fix(codeql): 언어별 재시작 경합과 재분석 반복 방지

[seonghobae]

변경

#2028 위에 쌓은 후속 수정입니다. #2029 dispatch run 34178442472와 #2033 dispatch run 34182987578에서 재현된 언어별 rerun 403 경합을 제거합니다. 전체 matrix 이후 단일 coordinator가 정확한 실패 작업 집합을 확인하고 native failed-jobs 재시작을 한 번 요청합니다. 읽기 전용 분석 작업과 재시작 권한을 분리했습니다.

완료된 분석 job과 validate-dispatch 성공을 함께 확인해 전체 실행 완료를 기다리는 순환 경합을 피합니다. 전달기도 같은 결과를 소비해 성공·실제 보안 지적 모두 불필요한 재분석을 멈춥니다. 보안 지적은 계속 실패 상태입니다. AGENTS.md, CHANGELOG, doctoring, docs/product-technical-gap-baseline.md에 절차와 실패 재현 근거를 기록했습니다.

#2028이 protected main에 병합한 immutable base SHA·required run ID binding을 3-way 보존 병합했습니다. 후속 review에서 coordinator의 completed-scan lookup이 옛 head-only title을 사용해 #2028 run name과 불일치하는 문제를 RED 78aca1ded85d70e71e94470eacd4cb1ca203c904 → GREEN 868a208b83d60c855da42477ac0501cb66a69f80으로 고쳤습니다. 상태 creator trust를 넓히거나 polling을 추가하지 않았습니다.

검증

기존 24개 통과 기준선에서 실제 active-run POST 거부를 반영하자 1 failed / 1 passed로 문제를 재현했습니다. 원 branch 수정 후 CodeQL 계약 46 passed, Actions 환경 및 -W error 조건에서 59 passed / 81.67s, actionlint와 git diff --check 통과 기록을 유지합니다.

2026-09-08 protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db restack에서는 네 충돌 파일을 의미 보존 병합했습니다. 후속 cross contract는 old head-only lookup에서 실패했고 exact head/base/required_run lookup 뒤 52 focused contract cases가 통과했습니다. Python/YAML syntax도 통과했습니다. 현재 exact HEAD는 d66f1d5a1388b6acdcbb72f15d93a4705f1da2a8, protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db 기반이며 mergeable·Draft입니다. Review에서 발견한 coordinator test의 literal \\n split과 dispatch workflow EOF blank line은 같은 non-force atomic commit에서 교정했습니다. Fresh focused execution은 coordinator identity contract와 EOF normalization을 통과했고, 새 exact-head hosted runs 34190190400/424/465/485/495는 queued입니다.

남은 승인 조건

독립 리뷰, 전체 exact-head hosted 검사, 실제 다언어 PR의 단일 복구와 필수 검사 종료를 검증해야 합니다. 로컬 성공을 조직 60-job ceiling 해소나 배포 완료로 주장하지 않습니다. 부모 #2028의 유효 변경을 폐기하거나 대체하지 않습니다.

Current-head review admission

2026-09-08 exact head d66f1d5a1388b6acdcbb72f15d93a4705f1da2a8 is open · Ready · mergeable on protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db, with zero unresolved inline threads.

Current Ready-lifecycle Security Scan 34194312191, SAST Semgrep 34194312216, and Python Security 34194312193 are terminal SUCCESS. CodeQL PR 34194312208 is terminal FAILURE; both exact language jobs (101963759788 python and 101963759820 actions) read verdict=pending and fail closed, while coordinator job 101969055648 successfully dispatched the exact repository/base/head/run/matrix payload. This is the central verdict-settlement boundary now repaired in proposed .github#1902, not a #2032 source or SARIF failure.

Agent Review Runtime Quality CI 34190190485 is terminal SUCCESS on the same head. Ready admits current-head review only. Terminal CodeQL success and a qualifying independent approval remain merge gates; predecessor evidence is not transferred and no unchanged-head rerun is justified before the canonical owner is integrated.

