fix(sbom): preserve publication tree authority

.github/workflows/actions-queue-health.yml

@@ -20,6 +20,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      id-token: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
@@ -31,12 +32,78 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Exchange OpenCode app token for cross-repo reads
+        id: queue_read_app_token
+        env:
+          OIDC_AUDIENCE: opencode-github-action
+          OPENCODE_API_BASE_URL: https://api.opencode.ai
+        run: |
+          set -euo pipefail
+
+          mark_unavailable() {
+            echo "available=false" >>"$GITHUB_OUTPUT"
+          }
+
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "OpenCode app token exchange unavailable: OIDC request environment is missing."
+            mark_unavailable
+            exit 0
+          fi
+
+          request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}"
+          separator="&"
+          case "$request_url" in
+            *\?*) ;;
+            *) separator="?" ;;
+          esac
+
+          if ! oidc_response="$(
+            curl -fsS \
+              -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+              "${request_url}${separator}audience=${OIDC_AUDIENCE}"
+          )"; then
+            echo "OpenCode app token exchange unavailable: OIDC token request did not complete."
+            mark_unavailable
+            exit 0
+          fi
+
+          oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")"
+          if [ -z "$oidc_token" ]; then
+            echo "OpenCode app token exchange unavailable: OIDC token response was empty."
+            mark_unavailable
+            exit 0
+          fi
+
+          if ! token_response="$(
+            curl -fsS \
+              -X POST \
+              -H "Authorization: Bearer ${oidc_token}" \
+              "${OPENCODE_API_BASE_URL}/exchange_github_app_token"
+          )"; then
+            echo "OpenCode app token exchange unavailable: app token request did not complete."
+            mark_unavailable
+            exit 0
+          fi
+
+          app_token="$(jq -r '.token // empty' <<<"$token_response")"
+          if [ -z "$app_token" ]; then
+            echo "OpenCode app token exchange unavailable: app token response was empty."
+            mark_unavailable
+            exit 0
+          fi
+
+          echo "::add-mask::$app_token"
+          {
+            echo "available=true"
+            echo "token=$app_token"
+          } >>"$GITHUB_OUTPUT"
+
       - name: Collect read-only repository and runner evidence
         env:
-          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.queue_read_app_token.outputs.token }}
         run: |
           if [ -z "${GH_TOKEN:-}" ]; then
-            echo "::error::PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN is required for cross-repository queue reads."
+            echo "::error::PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the exchanged OpenCode app token is required for cross-repository queue reads."
             exit 1
           fi
           echo "::add-mask::$GH_TOKEN"

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -2,7 +2,6 @@ name: Agent Review Runtime Quality CI
 
 on:
   pull_request:
-    branches: [main]
     paths:
       - ".github/workflows/agent-review-runtime-quality-ci.yml"
       - ".github/workflows/noema-review.yml"
@@ -22,6 +21,7 @@ on:
       - "scripts/ci/ensure_rust_llvm19.sh"
       - "tests/test_opencode_rust_coverage_toolchain_contract.py"
       - "tests/test_rust_coverage_timeout_not_measured.py"
+      - "tests/test_coverage_incomplete_summary.py"
       - "scripts/ci/resolve_base_rust_toolchain.py"
       - "tests/test_resolve_base_rust_toolchain.py"
       - "scripts/ci/place_maturin_extension.py"
@@ -166,10 +166,13 @@ jobs:
         id: affected_suites
         shell: bash --noprofile --norc -e -o pipefail {0}
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           test "$(git rev-parse HEAD)" = "$HEAD_SHA"
+          git fetch --no-tags --prune origin "refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF"
+          change_base_sha="$(git merge-base "refs/remotes/origin/$BASE_REF" "$HEAD_SHA")"
+          test -n "$change_base_sha"
           noema_suite=false
           opencode_suite=false
           strix_suite=false
@@ -215,6 +218,7 @@ jobs:
               scripts/ci/ensure_rust_llvm19.sh|\
               tests/test_opencode_rust_coverage_toolchain_contract.py|\
               tests/test_rust_coverage_timeout_not_measured.py|\
+              tests/test_coverage_incomplete_summary.py|\
               scripts/ci/resolve_base_rust_toolchain.py|\
               tests/test_resolve_base_rust_toolchain.py|\
               scripts/ci/place_maturin_extension.py|\
@@ -334,7 +338,7 @@ jobs:
                 exact_artifact_suite=true
                 ;;
             esac
-          done < <(git diff --name-only "$BASE_SHA...$HEAD_SHA")
+          done < <(git diff --name-only "$change_base_sha...$HEAD_SHA")
 
           {
             echo "noema=$noema_suite"
@@ -399,8 +403,8 @@ jobs:
         if: steps.affected_suites.outputs.opencode == 'true'
         run: |
           set -euo pipefail
-          python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_rust_coverage_timeout_not_measured.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
-          python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
+          python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_rust_coverage_timeout_not_measured.py tests/test_coverage_incomplete_summary.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
+          python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_coverage_incomplete_summary.py tests/test_resolve_base_rust_toolchain.py tests/test_place_maturin_extension.py
 
       - name: Verify JavaScript materializer documentation contract
         if: steps.affected_suites.outputs.opencode == 'true'
@@ -582,9 +586,15 @@ jobs:
             tests/test_exact_artifact_quality_single_runner.py
 
       - name: Verify consolidated workflow contract
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
           python -m pytest -q tests/test_agent_review_runtime_quality_consolidation.py
           python -m compileall -q tests/test_agent_review_runtime_quality_consolidation.py
-          git diff --check "${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}"
+          git fetch --no-tags --prune origin "refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF"
+          change_base_sha="$(git merge-base "refs/remotes/origin/$BASE_REF" "$HEAD_SHA")"
+          test -n "$change_base_sha"
+          git diff --check "$change_base_sha...$HEAD_SHA"
           git diff --exit-code

