fix(security): fail closed on ambiguous dependency-review HTTP responses

[seonghobae]

Current integration receipt — 2026-09-08

• Exact owner head: 4ccb21d8ace608f28d11d72589e5deb78add3a33.
• Current protected source/base: main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db.
• Ordinary two-parent adoption: predecessor 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4 plus protected main; exact tree bb57a09a8677536221b016cc3339cf258bcbb1de.
• Delta remains limited to the six canonical Dependency Review owner paths. Exact-tree local GREEN: focused 20 passed, full 3001 passed · 1 skipped · 21 subtests, diff check PASS.
• Fresh hosted exact-head materialization is 12 queued · 1 skipped; no queued or skipped result is counted as a security verdict.
• Exact-head approval is absent and unresolved review threads are zero. Keep Draft until every required/security/review gate is terminal, a qualifying current-head review is clean, and protected admission is ordinary.
• Dependency Review remains independently fail-closed: protected-main integration must be followed by an authenticated HTTP 200 compare and an actually executed dependency verdict before any consumer gate can be accepted.

Security owner outcome

This Draft is the canonical ContextualWisdomLab/.github owner lane for the Dependency Review admission boundary. It now consolidates the valid security deltas from protected #1724 and predecessor diagnostic #1643 without weakening the pinned Dependency Review action or any sibling scanner.

Three owner defects are repaired together:

1. pull-request HTTP 403/404 and every other non-200 compare result previously could be normalized to an unavailable/successful state in the reusable workflow; only HTTP 200 may now authorize the action;
2. thin reusable-workflow callers had omitted the least-privilege contents: read + pull-requests: read permission envelope that a called workflow cannot elevate itself;
3. the compare preflight trusted repository/base/head strings before transport; both the reusable workflow and bundled Security Scan now require exact immutable base/head object IDs and one legal non-dot owner/name repository identity before curl.

Test-first and carryover lineage

The original #1725 RED/GREEN lineage remains intact for non-200 fail-closed behavior and caller permissions. Current successor commits add #1643's still-valid immutable-identity requirement test-first:

• 3736634f95bf132bbbe208ffc80103863fe3a7c1 adds executable reusable-workflow regressions that require named/malformed revisions and malformed/dot-segment repository identities to fail before curl, while legal ContextualWisdomLab/.github reaches exactly one token-authenticated compare;
• b1e6263d9d9626b6cfd2046ce9147ab67867beec adds the corresponding reusable-workflow production validation;
• 8b86c0d2c6b0186538db1ed263f7cb9d222f3ca1 carries fix(security): validate immutable dependency-review identity on current main #1643's conflict-free bundled Security Scan identity preflight onto the current owner tree without force-push or destructive rebase;
• ae128374a2e38e60ada8bf5e89a9c7a4137f864f records the decisive A/B evidence and unified security invariants in canonical doctoring;
• 58a0b4c8ecc3073a64bd91457101229a21f020d4 adds a dedicated bundled-scan regression so the carried validation cannot silently disappear.

The temporary #1643 canary itself is deliberately not part of this publishable successor.

Decisive A/B evidence from #1643

Exact-head canary run 33589436750, job 100120235906, checked out a6a2759640e6aa1d1e1219e1cd7aacdeffef32c0 and compared exact base bb14b014eee31e6abdb5d2fffbb805aa29420eac to that head for ContextualWisdomLab/.github.

• anonymous request: HTTP 404, curl exit 0;
• job-token request with contents: read + pull-requests: read: HTTP 200, curl exit 0.

Therefore an anonymous response is not an availability authority. The least-privilege job token is the supported comparison boundary, and non-200 authenticated results remain fail-closed.

Current protected-main relationship — 2026-09-07

Protected source/base is main@c9052e607e5f3cc76e73207e7786b21500721b79; exact owner head is 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4. The direct ordinary adoption records predecessor c2e8ab0e535245f8f53801ad6a11e107fe492341 and protected main as its two parents. The exact tree differs from main in only the six owner paths listed above. Reverse PR #1995 is closed and no longer participates in acceptance.