[coderabbitai]

Warning

Review limit reached

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9b1c97aa-79e7-44d4-a73a-66df3edb28d3

📥 Commits

Reviewing files that changed from the base of the PR and between 7fd571d and d66f1d5.

📒 Files selected for processing (9)

• .github/workflows/codeql-pr.yml
• .github/workflows/codeql-scan-dispatch.yml
• AGENTS.md
• CHANGELOG.md
• docs/doctoring/codeql-matrix-wake-race.md
• docs/product-technical-gap-baseline.md
• tests/test_codeql_pr_workflow_contract.py
• tests/test_codeql_scan_dispatch_workflow_contract.py
• tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Visual Inspection 완료: HEAD fc78e1620fe53f80c5f64711e2356a3cdf1fc312의 AGENTS.md를 실제 Edge GitHub Preview 화면(1897×946)에서 열고 새 두 문단 전체를 스크린샷으로 확인했습니다. 문장 줄바꿈, 목록 간격, 우측 잘림·겹침 없음. 이는 문서 시각 검수이며 hosted CodeQL 복구 성공 증거는 아닙니다. 관련 59개 검사는 Actions 환경과 -W error에서 종료 코드 0으로 완료했습니다.

[seonghobae]

현재 HEAD fc78e1620fe53f80c5f64711e2356a3cdf1fc312의 CodeRabbit SUCCESS는 Draft PR not reviewed라는 생략 알림이며 승인 리뷰가 아닙니다. 실제 reviews 배열은 비어 있습니다. 전체 로컬 tests를 GITHUB_ACTIONS=true 및 -W error로 실행 중이고 별도 읽기 전용 교차 검토도 진행 중입니다. 중앙 .github의 queued 실행 API 페이지 집계는 53개였으며, 조직 전체 동시 job 수나 60-job ceiling 해소 여부를 뜻하지 않습니다.

[seonghobae]

P1 — stacked exact-head finding: the dedicated wake-required job and run-wide rerun are useful least-privilege/race deltas, but this PR inherits #2028's unauthenticated central-job fallback and is not a successor to #1902. Its central run/job lookup still lacks exact protected base/source, required-run/job, actor and SARIF-artifact provenance. Preserve #2028 pagination fixtures and this PR's actions-write separation/run-wide settlement through ordinary non-force semantic stacking onto the repaired #1902 line; do not merge or retire either predecessor until combined equivalence and exact hosted child→SARIF→receipt→required-run settlement are proven.

[seonghobae]

현재 fc78e1620fe53f80c5f64711e2356a3cdf1fc312의 전체 테스트가 동일 실행에서 종료 코드0으로 완료됐습니다: GITHUB_ACTIONS=true, -W error, 2994 passed, 1 skipped, 21 subtests passed /1518.65s. 중간 관찰 대기를 이유로 테스트를 중단하거나 새로 시작하지 않았습니다. 다만 읽기 전용 교차 검토에서 P2 세 건을 발견했습니다: 전체 dispatch 이력의 불필요한 조회, 확정 실패+미결 언어 혼합시 실패집합 불일치, 분할 dispatch run의 언어별 증거 누락. 별도 worktree에서 회귀 테스트와 수정 중이며 이 전체 통과로 지적 해소를 주장하지 않습니다. Draft를 유지합니다.

[seonghobae]

Queue evidence checkpoint (2026-09-08): live REST queued workflow-run counts are .github=131, contextual-orchestrator=24, naruon=19 (174 total); in_progress counts are 8,4,10. Against the historical same-three-repository 2026-09-03 doctoring sample of 3020 queued runs this is a 94.2% lower snapshot, NOT a causal attribution, org-wide completion percentage, concurrent-job count, or proof that the 60-job limit is resolved. Central queue has grown from the earlier 53-run snapshot to 131. All six inspected in-progress PR review targets still match their live open PR heads, so none was cancelled as stale. The merged parent 7fd571d additionally binds fallback evidence to live base SHA and required run ID; the P2 recovery patch is being integrated with that boundary preserved. Existing fc78 full-suite results do not validate this pending integration.

