chore(security): integrate protected main into dependency-review owner

.github/actions/orchestrator-free-sidecar/action.yml

@@ -6,9 +6,9 @@ inputs:
     required: false
     default: "false"
   catalog_limit:
-    description: Maximum discovered route catalog size for the sidecar preflight.
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
     required: false
-    default: "12"
+    default: "24"
   catalog_account_cap:
     description: Maximum routes admitted from one credential account.
     required: false

.github/workflows/agent-mention-noema-dispatch.yml

@@ -9,9 +9,18 @@ on:
     types: [agent-mention-noema]
 
 concurrency:
-  group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
-  cancel-in-progress: false
-  queue: max
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -9,9 +9,18 @@ on:
     types: [agent-mention-opencode]
 
 concurrency:
-  group: agent-mention-opencode-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
-  cancel-in-progress: false
-  queue: max
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -29,7 +29,7 @@ on:
       - "requirements-opencode-review-ci-hashes.txt"
 
 concurrency:
-  group: agent-mention-router-quality-${{ github.event.pull_request.number || github.ref }}
+  group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:

.github/workflows/agent-mention-router.yml

@@ -27,8 +27,8 @@ jobs:
         || contains(github.event.comment.body, '/oc')
       )
     concurrency:
-      group: review-agent-mention-router-local-${{ github.repository }}
-      queue: max
+      group: review-agent-mention-router-local-${{ github.repository }}-${{ github.event.issue.number || github.run_id }}
+      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/audit-central-ruleset.yml

@@ -10,14 +10,17 @@ on:
     paths:
       - ".github/workflows/audit-central-ruleset.yml"
       - "scripts/ci/audit_central_required_workflows.py"
+      - "scripts/ci/audit_org_codeql_coverage.py"
+      - "scripts/ci/bootstrap_codeql_pull_requests.py"
       - "docs/org-required-workflow-rollout.md"
 