Consumer evidence and release boundary

Before caller permission repair, immutable reusable-workflow consumers such as ContextualWisdomLab/newsdom-api#784@1623977e6c37c78cb1a94a7a48c48f6d02cac86c (33622976911) and ContextualWisdomLab/mightyETL#330@65efdf7b4064df5b9811c0403defb707e6efbc02 (33623035969) terminated startup_failure with zero jobs. After explicit caller permissions, fresh exact heads materialized Dependency Review runs in newsdom-api, mightyETL, scopeweave and Argos.

After this PR reaches protected main through ordinary protection, consumers must pin the reusable workflow to that immutable protected-main SHA. No caller returns to @main, a PR head, or another mutable owner ref.

Exact-head gate

All predecessor check/review evidence is invalidated. The authoritative current-head materialization is the live tally in the receipt above; exact-head approval remains absent, and nonterminal/failed gates are not transferable. Keep Draft and ADR-0025 Proposed until this unchanged successor has terminal passing required checks, substantive-clean current reviews/threads, current base/mergeability, and ordinary protected admission.

Refs #810, #1150, #1643, #1724, #1728, #1731, #1734.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fleet handoff — a second migration defect is now live-evidenced and belongs in the central consolidation contract/doctoring before #1725 leaves Draft.

RCA: #1724's thin-caller replacements removed each caller workflow's permission envelope. A reusable workflow cannot elevate GITHUB_TOKEN permissions passed by its caller; the central workflow requests contents: read + pull-requests: read. On repositories whose default token does not already include that scope, the call fails before job creation. This is consistent with GitHub's reusable-workflow contract that permissions may only be maintained or downgraded across the call chain.

Exact RED evidence after immutable pinning (so mutable-ref resolution is no longer confounded):

• newsdom-api fix(coverage): gate PyO3 test deferral on exact-head native peer checks #784 1623977e6c37c78cb1a94a7a48c48f6d02cac86c: Dependency Review run 33622976911 -> startup_failure, zero jobs; referenced workflow resolved exactly to .github@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03.
• mightyETL chore(deps): bump typing-extensions from 4.15.0 to 4.16.0 #330 65efdf7b4064df5b9811c0403defb707e6efbc02: run 33623035969 -> startup_failure, zero jobs.
• Original caller workflows prove the permissions were part of the pre-migration contract: scopeweave and newsdom-api had contents: read + pull-requests: read; Argos had the same; mightyETL had contents: read, which is insufficient once the centralized workflow itself also requires pull-requests: read.

Consumer GREEN repair is now applied without touching this owner branch: explicitly retain permissions: {contents: read, pull-requests: read} in the thin callers. Fresh exact heads now materialize instead of immediate zero-job failure: newsdom-api 9a798d5ac7b9b295a1accb2327fc76611352290f run 33623818000 queued; mightyETL 4576f863ede9fca0673d6cce5ae8a4093246f5ab run 33623854807 queued; scopeweave db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f run 33623761776 queued; Argos #557 ee4c5dd326977407435b0f2425fdecebc34a810f run 33623867278 pending.

Owner-path acceptance: extend #1725's central contract/ADR/doctoring/example caller so every reusable Dependency Review caller is required to pass at least contents: read and pull-requests: read; preserve the existing 403/404 fail-closed RED/GREEN; then merge normally and publish the resulting protected-main exact SHA for all four consumers to pin. No caller should return to @main.

[seonghobae]

Fresh owner-path re-read confirms the permission handoff has advanced correctly to an explicit RED at ee0f1ce544965772775b590050e40476df4ea8f6 (test(security): require caller permission envelope). The new contract requires the reusable workflow's documented thin caller to contain permissions: contents: read and pull-requests: read, while the workflow source at this exact head still shows concurrency immediately after on: and therefore does not yet satisfy that test. Keep this as RED rather than weakening the assertion.

Next owner GREEN should minimally update the canonical example/doctoring contract to include the two caller read permissions, preserve the existing non-200 fail-closed production repair, adopt protected main@8eaa65005005ac1e67e21f18f8627529d0f41f5c non-destructively, and reacquire exact-head gates before normal merge. Once that fixed protected merge SHA exists, the four consumer PRs can replace their temporary 0bcd22... pins with that immutable fixed SHA and rerun their real gates.