.github/workflows/codeql-pr.yml

@@ -18,16 +18,17 @@ name: CodeQL PR
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, closed]
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     # Do not restrict the base ref: the org required-workflow ruleset already
     # scopes this to each repository's actual default branch via
     # ref_name: ["~DEFAULT_BRANCH"], whatever it is named. A hardcoded
     # [main, master, develop] list silently produced zero CodeQL checks for
     # any repository with a different default branch name (confirmed live:
     # a repository defaulting to gh-pages received every other required
-    # check but no CodeQL check at all) and would also block coverage for
-    # stacked PRs targeting a non-default feature branch, matching
-    # security-scan.yml's own "do not restrict the base ref" precedent.
+    # check but no CodeQL check at all). This does not widen ruleset 18156473:
+    # its default-ref scope must inject the required workflow first. A
+    # feature-base stacked PR gets this gate only where the workflow is run
+    # natively, or after retargeting to the repository default branch.
 
 concurrency:
   # NOT scoped by head SHA, unlike opencode-review.yml's group -- and that is
@@ -58,8 +59,11 @@ permissions:
 jobs:
   detect-languages:
     name: Detect CodeQL languages
-    # Draft PRs get no runner; ready_for_review re-runs this on the same head.
-    if: (github.event.action != 'closed') && (github.event.pull_request.draft != true || github.event.action == 'converted_to_draft' || github.event.action == 'closed')
+    # Ruleset consumers do not receive unchanged-head Ready events, so their
+    # Draft heads materialize security evidence. The native owner saves its
+    # runner, while Draft conversion and close events only retire stale work
+    # through the per-PR concurrency group above.
+    if: github.event.action != 'closed' && github.event.action != 'converted_to_draft' && (github.event.pull_request.draft != true || github.event.pull_request.base.repo.full_name != 'ContextualWisdomLab/.github')
     runs-on: ${{ fromJSON(github.workflow_ref == 'ContextualWisdomLab/.github/.github/workflows/codeql-pr.yml@refs/heads/main' && '{"group":"CWL central control","labels":["self-hosted","linux","x64"]}' || '"ubuntu-24.04"') }}
     timeout-minutes: 5
     permissions:
@@ -495,6 +499,54 @@ jobs:
             exit 1
           fi
 
+          # A later attempt of the same required run must preserve exact work
+          # already admitted by the protected central handler. Without this
+          # check, a missing terminal verdict makes every attempt redispatch;
+          # handler concurrency then replaces the durable queued run and sends
+          # the same work to the back of the scarce CodeQL queue.
+          expected_title="CodeQL Scan Dispatch ${TARGET_REPOSITORY}#${PR_NUMBER}@${live_head}/${live_base}/${REQUIRED_RUN_ID}/${live_merge}"
+          required_created_at="$(gh api "repos/${TARGET_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}" --jq .created_at)"
+          if ! [[ "$required_created_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]; then
+            echo "::error::Could not validate required run creation time before CodeQL admission lookup."
+            exit 1
+          fi
+          dispatch_runs="$(
+            gh api --method GET --paginate \
+              -f per_page=100 \
+              -f event=repository_dispatch \
+              -f created=">=${required_created_at}" \
+              "repos/ContextualWisdomLab/.github/actions/workflows/codeql-scan-dispatch.yml/runs" |
+              jq -s .
+          )"
+          active_dispatch_id="$(printf '%s' "$dispatch_runs" | jq -r \
+            --arg title "$expected_title" \
+            --arg path ".github/workflows/codeql-scan-dispatch.yml" '
+              [
+                .[] | .workflow_runs[]?
+                | select(.path == $path)
+                | select(.event == "repository_dispatch")
+                | select(.display_title == $title or .name == $title)
+                | select(.status == "queued" or .status == "in_progress"
+                    or .status == "waiting" or .status == "pending"
+                    or .status == "requested")
+                | select(
+                    (.actor.login // "" | ascii_downcase) as $actor
+                    | $actor == "opencode-agent" or $actor == "opencode-agent[bot]"
+                  )
+                | select(
+                    (.triggering_actor.login // "" | ascii_downcase) as $trigger
+                    | $trigger == "opencode-agent" or $trigger == "opencode-agent[bot]"
+                  )
+              ]
+              | first
+              | .id // empty
+            '
+          )"
+          if [[ "$active_dispatch_id" =~ ^[1-9][0-9]*$ ]]; then
+            echo "CodeQL admission deferred; preserving exact active dispatch ${active_dispatch_id}."
+            exit 0
+          fi
+
           if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
             echo "::error::CodeQL scan dispatch requires GitHub OIDC."
             exit 1

.github/workflows/codeql-scan-dispatch.yml

@@ -31,21 +31,14 @@ on:
   repository_dispatch:
     types: [codeql-scan, codeql-scan-v2]
 
-concurrency:
-  group: >-
-    codeql-scan-dispatch-${{
-    github.event.client_payload.target_repository || github.repository }}-${{
-    github.event.client_payload.pr_number || github.run_id }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
   validate-dispatch:
     name: validate-dispatch
     runs-on:
-      group: CWL central CodeQL
+      group: CWL central control
       labels: [self-hosted, linux, x64]
     timeout-minutes: 8
     permissions:
@@ -866,7 +859,7 @@ jobs:
       && needs.scan.result != 'cancelled'
       && needs.scan.result != 'skipped'
     runs-on:
-      group: CWL central CodeQL
+      group: CWL central control
       labels: [self-hosted, linux, x64]
     timeout-minutes: 8
     permissions: