fix(sbom): preserve publication tree authority by seonghobae · Pull Request #2549 · ContextualWisdomLab/.github

seonghobae · 2026-10-01T09:30:30Z

2026-10-01 CodeQL admission owner-union

Exact head: c8d8e1fc8f3f526ee621ac013cac6a8e816195a2
Exact tree: c12c09a196eb33e437c8689236f7ee353521406d
Ordinary parents: prior fix(sbom): preserve publication tree authority #2549 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a and fix(ci): retire queued runs when PR returns to Draft #2537 repair 9143d6e1430ebb4959a27a00e4288ae967ad308c; the branch ref advanced with force=false.
Remote verification: a fresh pull/2549/head fetch reports the exact same head, tree, and ordered parents.
RCA: repository/PR workflow concurrency was evaluated before central-handler event, actor, and immutable head validation. A stale or forged arrival could therefore cancel a current admissible run. Recovery dispatch also lacked an exact-active central-run de-duplication contract.
Repair: central-handler concurrency remains only after validation; CodeQL recovery now suppresses dispatch solely for an exact, trusted, active central run matching repository, PR, head, base, source run, event, path, actor, and triggering actor. Terminal, inexact, or untrusted runs cannot suppress recovery.
Local exact-tree verification: focused owner-union suite 249 passed; complete Python 3.14 warnings-fatal suite 5,437 passed, 5 skipped, 40 subtests; 18,882/18,882 statements and 7,712/7,712 branches; production docstrings 100.0%; relevant documentation/gap contracts 245 passed, 4 subtests; git diff --check clean.
Independent review: 0 Critical / 0 Important findings. Additional wrong-path, wrong-event, and wrong-triggering-actor edge contracts are included.
Fresh hosted evidence for this head: Metadata Reconcile 36873070493, Trusted uv 36873070605, and Runtime Quality 36873070417 are terminal SUCCESS. Security 36873070494, CodeQL 36873070640, and SAST 36873070363 are Draft-policy SKIPPED and are not acceptance evidence.

This remains Draft / Proposed / merge HOLD. #2530 remains the unmerged prerequisite; there is no qualifying approval or non-skipped exact-head security/CodeQL acceptance. No bypass, auto-merge, Force Push, destructive rebase, Close, or predecessor retirement is authorized.

Historical 2026-10-01 exact-head history-boundary repair

Exact head: 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a
Exact tree: b25d761ec7af723523d692df2f647bc76351f474
Ordinary parent: prior fix(sbom): preserve publication tree authority #2549 0ba66aff4cbc1fcf426b6d489107a3d584f067c7; the ref advanced with force=false.
RCA: final-tree comparison alone could not see an owner-file change followed by its revert. The prior publication head could therefore contribute both unauthorized commits to the next publication ancestry while presenting an inventory-only final delta.
RED at 0ba66aff4cbc1fcf426b6d489107a3d584f067c7: the real-Git reverted-owner-history fixture failed because the reconciler returned 0 and created a merge commit.
GREEN: the reconciler now inspects every commit reachable only from the prior publication head against its first parent before mutation. The focused contract passes; the complete scheduler contract passes 11 tests; scheduler plus gap-baseline contracts pass 18 tests and 4 subtests both normally and with GITHUB_ACTIONS=true. Shell syntax and git diff --check pass.
Fresh exact-head hosted evidence: Security 36865268156, SAST 36865268212, Trusted uv 36865268271, and Runtime Quality 36865268235 are terminal SUCCESS; CodeQL 36865268267 was Draft-policy SKIPPED and is not acceptance. Review threads are 0 and qualifying APPROVED reviews are 0.

This remains Draft / Proposed / merge HOLD. #2530 is still an unmerged prerequisite, #1678's 69-target inventory/error snapshot has not yet been forward-carried, and no bypass, auto-merge, Force Push, destructive rebase, Close, or predecessor retirement is authorized.

Status

Draft / Proposed / merge HOLD

This canonical control-plane repair is stacked on #2530. It must not merge before its base, exact-head hosted Checks, and independent review are terminal and acceptable.

