committed
  14eb9af
Commits on Sep 30, 2026
- chore(ux): document ui absence and trigger ci retry again
  seonghobae
  committed
  25c576c
- fix(opencode): withhold approval on incomplete coverage evidence
  
  seonghobae
  and
  claude
  committed
  5e0b6b1
- fix(ci): include suite parser dependencies in the quality lock
  
  seonghobae
  and
  claude
  committed
  41e95af
- chore(ux): trigger ci retry after returning from draft state
  seonghobae
  committed
  cb4766f
- docs(ci): record complete parser-lock suite and macOS environment RCA
  
  seonghobae
  and
  claude
  committed
  019cf4c
- test(security): require patched Strix and Rust fixture locks
  seonghobae
  committed
  cd84d88
- fix(security): refresh shared PyJWT and PyO3 locks
  seonghobae
  committed
  1ca4b94
- test(security): reject duplicate vulnerable dependency locks
  seonghobae
  committed
  02c70d5
- docs(ci): track full-suite parser-lock gap evidence
  seonghobae
  committed
  f93f9f7
- docs(ci): distinguish source and live parser-lock heads
  seonghobae
  committed
  189e6e3
- test(coverage): reject unapproved production omissions
  seonghobae
  committed
  19e3df3
- fix(coverage): restore production modules to the gate
  seonghobae
  committed
  706f352
- fix(ci): close GitHub API HTTP error responses
  seonghobae
  committed
  25af103
- test(security): normalize requirement extras
  seonghobae
  committed
  d1aa365
- test(coverage): exercise fail-closed edge paths
  seonghobae
  committed
  d3dadff
- fix(ci): bound CodeQL HTTP error diagnostics
  seonghobae
  committed
  ae3ca14
- test(coverage): exercise Strix report scope
  seonghobae
  committed
  cf7326b
- merge(main): refresh coverage repair base
  seonghobae
  committed
  6d3a989
- test(coverage): close runtime helper edge gaps
  seonghobae
  committed
  a435def
- fix(ci): close remaining HTTP error responses
  seonghobae
  committed
  3dc4767
- fix(ci): close responses after telemetry failures
  seonghobae
  committed
  9d3ec75
- fix(ci): fetch lineage required by full quality gate
  seonghobae
  committed
  bc40de5
- chore(deps): add pyyaml and defusedxml to dev dependencies
  seonghobae
  committed
  3ef3ffa
- chore(deps): consume canonical lock delta for ci dependencies
  seonghobae
  committed
  f62bb7e
- merge: integrate shared security baseline prerequisite
  seonghobae
  committed
  ccb7bb7
- merge: integrate GitHub API response lifecycle prerequisite
  seonghobae
  committed
  ef28f6b
- docs: bind parser integration gap to exact head
  seonghobae
  committed
  2510618
- test(coverage): integrate prerequisites and restore 100% gate
  seonghobae
  committed
  61fb469
- merge: carry central security and coverage owner into #2536
  seonghobae
  committed
  737fc6f
- fix(ci): fetch metadata evidence ancestry
  seonghobae
  committed
  3bc859c
- docs(ci): record metadata ancestry RCA
  seonghobae
  committed
  88143f9
- fix(security): refresh shared urllib3 locks
  seonghobae
  committed
  d76ab42
- fix(security): pin patched PyJWT recursion release
  seonghobae
  committed
  be64c84
- test(opencode): reject incomplete reused coverage evidence
  seonghobae
  committed
  87ffafa
- fix(opencode): bind reused approval to coverage decision
  seonghobae
  committed
  0bcded6
- test(opencode): refresh reviewed dispatch blob pin
  seonghobae
  committed
  43c78cc
- fix(opencode): fail closed on unmeasured approval reuse
  seonghobae
  committed
  7771a2b
- test(opencode): cover unmeasured approval CLI rejection
  seonghobae
  committed
  feb88e3
- test(opencode): restore full coverage of approval rejection
  seonghobae
  committed
  18c886c
- merge(main): reconcile CodeQL wake owner with protected truth
  seonghobae
  committed
  dc97393
- fix(ci): install PyYAML for complete quality collection
  seonghobae
  committed
  4fc3cbe
- fix(ci): install full quality locks and refresh vulnerable fixtures
  seonghobae
  committed
  74a7654
- fix(security): refresh audited Python runtime locks
  seonghobae
  committed
  ca892db
- fix(ci): restore full quality evidence
  seonghobae
  committed
  bc428a8
- fix(ci): restore exact published source bytes
  seonghobae
  committed
  60dd89e
- fix(ci): integrate coverage prerequisite with wake repair
  seonghobae
  committed
  720b629
- fix(ci): install Noema lock in metadata quality gate
  seonghobae
  committed
  bebf8bf
- fix(opencode): honor latest exact-head review decision
  seonghobae
  committed
  ba55414
- fix(security): pin patched LiteLLM in Strix lock
  seonghobae
  committed
  4f49718
- test(ci): reconcile integrated dependency contracts
  seonghobae
  committed
  19b338a
- fix(security): refresh review runtime locks
  seonghobae
  committed
  6a37e4c
- merge: integrate latest review authority into CodeQL owner
  seonghobae
  committed
  38a1692
Commits on Oct 7, 2026
- merge: reconcile current runner contracts into CodeQL owner
  seonghobae
  committed
  e28a795

Commits

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Commits on Sep 7, 2026

Commits on Sep 8, 2026