 concurrency:
-  group: central-required-workflow-ruleset-audit
+  group: central-required-workflow-ruleset-audit-${{ github.event_name == 'repository_dispatch' && github.event.action || github.event_name }}
   cancel-in-progress: true
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   audit:
@@ -100,3 +103,150 @@ jobs:
             exit 1
           fi
           python3 scripts/ci/audit_central_required_workflows.py --stacked "$stacked_ruleset_json"
+
+      - name: Audit organization CodeQL coverage
+        # Runs even when the ruleset step above failed. Those two audits share a
+        # job but not a subject: the ruleset step exits 1 on owner-configured
+        # governance drift, and on 2026-09-06 it did exactly that ("exactly two
+        # approving reviews are not required", "last-push approval protection is
+        # disabled"), which silently took this CodeQL coverage detector down with
+        # it -- every run since 2026-09-04 failed there and never reached this
+        # step. This step builds its own repository list into its own temp file
+        # and the step above exports nothing to GITHUB_ENV or GITHUB_OUTPUT, so
+        # it has no data dependency to lose. The job still fails overall; what
+        # changes is that a coverage gap is reported instead of hidden behind an
+        # unrelated failure.
+        if: always()
+        env:
+          ORG_LOGIN: ContextualWisdomLab
+          ORG_WIDE_CREDENTIAL_AVAILABLE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' }}
+        run: |
+          set -euo pipefail
+
+          if [ "$ORG_WIDE_CREDENTIAL_AVAILABLE" = "false" ]; then
+            echo "::error::CodeQL coverage audit requires an org-scoped credential (PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN) to reliably enumerate private organization repositories; the repository-scoped github.token fallback cannot see them, which would silently narrow this audit to a subset of the organization."
+            exit 1
+          fi
+
+          repositories_json="$RUNNER_TEMP/codeql-coverage-organization-repositories.json"
+          coverage_json="$RUNNER_TEMP/codeql-coverage-repositories.json"
+
+          if ! gh api --paginate "orgs/${ORG_LOGIN}/repos?type=all&per_page=100" \
+            | jq -s 'add | map({name, archived}) | unique_by(.name) | sort_by(.name)' >"$repositories_json"; then
+            echo "::error::CodeQL coverage audit could not enumerate organization repositories for ${ORG_LOGIN}."
+            exit 1
+          fi
+
+          # ORG_WIDE_CREDENTIAL_AVAILABLE above only proves some org-scoped
+          # secret exists, not that the specific credential actually used
+          # (PR_REVIEW_MERGE_TOKEN when present) has complete repository
+          # visibility: docs/org-required-workflow-rollout.md's
+          # "Inaccessible-repository posture" entry already documents that
+          # PR_REVIEW_MERGE_TOKEN may be a fine-grained credential with an
+          # explicit repository allowlist rather than truly org-wide -- "a
+          # sibling repository the sweep credential structurally cannot
+          # read -- the OpenCode app is not installed there, or
+          # PR_REVIEW_MERGE_TOKEN does not cover it -- returns HTTP 403".
+          # That per-repo-read pattern doesn't apply here though: the
+          # enumeration call directly above IS the discovery mechanism, so a
+          # credential missing coverage does not 403 -- it just silently
+          # returns a smaller list, with excluded repositories never
+          # appearing at all and no per-repo error to catch. These three
+          # repositories are confirmed (2026-09-03, `gh api
+          # repos/ContextualWisdomLab/<name> --jq '{private,archived}'`) to
+          # be private and non-archived, so their absence from the
+          # enumerated list is real evidence of incomplete credential scope.
+          # If one is ever deleted, made public, or archived, swap in
+          # another confirmed private, non-archived repository here.
+          PRIVATE_REPOSITORY_COVERAGE_SENTINELS=(
+            "xtrmLLMBatchPython"
+            "linux-cluster-ops"
+            "gyeot"
+          )
+          missing_sentinels=()
+          for sentinel in "${PRIVATE_REPOSITORY_COVERAGE_SENTINELS[@]}"; do
+            if ! jq -e --arg name "$sentinel" 'any(.[]; .name == $name)' "$repositories_json" >/dev/null; then
+              missing_sentinels+=("$sentinel")
+            fi
+          done
+          if [ "${#missing_sentinels[@]}" -gt 0 ]; then
+            echo "::error::CodeQL coverage audit's organization repository enumeration is missing known-private sentinel repository(ies): ${missing_sentinels[*]}. This means the credential used for this step cannot see the full organization -- PR_REVIEW_MERGE_TOKEN may be a fine-grained credential scoped to a repository allowlist rather than org-wide (see docs/org-required-workflow-rollout.md, 'Inaccessible-repository posture'). Unlike a per-repository 403, an incomplete-coverage credential does not fail this enumeration call; it silently returns a smaller repository list, so this audit would otherwise pass while covering only a subset of the organization. Fix the credential's scope/allowlist rather than ignoring this failure."