Root cause

Scheduled SBOM publication run 36836856075, job 110286232014, produced #1678 head 7598436eb9126db7bdff00fcf31f6fda15d0f58f with an ancestry-only git merge --strategy=ours. The earlier owner repairs remained ancestors, but 23 non-inventory paths disappeared from the resulting tree. Exact-head OSV 110286490852, dependency-review 110286490849, Trivy 110286490623, and pip-audit 110286478880 then exposed restored vulnerable pins.

Repair contract

remove the ancestry-only ours merge;
reject a prior publication head before mutation when its merge-base-relative delta contains any path outside the two generated inventory files;
permit only a generated-only predecessor to enter an ordinary two-parent merge;
keep the current run's JSON and Markdown inventories authoritative;
fail closed on every other conflict or unresolved index;
retain normal non-force push race protection;
record the incident and next gate in doctoring, CHANGELOG, and docs/product-technical-gap-baseline.md.

Real temporary-repository tests first reproduced repair loss, generated-only reconciliation, and non-inventory conflict refusal. The full-suite run also exposed a Maturin test fixture that replaced HTTPError.close() with a no-op observer; a RED closed-state assertion now keeps the real cleanup path.

Historical pre-union evidence

base: fix(ci): integrate parser, security, response, and coverage gates #2530 dc54310c8c5ee6637274e7e82f5ea53d64ad91e6
head: 59c9bcfe926d1182c12d6f3de428f6df39f9e82c
tree: 30a08dd247473fca3c0fa1fb98653cd6dc9216c0
remote tree equals the locally verified tree
focused scheduler/aggregator/release workflow contracts: 50 passed
HTTPError cleanup RED: 1 failed as intended
cleanup GREEN plus the formerly affected successor test: 2 passed
full Python 3.14 warnings-fatal suite: 5,317 passed, 5 skipped, 40 subtests
workflow YAML, shell syntax, and git diff --check: pass

Follow-up

After ordinary protected integration, forward-repair #1678 and require a fresh scheduled publication whose tree comparison proves that no owner path was discarded. #1678 remains open; this PR does not claim its vulnerable dependency state is fixed yet.

No Force Push, destructive rebase, bypass, auto-merge, synthetic status, or PR closure was used.

Keep Rust coverage timeouts advisory but classify their measurement as NOT MEASURED. Require one unambiguous same-dispatch PASS decision before formal approval publication, with executable fail-closed regression cases wired into CI. Co-Authored-By: Claude Code <noreply@anthropic.com>

Preserve the incomplete-coverage approval guard while ordinary-merging .github#2521's complete PyJWT, PyO3, parser, HTTP lifecycle, and 100% coverage repairs. Hosted failures on #2536 were caused by the stale vulnerable locks/fixture; no gate is suppressed. Verification: 5,234 passed, 5 optional skips, 40 subtests; 18,232 statements and 7,488 branches at 100%.

Preserve concurrent exact-head tests and implementation while requiring one unique coverage PASS decision in existing-approval, status-publication, and merge-scheduler consumers. Record RCA and exact verification evidence.

Execute the real NOT MEASURED CLI rejection path, preserve the concurrent exact-head regression, and record exact hosted RCA plus local 100% statement/branch evidence.

Preserve the queue-retirement delta while adopting the exact owner tree from #2536, including the PyO3, PyJWT, and urllib3 security fixes. This is a non-destructive two-parent integration; exact-head checks must rerun.

Use the existing job-bound OpenCode OIDC exchange when legacy cross-repository secrets are absent, so the scheduled read-only queue report can emit evidence instead of failing before collection.

Integrate #2547 with the current #2530 parser/security/coverage owner without force-pushing or dropping either document delta. Repair the warnings-fatal HTTPError fixture lifecycle exposed by the combined full suite. Exact-tree verification: - focused live-base/owner contracts: 89 passed - HTTPError lifecycle file: 17 passed with warnings fatal - full warnings-as-errors suite: 5,316 passed, 5 skipped, 40 subtests - git diff --check: passed

Remove only the pull-request base restriction so the owner quality workflow emits exact-head evidence for canonical stacked PRs. Preserve paths, read-only permissions, exact-head checkout, and PR-stable concurrency. RED: stacked-base admission contract failed on branches: [main]. GREEN: 63 focused contracts; full warnings-fatal suite 5,317 passed, 5 skipped, 40 subtests; YAML parse, compileall, and diff check passed.