[seonghobae]

Fresh-base owner handoff for exact head 403ca1c4de8b3e477b5a9b1c102188278286b2c8 (read-only; no source/ref/PR-state mutation): protected ContextualWisdomLab/.github/main is now 63bf49835da44aa8257eb76a92368e6485ae6e94 via #1728, while this Draft still records base b4eec000d21084accb736d289eb64cfd78e7a91a and is currently non-mergeable. Preserve the HTTP-non-200 fail-closed and least-privilege caller-permission RED/GREEN deltas; non-force reconcile with the live protected base, then re-run focused tests and every exact-current-head required/security/provenance check. Do not transfer the prior 403ca1c4… evidence across the new integration head. Consumers must continue to wait for the resulting protected-main immutable SHA and then pin that exact SHA; no @main, PR-head, skipped/cancelled/queued, or predecessor evidence is release authority.

[seonghobae]

Fresh Naruon reproduction confirms this PR's permission-envelope RCA on a fifth consumer. ContextualWisdomLab/naruon#1539@6e7a8d8a947fec1ffdfff15f165b3a171ec2e03e pins reusable Dependency Review at protected .github@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1; run 33630975578 resolves that referenced workflow but ends startup_failure with zero jobs. The Naruon thin caller currently omits caller-side permissions, matching the already-proven newsdom-api/mightyETL failure class in this PR. I am routing the consumer repair to #1539 without changing this central branch. GREEN for Naruon should include a fresh immutable central pin plus caller contents: read / pull-requests: read, followed by a real dependency-review / dependency-review job on the unchanged repaired caller head.

[seonghobae]

Current-main ancestry reconciliation rationale before write: protected main advanced to 78271917b526469c559fa75cb5ee39426e5494d1 after this Draft lane's prior reconciliation. Fresh compare is ahead_by=8 / behind_by=4 with merge base 63bf49835da44aa8257eb76a92368e6485ae6e94, but the effective tip-to-tip content delta remains exactly the four owner paths already named by this PR: reusable Dependency Review workflow, Proposed ADR-0025, doctoring, and executable contract test. The branch's latest commit 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c specifically reconciles the newer reusable-workflow contract (including comment_summary_in_pr and harden-runner tests), and every non-owner path is already content-identical to current protected main.

I will therefore preserve both histories without force/rebase by creating a two-parent reconciliation commit with the current branch tree unchanged, parents 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c and protected main@78271917b526469c559fa75cb5ee39426e5494d1, then move only this owner branch by fast-forward. This is ancestry repair only: no security behavior, ADR status, test expectation, or current protected-main intent is discarded.

[seonghobae]

Consumer owner-path acceptance from writable newsdom-api#784: current caller exact head b14586c218bb60e614136bef94e9fd8163f4d4b8 pins central workflow SHA 5f8e5b2a79e709c4ab1a4179a605d34c458b13a1. That protected-main commit still treats authenticated HTTP 403/404 compare responses as available=false and skips the hard gate; therefore it is not an acceptable security contract for the consumer. #1725 correctly owns the fail-closed repair. GREEN handoff requires: (1) unchanged #1725 protected-main descendant with non-200 fail-closed + caller permission/identity tests terminal-green, (2) ordinary protected merge, (3) canonical immutable owner release/tag for the reusable workflow (the repository currently exposes no Releases), and (4) newsdom-api caller/test constant bumped to that released owner identity followed by exact-head dependency-review / dependency-review terminal GREEN. Do not resolve by returning to @main, retaining 5f8e, or treating 403/404 as availability success.

[harbourviewcompany-create]

Evidence log — 2026-09-02

Exact current head: 58a0b4c8ecc3073a64bd91457101229a21f020d4.

