chore: refresh org SBOM inventory

.github/actions/orchestrator-free-sidecar/action.yml

@@ -6,9 +6,9 @@ inputs:
     required: false
     default: "false"
   catalog_limit:
-    description: Maximum discovered route catalog size for the sidecar preflight.
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
     required: false
-    default: "12"
+    default: "24"
   catalog_account_cap:
     description: Maximum routes admitted from one credential account.
     required: false

.github/workflows/agent-mention-noema-dispatch.yml

@@ -8,15 +8,26 @@ on:
   repository_dispatch:
     types: [agent-mention-noema]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -8,15 +8,26 @@ on:
   repository_dispatch:
     types: [agent-mention-opencode]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/audit-central-ruleset.yml

@@ -105,6 +105,18 @@ jobs:
           python3 scripts/ci/audit_central_required_workflows.py --stacked "$stacked_ruleset_json"
 
       - name: Audit organization CodeQL coverage
+        # Runs even when the ruleset step above failed. Those two audits share a
+        # job but not a subject: the ruleset step exits 1 on owner-configured
+        # governance drift, and on 2026-09-06 it did exactly that ("exactly two
+        # approving reviews are not required", "last-push approval protection is
+        # disabled"), which silently took this CodeQL coverage detector down with
+        # it -- every run since 2026-09-04 failed there and never reached this
+        # step. This step builds its own repository list into its own temp file
+        # and the step above exports nothing to GITHUB_ENV or GITHUB_OUTPUT, so
+        # it has no data dependency to lose. The job still fails overall; what
+        # changes is that a coverage gap is reported instead of hidden behind an
+        # unrelated failure.
+        if: always()
         env:
           ORG_LOGIN: ContextualWisdomLab
           ORG_WIDE_CREDENTIAL_AVAILABLE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' }}
@@ -165,13 +177,21 @@ jobs:
           printf '[]\n' >"$coverage_json"
           while IFS=$'\t' read -r repository archived; do
             default_setup_state=null
+            # `state` alone is not coverage: a repository can report
+            # "configured" with an empty `languages` list, which scans nothing
+            # and produces no analyses (measured 2026-09-07 on life-os, aFIPC
+            # and inkspan). Collect both fields so the audit can tell those
+            # apart from a setup that actually covers a language.
+            default_setup_languages=null
             if [ "$archived" != "true" ]; then
-              default_setup_state_json="$RUNNER_TEMP/codeql-default-setup-${repository//[^A-Za-z0-9_.-]/_}.json"
-              if gh api "repos/${ORG_LOGIN}/${repository}/code-scanning/default-setup" --jq .state \
-                >"$default_setup_state_json" 2>/dev/null; then
-                default_setup_state=$(jq -R '.' "$default_setup_state_json")
+              default_setup_json="$RUNNER_TEMP/codeql-default-setup-${repository//[^A-Za-z0-9_.-]/_}.json"
+              if gh api "repos/${ORG_LOGIN}/${repository}/code-scanning/default-setup" \
+                >"$default_setup_json" 2>/dev/null; then
+                default_setup_state=$(jq '.state // null' "$default_setup_json")
+                default_setup_languages=$(jq '.languages // []' "$default_setup_json")
               else
                 default_setup_state=null
+                default_setup_languages=null
               fi
             fi
 
@@ -187,12 +207,13 @@ jobs:
               fi
             fi
 
-            echo "CODEQL_COVERAGE repository=${repository} archived=${archived} default_setup_state=${default_setup_state} latest_codeql_analysis=${latest_codeql_analysis}"
+            echo "CODEQL_COVERAGE repository=${repository} archived=${archived} default_setup_state=${default_setup_state} default_setup_languages=${default_setup_languages} latest_codeql_analysis=${latest_codeql_analysis}"
             jq --arg name "$repository" \
               --argjson archived "$archived" \
               --argjson default_setup_state "$default_setup_state" \
+              --argjson default_setup_languages "$default_setup_languages" \
               --argjson latest_codeql_analysis "$latest_codeql_analysis" \
-              '. + [{name: $name, archived: $archived, default_setup_state: $default_setup_state, latest_codeql_analysis: $latest_codeql_analysis}]' \
+              '. + [{name: $name, archived: $archived, default_setup_state: $default_setup_state, default_setup_languages: $default_setup_languages, latest_codeql_analysis: $latest_codeql_analysis}]' \
               "$coverage_json" >"${coverage_json}.next"
             mv "${coverage_json}.next" "$coverage_json"
           done < <(jq -r '.[] | [.name, (.archived | tostring)] | @tsv' "$repositories_json")