Preserve #2537 queue-retirement and #2548 consumer-materialization deltas in one canonical owner contract. Consumer Draft heads scan, native-owner Draft heads remain runner-free, and converted_to_draft/closed only retire stale same-PR work.

Fail closed before an SBOM publication update can discard non-inventory owner repairs. Preserve the current generated inventory only for generated-only predecessors, prove the behavior with real Git fixtures, and keep the Maturin HTTPError fixture's real close path intact.

coderabbitai · 2026-10-01T09:30:38Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-10-01T09:33:02Z

Exact-head review for 59c9bcfe926d1182c12d6f3de428f6df39f9e82c

The seven-path delta repairs the causal tree-loss mechanism rather than preserving ancestry with --strategy=ours. The new reconciler checks the prior publication branch's merge-base-relative ownership before mutation, admits only generated inventory paths, restores the current run's JSON/Markdown as authoritative after an ordinary two-parent merge, aborts every non-inventory conflict, and retains the existing non-force race boundary. Real temporary-repository fixtures cover owner-repair refusal, generated-only reconciliation, and clean abort state.

No actionable source finding remains in the inspected delta. This is COMMENT only, not approval: Trusted uv Materializer Quality CI 36843193986 is still non-terminal, CodeQL PR 36843193997 is Draft-skipped, qualifying approvals are 0, and base #2530 remains mutable. Keep Draft / Proposed / merge HOLD. After protected integration, #1678 still requires a forward repair plus fresh scheduled tree comparison; predecessor ancestry alone is not completion.

seonghobae · 2026-10-01T10:29:10Z

Exact-head hosted evidence refresh — 59c9bcfe926d1182c12d6f3de428f6df39f9e82c

Security 36843194057, SAST 36843194019, and Trusted uv Materializer Quality CI 36843193986 completed successfully. CodeQL PR 36843193997 was skipped, so it is not acceptance. The prerequisite stack and independent review remain outstanding; Draft / Proposed / merge HOLD remains correct.

Bound Draft/close cleanup to exact protected run identities, revalidate live run and PR authority across all active states, and fail closed without explicit central Actions authority.

seonghobae · 2026-10-01T12:34:04Z

Exact-head owner-union repair published without history rewrite.

head: 0ba66aff4cbc1fcf426b6d489107a3d584f067c7
tree: 71b29cf9bc1c55459b54ea432d6dd509f73a6ecd
parents: prior fix(sbom): preserve publication tree authority #2549 59c9bcfe926d1182c12d6f3de428f6df39f9e82c and fix(ci): diff agent quality against live base #2547 a8bc5887d0ac013457627b9a944e9e3558d689cd (carrying fix(opencode): preserve exact-head dispatch queue position #2546)
ref update: force=false
new RED→GREEN: generated non-inventory commit paths and tracked/untracked worktree side effects now fail before lineage mutation; only the JSON/Markdown inventories are authoritative
exact-tree local verification: 5,382 passed, 7 skipped, 40 subtests; 18,780/18,780 statements and 7,656/7,656 branches; Docstrings 100%; YAML/compile/shell/diff checks GREEN
independent re-review: 0 Critical / 0 Important / 0 Minor
hosted exact-head SUCCESS: Runtime Quality 36862488853, Trusted uv 36862489100, Security 36862488991, SAST 36862488979, Strix 36862483650, Noema 36862483810, OpenCode 36862483909
Draft-policy SKIPPED, not acceptance evidence: CodeQL 36862488884 and merge scheduler 36862483951
qualifying approvals: 0; unresolved review threads: 0

This is source repair, not merge authorization. The PR remains Draft / Proposed / HOLD while #2530 is unmerged, applicable non-skipped CodeQL and independent approval are absent, and #1678's historical inventory/error snapshot still requires forward carryover. No bypass, auto-merge, Force Push, destructive rebase, Close, or predecessor retirement.

seonghobae

Exact-head review found and repaired one authority-boundary defect: the final-tree allowlist admitted a prior publication lineage that changed an owner file and reverted it before the head, so both unauthorized commits could become ancestors of the next publication. A real-Git RED at predecessor 0ba66aff4cbc1fcf426b6d489107a3d584f067c7 reproduced the merge. Head 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a now checks every prior-only commit against its first parent before mutation; the focused test, complete 11-test scheduler contract, and normal/GITHUB_ACTIONS=true 18-test + 4-subtest focused sets pass. This COMMENT is not self-approval. Draft/base prerequisite, fresh hosted Checks, independent approval, and #1678 forward publication proof remain required.

Preserve PR #2549's SBOM and docstring authority while integrating the complete valid #2537 control-plane ancestry. Resolve overlapping Maturin and queue contracts in favor of the newer hardened owner implementations; retain exact-active CodeQL deduplication, pre-validation cancellation removal, and runner-pool separation. Keep the result Draft/Proposed pending hosted exact-head Checks and independent approval.

seonghobae · 2026-10-01T14:03:41Z

Owner-union repair published and independently revalidated.

PR fix(sbom): preserve publication tree authority #2549 exact head: c8d8e1fc8f3f526ee621ac013cac6a8e816195a2
exact tree: c12c09a196eb33e437c8689236f7ee353521406d
ordered parents: prior fix(sbom): preserve publication tree authority #2549 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a; fix(ci): retire queued runs when PR returns to Draft #2537 repair 9143d6e1430ebb4959a27a00e4288ae967ad308c
publication: ordinary two-parent commit; branch ref update used force=false
remote proof: fresh pull/2549/head fetch reports the same head/tree/parents
local exact-tree evidence: focused union 249 passed; complete warnings-fatal suite 5,437 passed, 5 skipped, 40 subtests; statement/branch coverage 100%; production docstrings 100%; docs/gap contracts 245 passed + 4 subtests; diff check clean
independent review: 0 Critical / 0 Important
hosted runs: Metadata 36873070493, Runtime Quality 36873070417, Trusted uv 36873070605 in progress; Security 36873070494, CodeQL 36873070640, SAST 36873070363 skipped by Draft policy and therefore are not acceptance evidence

State remains Draft / Proposed / merge HOLD. #2530 is still an unmerged prerequisite; there is no qualifying approval or non-skipped exact-head security/CodeQL acceptance. No bypass, auto-merge, Force Push, destructive rebase, Close, or predecessor retirement was used.

seonghobae · 2026-10-01T14:59:53Z

Exact-head hosted completion refresh for c8d8e1fc8f3f526ee621ac013cac6a8e816195a2:

Repository Metadata Reconcile 36873070493: SUCCESS
Trusted uv Materializer Quality CI 36873070605: SUCCESS
Agent Review Runtime Quality CI 36873070417: SUCCESS
Security 36873070494, CodeQL 36873070640, and SAST 36873070363: Draft-policy SKIPPED, therefore not acceptance evidence
review threads: 0; qualifying current-head approvals: 0

Head/base remain unchanged and GitHub reports the PR open, Draft, and mechanically mergeable. #2530 remains the unmerged prerequisite. State stays Draft / Proposed / merge HOLD; no bypass, auto-merge, Force Push, destructive rebase, rerun, or closure is authorized.

seonghobae and others added 30 commits September 30, 2026 12:04

test(ci): expose draft queue retirement gap

8cd0e18

fix(ci): retire queued codeql-pr draft runs

fa7acfb

fix(ci): retire queued sast-semgrep draft runs

a7dff5c

fix(ci): retire queued security-scan draft runs

2ab271f

fix(ci): retire queued python-security draft runs

c091ee4

fix(ci): skip gitleaks entry on draft retirement

c10f1c0

test(ci): require live draft skip without event exemption

3dbb0bc

docs(ci): record draft queue retirement

415c2e7

docs(ci): explain draft queue retirement

f182312

ci: refresh checks on security prerequisite

bf8acdc

fix(ci): fetch metadata evidence ancestry

3bc859c

docs(ci): record metadata ancestry RCA

88143f9

fix(security): refresh shared urllib3 locks

d76ab42

fix(security): pin patched PyJWT recursion release

be64c84

test(opencode): reject incomplete reused coverage evidence

87ffafa

fix(opencode): bind reused approval to coverage decision

0bcded6

test(opencode): refresh reviewed dispatch blob pin

43c78cc

fix(opencode): fail closed on unmeasured approval reuse

7771a2b

Preserve concurrent exact-head tests and implementation while requiring one unique coverage PASS decision in existing-approval, status-publication, and merge-scheduler consumers. Record RCA and exact verification evidence.