• Current protected main: 8c085835fbf77de2321b72fa6b8dd946227e523e.
• GitHub compare: diverged, ahead_by=14, behind_by=7, merge base 78271917b526469c559fa75cb5ee39426e5494d1.
• GitHub currently reports the PR mechanically mergeable; there is no active merge conflict reported by the API. The branch is nevertheless behind current main, so current-head validation is not yet transferable.
• Exact-head required/security runs are queued/pending: OSV 33637850661, Secret Scan 33637849083, Security Scan 33637849313, CodeQL 33637849320, Scorecard 33637849319, SBOM 33637849219, SAST 33637849226, Python Security 33637849275.
• Security Scan currently has four queued jobs (osv-scan, dependency-review, trivy-fs, scorecard) in run 33637849313; no terminal result exists yet.
• Combined commit status currently exposes only CodeRabbit success; required GitHub Actions evidence is therefore non-terminal.
• Existing independent review evidence is stale: the recorded review was against predecessor head 403ca1c4..., not this exact head, so it is not treated as current approval.

Gate decision: HOLD. Do not mark ready or merge until the branch is reconciled against current protected main, focused QA passes on the resulting exact head, all applicable required/security checks are terminal and passing, and current qualifying review/thread requirements are satisfied.

[seonghobae]

Fresh Context Fabric consumer evidence confirms this owner lane is still required, but the branch must be reconciled onto current protected main before integration.

ContextualWisdomLab/context-graph-contracts#4@3b1bdf0f47087bf06c082180e5a919efeaffb8dd ran Security Scan 33873626072; dependency-review job 101066017665 acquired an Ubuntu 24.04 runner, checked out and independently verified that exact head, then called the authenticated dependency-graph compare for exact base 99cb5468ba3c15c5e79688f53dee74724fae2d13 -> exact head 3b1bdf0f.... The transport returned HTTP 403, curl_exit=0; the job correctly failed closed and skipped the pinned dependency-review action. OSV, Trivy and Scorecard sibling jobs succeeded on the same Security Scan run, so this is specifically the dependency-graph comparison/admission boundary rather than generic runner failure or leaf source execution.

The live owner branch is now #1725@6e8998f0c7159a0296eaa455fade762c185e246c, while protected .github/main is f43dcb884be5a0efc61611b5c8cb83c4c7735995; fresh comparison is diverged, 159 behind / 15 ahead from merge base 4f95abce.... Preserve the six-file owner delta, adopt intervening protected-main changes by non-force reconciliation, and regenerate exact-head checks/reviews. No predecessor evidence transfers. After protected integration, rerun the unchanged/current CGC consumer head and require authenticated HTTP 200 plus an actually executed Dependency Review result; do not reinterpret 403 as success.

[seonghobae]

Fresh consumer correction, 2026-09-05: ContextualWisdomLab/ConceptWeave#1@8e8783286eac7567803568d9a91010daaf028074 produced a real hosted Security Scan RED in run 33886162808, dependency-review job 101108147137. Exact-head checkout succeeded; the support probe then returned HTTP 403 with curl exit 0 for a public, non-fork repository while the job token exposed contents: read and pull-requests: read. The pinned action was skipped because the existing owner contract correctly failed closed.

This materially extends #1725's older A/B evidence: authenticated 200 is not universal across current required-workflow consumers. I did not force-restack this deeply diverged branch. Current-main successor Draft #1873 starts from protected .github/main@f43dcb884be5a0efc61611b5c8cb83c4c7735995 and carries the new test-first defect class plus exact doctoring. Its invariant remains the same as #1725: no non-200 response is success. The proposed next repair is bounded same-token re-observation for anomalous public/non-fork 403 plus request/rate metadata, followed by final non-200 hard failure and a real consumer rerun. #1725 remains open; no delta is being discarded.

[seonghobae]

SOURCE WRITER CLAIM — reverse restack PR #1995 is retired because its main head repeatedly materialized the full PR workflow fanout. Fresh refs are owner branch c2e8ab0e535245f8f53801ad6a11e107fe492341 and protected main@c9052e607e5f3cc76e73207e7786b21500721b79.

A detached preflight merge completed without conflict. Its candidate tree differs from current protected main in exactly the six canonical #1725 owner paths; focused dependency-review/security contracts are 22 passed, full suite is 2983 passed, 1 skipped, 21 subtests, and diff check passes. I am taking the existing owner branch only for a direct ordinary two-parent adoption, then will re-fetch both remote refs immediately before a fast-forward push. No force update, protected-main mutation, settings change, consumer rerun, bypass, or predecessor-evidence transfer is included.

[seonghobae]

SOURCE WRITER RELEASE — exact head 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4 now directly and ordinarily adopts protected main@c9052e607e5f3cc76e73207e7786b21500721b79.

• parents: predecessor owner head c2e8ab0e535245f8f53801ad6a11e107fe492341 + protected main c9052e607e5f3cc76e73207e7786b21500721b79;
• exact tree: 90cedf22f0226f997e295462b66186d02df3f193;
• main-relative delta: exactly six canonical Dependency Review owner paths;
• focused dependency-review/security contracts: 22 passed in 0.63s;
• full suite: 2983 passed, 1 skipped, 21 subtests in 96.34s;
• diff check: PASS.

The first focused invocation named one nonexistent test file and exited before collecting tests; it was a command-selection error, not a source failure. The corrected exact-tree focused suite and full suite above are the claimed evidence.

Fresh hosted state is 12 queued · 1 skipped, exact-head approval is absent, and the PR remains Draft. No predecessor evidence transfers. Reverse restack PR #1995 is closed without merge; no force push, protected-main write, settings mutation, consumer rerun, bypass, or gate relaxation occurred.

[seonghobae]

Exact-head execution receipt: ordinary parents 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4 + protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, tree bb57a09a8677536221b016cc3339cf258bcbb1de. The protected CodeQL #2028 delta was adopted without entering this PR's six-path Dependency Review diff. Local GREEN: focused 20 passed; full 3001 passed, 1 skipped, 21 subtests; git diff --check PASS. Hosted exact-head gates remain nonterminal, so this is evidence only, not approval or merge authorization.

[seonghobae]

Fresh consumer evidence from ContextualWisdomLab/LineageWeave#983 confirms this canonical Dependency Review owner boundary remains live and fail-closed across the repair movement.

Exact consumer evidence:

• consumer protected base 83eba56149eb802cd63642c507c324c9976ec78e
• predecessor head 266303480fd5282f3a6682da895902c9dacdea81: Security Scan run 34222989425, dependency-review job 102051088248
• current head 2881ad6de8a92255b4028fd8f6670473e8746240: Security Scan run 34229414648, dependency-review job 102071541947
• both checkouts matched their exact heads
• both job tokens advertised contents: read, metadata: read, pull-requests: read
• both authenticated dependency-graph/compare/<base>...<head> preflights returned HTTP 403 with curl exit 0
• in both runs the workflow correctly failed closed and the pinned dependency-review action itself was skipped
• on the current head, Scorecard, OSV and Trivy all completed successfully, so this is not evidence of a LineageWeave source vulnerability or a generic scanner outage.

No LineageWeave caller-side skip/fallback or gate weakening was added. After #1725 reaches protected .github/main, acceptance still requires an immutable protected-main consumer pin plus a fresh consumer run that obtains authenticated HTTP 200 and executes the dependency verdict.

[seonghobae]

Fresh consumer evidence from ContextualWisdomLab/LineageWeave#983@8274f1a12e1f5c4ad7f31c91cba39cc79f277831 supports this canonical owner path. Security run 34271323036, dependency-review job 102213434249, checked out the exact head and verified the expected SHA successfully. The authenticated preflight then queried the dependency-graph compare for exact base 83eba56149eb802cd63642c507c324c9976ec78e → head 8274f1a12e1f5c4ad7f31c91cba39cc79f277831 on public ContextualWisdomLab/LineageWeave and received http_status=403, curl_exit=0; the job correctly failed closed before running Dependency Review. Scorecard and OSV on the same consumer head were GREEN. No LineageWeave-local scanner, receipt fabrication, or non-200 waiver was added. Please retain this as downstream RED evidence for the caller-permission/Dependency Review admission repair; consumer acceptance still requires this owner repair to reach protected .github/main, an immutable consumer pin where applicable, and a fresh exact consumer HTTP 200 + executed dependency verdict.