[seonghobae]

Integration boundary update: local d96682c0517f9e291ea01f20e5cc311fdc70a536 preserves merged main7fd base/run identity and the P2 experiments, but is not pushed or accepted as a complete solution. Existing #190261b88b8 still has exact-head P1 review 5136995106: required-run identity lost, per-language Actions-write settlement, and status-publication-403 blocking recovery. Its 79 focused/3027 full passes do not cover those missing contracts. We must semantically combine both PRs rather than select either whole workflow. A separate minimal mixed-failure probe on #1902 is RED and remains part of that combined acceptance. No PR closed, no delta discarded, no lifecycle or status bypass. Browser visual inspection of the published RED receipt #1902 comment5578786965 is complete; the full paragraph wraps without clipping. This is PR evidence inspection, not product UI or deployed runtime proof.

[seonghobae]

Carryover status from canonical owner PR #1902:

PR #1902 exact head 1a3133f5efd147bc6892a2920749bf103f4683da now integrates this branch's valid single non-matrix settlement and least-privilege (scan: actions:read, one wake-required: actions:write) semantics, while retaining #1902's stricter required-run-bound receipt and exact direct-evidence provenance. Local exact-tree evidence is GREEN; hosted exact-head runs and independent review are still pending.

This PR remains Draft/open and its delta is preserved. Do not retire it yet: complete successor carryover requires hosted equivalence on #1902, not merely source similarity or local tests. No branch/ref change, review dismissal, or predecessor evidence transfer was made here.

[seonghobae]

2026-09-08 causal restack evidence: protected main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db and branch fc78e1620fe53f80c5f64711e2356a3cdf1fc312 were re-fetched immediately before publication. Non-force merge commit 2268986b3b5f1ee6cd5ad738284c480f653b9078 has both as parents, is 11 ahead / 0 behind and mechanically mergeable. Conflict resolution retains #2028's base-SHA/required-run binding plus this PR's validated in-progress scan evidence and one post-matrix rerun-failed-jobs coordinator. Fresh live evidence is #2033 dispatch run 34182987578: both scans/statuses succeeded, then actions wake failed HTTP 403 because python had already restarted required run 34181386094. Local post-resolution evidence: Python/YAML syntax clean and 51 focused contract cases passed. New exact-head hosted runs 34185988934, 34185988946, 34185988972, 34185989005, 34185989070 are queued; predecessor results are not transferred.

[seonghobae]

Post-restack review found and repaired a cross-PR identity mismatch. RED 78aca1ded85d70e71e94470eacd4cb1ca203c904 makes completed-scan reuse supply #2028's exact head/base/required_run title and asserts that the coordinator constructs the same identity; the old head-only lookup fails by redispatching. GREEN 868a208b83d60c855da42477ac0501cb66a69f80 changes the coordinator lookup to ${PR_HEAD_SHA}/${live_base}/${REQUIRED_RUN_ID}. Documentation alignment is d1affc03a02112e0927e9f168b41adfc53a0ba00. Focused result: 52 contract cases passed; Python/YAML syntax passed. Fresh authority: protected main unchanged at 7fd571d…, exact head d1affc0…, 15 ahead / 0 behind, mergeable, Draft, unresolved threads 0. Hosted runs 34186811252/266/282/285/290 remain queued/pending, so this is not merge-ready evidence.

[seonghobae]

Exact-head 독립 검증에서 게시된 GREEN 주장을 재현하지 못했습니다.

• HEAD: d1affc03a02112e0927e9f168b41adfc53a0ba00
• base: 7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db
• focused:
  GITHUB_ACTIONS=true pytest -q -W error tests/test_codeql_pr_workflow_contract.py tests/test_codeql_scan_dispatch_workflow_contract.py tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py
  → 1 failed, 57 passed
• failure: test_codeql_coordinator_fallback_binds_live_base_and_required_run_identity
• cause: test가 실제 newline이 아니라 literal \\n으로 workflow.split(" dispatch-current-head:\\n", 1)을 수행해 production workflow를 검사하지 못합니다.
• git diff --check 7fd571db...HEAD도 .github/workflows/codeql-scan-dispatch.yml:596: new blank line at EOF로 실패합니다.