test(opencode): cover unmeasured approval CLI rejection

feb88e3

test(opencode): restore full coverage of approval rejection

18c886c

Execute the real NOT MEASURED CLI rejection path, preserve the concurrent exact-head regression, and record exact hosted RCA plus local 100% statement/branch evidence.

chore(stack): integrate security owner into draft queue retirement

cf8fa36

Preserve the queue-retirement delta while adopting the exact owner tree from #2536, including the PyO3, PyJWT, and urllib3 security fixes. This is a non-destructive two-parent integration; exact-head checks must rerun.

test(ci): align SAST draft admission contract

76aa575

fix(opencode): honor latest exact-head review decision

ba55414

fix(ci): restore queue-health credential fallback

37ce2e4

Use the existing job-bound OpenCode OIDC exchange when legacy cross-repository secrets are absent, so the scheduled read-only queue report can emit evidence instead of failing before collection.

fix(security): refresh review runtime locks

6a37e4c

merge: restack draft queue retirement on latest review authority

0dacd79

fix(ci): skip merge scheduler runner on Draft conversion

8ea4750

fix(opencode): serialize exact-head dispatch admission

67c6892

seonghobae added 11 commits October 1, 2026 14:43

docs(evidence): bind final exact-suite count

8951c2c

fix(codeql): materialize draft consumer heads

ad79e58

fix(docs): restore complete product gap baseline

1fa31f5

merge: integrate shared security baseline prerequisite

8f6a870

fix(ci): stack live-base quality on queue owner

5deb2d7

test(strix): align queue gate with lease admission

db81de7

merge: integrate #2546 Strix lease-contract gate repair

5206633

seonghobae mentioned this pull request Oct 1, 2026

chore: refresh org SBOM inventory #1678

Draft

fix: admit exact-head Draft semantic reviews

bd1a3d3

seonghobae added 6 commits October 1, 2026 19:40

fix(ci): retire stale central dispatch runs

f79c8f2

Bound Draft/close cleanup to exact protected run identities, revalidate live run and PR authority across all active states, and fail closed without explicit central Actions authority.

fix: preserve Draft-to-Ready review admission

6eb1174

fix: restore scheduler coverage guard

8b81426

merge: integrate current OpenCode admission owner

a8bc588

docs(ci): correct stacked required-workflow scope

3d2656b

merge: preserve runtime and SBOM publication owners

0ba66af

fix(sbom): reject reverted owner history

1e2d753

seonghobae commented Oct 1, 2026

View reviewed changes

seonghobae added 2 commits October 1, 2026 22:59

fix(codeql): preserve exact active dispatch

9143d6e

seonghobae mentioned this pull request Oct 1, 2026

fix(ci): retire queued runs when PR returns to Draft #2537

Draft

Navigation Menu

fix(sbom): preserve publication tree authority - #2549

fix(sbom): preserve publication tree authority#2549
seonghobae wants to merge 61 commits into
fix/full-suite-parser-locks-20260930from
fix/sbom-publication-tree-preservation-20261001

seonghobae commented Oct 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 1, 2026

Draft PR not reviewed

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026 •

edited

Loading

Uh oh!

seonghobae left a comment

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seonghobae commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2026-10-01 CodeQL admission owner-union

Historical 2026-10-01 exact-head history-boundary repair

Status

Root cause

Repair contract

Historical pre-union evidence

Follow-up

Uh oh!

coderabbitai Bot commented Oct 1, 2026

Draft PR not reviewed

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae left a comment

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

seonghobae commented Oct 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Oct 1, 2026 •

edited

Loading

seonghobae commented Oct 1, 2026 •

edited

Loading