[seonghobae]

Second independent LineageWeave consumer confirms the same admission failure is systemic rather than specific to #983. On LineageWeave#929@fabdacd4c487be7feb8db02c32b79d4e7d89f581, Security run 34255176062, dependency-review job 102159059348, exact checkout verification passed. The token permissions reported Contents: read, Metadata: read, PullRequests: read; the authenticated dependency-graph compare for protected base 83eba56149eb802cd63642c507c324c9976ec78e → exact head fabdacd4c487be7feb8db02c32b79d4e7d89f581 on public ContextualWisdomLab/LineageWeave again returned http_status=403, curl_exit=0, so Dependency Review itself was correctly skipped and the job failed closed. OSV and Trivy on the same head were GREEN. This reproduces the #983 consumer RED on a distinct product branch and strengthens the caller-permission/admission RCA; keep the fix centralized here and require fresh downstream HTTP 200 + executed dependency verdict after protected owner delivery.

[seonghobae]

Fresh independent consumer evidence from ContextualWisdomLab/LineageWeave#983 reproduces the same authenticated admission boundary on exact head 28ed29508dc70be6e92a043c6d5a83cbea1e8271. Security run 34277210268, dependency-review job 102233148725, checks out that exact SHA successfully, verifies actual_sha == expected_sha, then calls the public repository dependency-graph compare for exact main@83eba56149eb802cd63642c507c324c9976ec78e...28ed2950... with the job token. The preflight reports http_status=403 curl_exit=0 and fails closed before actions/dependency-review-action executes. The job token permission envelope printed by Actions is contents: read, pull-requests: read, metadata: read.

This is not a LineageWeave source/scanner finding: the same exact head has SAST GREEN and OSV/Scorecard/Trivy lanes succeeding; no leaf substitute scanner or synthetic receipt was added. Treat this as another consumer acceptance case for #1725: after the owner repair reaches immutable protected main and the consumer pins it, the same exact authenticated compare must return HTTP 200 and Dependency Review must actually execute before the consumer gate can be GREEN.

[seonghobae]

Fresh consumer evidence from LineageWeave keeps this owner prerequisite live. ContextualWisdomLab/LineageWeave#983@17770e3dbc99201424d08017b7334348eff761ab, Security run 34282238497: exact scope detection is GREEN; Trivy, OSV and Scorecard are GREEN; Dependency Review job 102249740435 checks out the exact consumer head and fails only at Check dependency review support before the pinned action executes. This repeats the authenticated consumer admission failure on a newer exact head without a LineageWeave-local shim or scanner substitution. Treat it as consumer RED only; #1725 remains unmerged Draft owner work, so no owner GREEN/release or downstream acceptance is claimed.

[seonghobae]

Fresh LineageWeave consumer evidence from ContextualWisdomLab/LineageWeave#983@b69efde292a4bcf0c8ef78da31379965e9a34339:

Security Scan run 34303750908 materialized normally. Exact-head changed-scope, Trivy (102316331581), OSV (102316331665), and Scorecard lanes reached GREEN. Dependency Review job 102316331603 checked out and verified the exact b69 head, then failed specifically at Check dependency review support; the delegated Dependency review step was skipped. This reproduces the fail-closed admission problem on another exact immutable consumer head after ordinary workflow materialization. No LineageWeave-local substitute scanner, synthetic receipt, or gate waiver was introduced.

Keep this as consumer RED for the canonical owner repair/release path: after owner integration, the acceptance target remains an authenticated HTTP 200 compare plus an actually executed Dependency Review verdict on a consumer pinned to the immutable released owner revision.

[seonghobae]

Fresh LineageWeave consumer evidence on exact ContextualWisdomLab/LineageWeave#983@e2bcba49dd9b2baab129de9c3872d77f654dd16a reproduces the same owner-boundary admission failure after the leaf checkout is exact. Security Scan 34309004543, dependency-review job 102332004493: checkout exact dependency-review head = GREEN, Verify Dependency Review head checkout = GREEN, Check dependency review support = RED, and the actual Dependency review action is skipped. On the same exact head, Trivy job 102332004482 and Scorecard 102332004500 are GREEN; OSV also materialized independently. This remains fail-closed consumer evidence, not a request for a LineageWeave-local substitute or waiver. Please preserve the owner path through protected integration + immutable consumer pin + authenticated HTTP-200 compare + actually executed dependency verdict before counting the repair delivered.