Production coordinator title 자체는 exact head/base/required_run identity를 포함하는 것으로 보입니다. 그러나 현재 published test는 그 경계를 실행하지 못하고 exact tree도 diff-clean이 아니므로 “52 focused contract cases / diff check PASS”를 current-head evidence로 사용할 수 없습니다.

최소 수리 조건은 테스트의 double-escaped newline을 실제 "\n"으로 고치고 EOF 공백을 제거한 뒤 focused/full suite와 diff check를 exact head에서 다시 실행하는 것입니다. PR은 Draft/fail-closed를 유지해야 하며, canonical #1902의 더 강한 provenance 계약을 약화시키는 whole-workflow 승계는 피해야 합니다.

[seonghobae]

현재 head c19d31f0e2c4fe0ad85ffe2840b1e8a5f29a5af6는 d1affc0 위의 일반 문서 변경입니다. AGENTS.md와 gap baseline만 수정해 한 저장소의5~6 workflow runs를 조직60 executing jobs와 비교하던 단위·범위 오류를 교정했습니다. 동적5개job의 추가 fan-out은 확인했지만 query/SARIF 게시 동등성은 미완이므로 자동 보안검사를 제거하지 않습니다. diff check통과, 실제 Edge에서 pushed AGENTS 새문단의1897x949 화면을 검사해 줄바꿈·잘림·겹침 없음을 확인했습니다. 실행코드는d1affc03과동일하며 이전head의Checks/승인을 새head완료로 전용하지 않습니다. PR은Draft, CodeQL통합canonical#1902와출처/권한/pagination보완은별도진행중입니다.

[seonghobae]

Direct repair of the current-head test/evidence defects from review:

• Predecessor c19d31f0e2c4fe0ad85ffe2840b1e8a5f29a5af6 reproduced the coordinator contract RED: the test searched for the literal characters \\n, while the production workflow contains an actual newline, so the split raised before inspecting dispatch-current-head.
• Non-force atomic commit d66f1d5a1388b6acdcbb72f15d93a4705f1da2a8 changes that one test marker to the actual newline and removes only the extra blank line at EOF in .github/workflows/codeql-scan-dispatch.yml.
• Fresh focused execution against blobs cfa1d383… / 8c305ad1… / 03c340ba…: coordinator identity contract PASS; dispatch EOF normalization PASS.

This repairs the published test and diff-cleanliness finding only. The PR remains Draft because canonical #1902 owns the stronger producer-source, complete-pagination, mixed-verdict, and authenticated settlement contract. New exact-head hosted Checks and successor-equivalence evidence are still required; predecessor GREEN is not transferred.

[seonghobae]

Independent exact-head follow-up for d66f1d5a1388b6acdcbb72f15d93a4705f1da2a8 on main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db: the two defects recorded in review 5137459157 are repaired.

• the coordinator contract now splits on the real newline and executes the production dispatch-current-head section;
• the extra workflow EOF blank line is removed;
• focused workflow/dispatch/runner contracts under GITHUB_ACTIONS=true -W error: 58 passed;
• git diff --check 7fd571db...HEAD: clean.

This verifies only that review's test-driver and diff-cleanliness findings. The PR remains Draft and is not a canonical successor to #1902's stronger producer-source, complete-pagination, mixed-verdict, and authenticated-settlement boundary. Current hosted state is non-terminal, and this COMMENT is not approval or merge authority.

[seonghobae]

Exact CodeQL RCA — run 34194312208

• Python job 101963759788 and actions job 101963759820 both completed the verdict read with verdict=pending, then failed closed in enforcement.
• Coordinator 101969055648 completed successfully and dispatched the exact ContextualWisdomLab/.github#2032@d66f1d5a…/main@7fd571db…/34194312208 two-language matrix.
• Security Scan, SAST Semgrep, Python Security, and Runtime Quality are SUCCESS on the exact head.

The remaining failure is the canonical central receipt/settlement path in .github#1902; no #2032 source change or manual rerun is warranted.