+            exit 1
+          fi
+
+          printf '[]\n' >"$coverage_json"
+          while IFS=$'\t' read -r repository archived; do
+            default_setup_state=null
+            # `state` alone is not coverage: a repository can report
+            # "configured" with an empty `languages` list, which scans nothing
+            # and produces no analyses (measured 2026-09-07 on life-os, aFIPC
+            # and inkspan). Collect both fields so the audit can tell those
+            # apart from a setup that actually covers a language.
+            default_setup_languages=null
+            if [ "$archived" != "true" ]; then
+              default_setup_json="$RUNNER_TEMP/codeql-default-setup-${repository//[^A-Za-z0-9_.-]/_}.json"
+              if gh api "repos/${ORG_LOGIN}/${repository}/code-scanning/default-setup" \
+                >"$default_setup_json" 2>/dev/null; then
+                default_setup_state=$(jq '.state // null' "$default_setup_json")
+                default_setup_languages=$(jq '.languages // []' "$default_setup_json")
+              else
+                default_setup_state=null
+                default_setup_languages=null
+              fi
+            fi
+
+            latest_codeql_analysis=null
+            if [ "$archived" != "true" ]; then
+              analysis_json="$RUNNER_TEMP/codeql-analysis-${repository//[^A-Za-z0-9_.-]/_}.json"
+              if gh api "repos/${ORG_LOGIN}/${repository}/code-scanning/analyses?tool_name=CodeQL&per_page=1" \
+                --jq '.[0] | if . then {created_at, error} else null end' \
+                >"$analysis_json" 2>/dev/null; then
+                latest_codeql_analysis=$(cat "$analysis_json")
+              else
+                latest_codeql_analysis=null
+              fi
+            fi
+
+            echo "CODEQL_COVERAGE repository=${repository} archived=${archived} default_setup_state=${default_setup_state} default_setup_languages=${default_setup_languages} latest_codeql_analysis=${latest_codeql_analysis}"
+            jq --arg name "$repository" \
+              --argjson archived "$archived" \
+              --argjson default_setup_state "$default_setup_state" \
+              --argjson default_setup_languages "$default_setup_languages" \
+              --argjson latest_codeql_analysis "$latest_codeql_analysis" \
+              '. + [{name: $name, archived: $archived, default_setup_state: $default_setup_state, default_setup_languages: $default_setup_languages, latest_codeql_analysis: $latest_codeql_analysis}]' \
+              "$coverage_json" >"${coverage_json}.next"
+            mv "${coverage_json}.next" "$coverage_json"
+          done < <(jq -r '.[] | [.name, (.archived | tostring)] | @tsv' "$repositories_json")
+
+      - name: Exchange OpenCode app token for CodeQL setup writes
+        id: opencode_app_token
+        env:
+          OIDC_AUDIENCE: opencode-github-action
+          OPENCODE_API_BASE_URL: https://api.opencode.ai
+        run: |
+          set -euo pipefail
+          request_url="$ACTIONS_ID_TOKEN_REQUEST_URL"
+          separator='&'
+          [[ "$request_url" == *\?* ]] || separator='?'
+          oidc_token="$(curl -fsS --connect-timeout 5 --max-time 20 \
+            -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+            "${request_url}${separator}audience=${OIDC_AUDIENCE}" | jq -r '.value // empty')"
+          [ -n "$oidc_token" ] || { echo "::error::OpenCode OIDC token was empty."; exit 1; }
+          app_token="$(curl -fsS --connect-timeout 5 --max-time 20 -X POST \
+            -H "Authorization: Bearer ${oidc_token}" \
+            "${OPENCODE_API_BASE_URL}/exchange_github_app_token" | jq -r '.token // empty')"
+          [ -n "$app_token" ] || { echo "::error::OpenCode installation token was empty."; exit 1; }
+          echo "::add-mask::$app_token"
+          {
+            echo "token<<OPENCODE_TOKEN"
+            echo "$app_token"
+            echo "OPENCODE_TOKEN"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create missing CodeQL setup pull requests
+        env:
+          OPENCODE_APP_TOKEN: ${{ steps.opencode_app_token.outputs.token }}
+        run: |
+          set -euo pipefail
+          python3 scripts/ci/bootstrap_codeql_pull_requests.py "$RUNNER_TEMP/codeql-coverage-repositories.json"
+          python3 scripts/ci/audit_org_codeql_coverage.py "$RUNNER_TEMP/codeql-coverage-repositories.json"

.github/workflows/cloudflare-dns.yml

@@ -35,7 +35,7 @@ on:
 # the older validation run. Trusted push/dispatch reconciliation keeps its
 # non-cancelling behavior so an in-flight write is never interrupted midway.
 concurrency:
-  group: cloudflare-dns-${{ github.event.pull_request.number || github.ref }}
+  group: cloudflare-dns-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions: