fix(ci): retire queued runs when PR returns to Draft

[seonghobae]

Current admission authority — 2026-10-01

• Exact head: 3d2656bae0e38ce38c331037f0938b97bd4688cb; tree: c7f93c58c372c1519c48786273cecc242a70c770; base: #2536@6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3.
• GitHub reports open, Draft, and mechanically mergeable; current scope is 21 files / 48 commits.
• This exact head is the canonical single-writer authority for the combined CodeQL Draft-event matrix, central stale-dispatch retirement, and corrected stacked required-workflow scope. Active ruleset 18156473 remains default-branch-only; feature-base stacked PRs do not gain central Security, SAST, or CodeQL admission by trigger broadening alone.
• Dependent fix(codeql): materialize draft consumer heads #2548 ordinarily integrated this exact owner head as its second parent at 2792c8512741f53632196e889778de82785d669e. It is mergeable, ahead 5 / behind 0, and preserves its 14-file security, Maturin, CHANGELOG, Gap, and lifecycle delta.
• Exact-head Draft-event Security 36859703947, SAST 36859703794, and CodeQL 36859703869 are SKIPPED; skipped is lifecycle evidence, not acceptance.
• Reviews API has one COMMENTED predecessor submission, zero APPROVED submissions, and zero threads. State remains Draft / Proposed / merge HOLD pending fresh non-skipped exact-head Checks and a qualifying independent current-head approval.

Incident

A fresh organization-wide sample found that CodeQL PR, SAST Semgrep, Security Scan, and Python Security runs could remain queued after the pull request was converted back to Draft. The workflows had per-PR cancel-in-progress: true groups and ready_for_review triggers, but no converted_to_draft trigger, so the Draft transition could not enter the same concurrency group and retire the stale Ready run.

RED

Added test_converted_to_draft_retires_queued_run_without_runner first.

4 failed in 0.37s

All four failures were the intended missing-event assertion.

GREEN

• subscribe the four workflows to converted_to_draft;
• require every entry job to observe github.event.pull_request.draft != true;
• preserve existing per-PR concurrency, permissions, scanner thresholds, and Ready-head behavior;
• record the incident and rejected alternatives in the doctoring note and changelog fragment.

Local contract evidence:

4 passed in 0.07s
14 passed in 0.46s

Safety

The replacement Draft event reaches workflow-level concurrency and cancels the older same-PR run, then skips before runner admission. No required result is synthesized, no failed check is rerun or changed to success, and no model/provider path is introduced. No force push, destructive rebase, bypass, or merge was performed.

Acceptance

Ready is review admission only. Hosted exact-head checks and independent review remain mandatory before merge. After ordinary protected merge, verify one live Draft transition retires the older queued run for all four workflows without assigning a runner.

Stack repair (2026-09-30)

Retargeted from main@37b10243cec3d160ecc9c1be75c71428b160a703 to canonical security prerequisite #2531 (codex/security-baseline-final-20260930@d1aa3659fca527a6c7330151f3ab4df3d7578391). The semantic source tree remains unchanged from f1823128a51d74590eec524e183a09fcbdd47f0f. A single empty fast-forward commit bf8acdc6855e854692b4bf940b97490400a9b33d refreshed Checks on the new base; no force update, approval, or merge was performed. Prior Python Security/Trivy failures were the inherited vulnerable PyJWT/PyO3 base and are not current-head GREEN evidence. Fresh mergeability and hosted Checks are required on the new stack.

Current owner-stack integration (2026-10-01)

• exact head: 76aa57533b1332af2d3976e32437dba70fafe47a
• canonical prerequisite: .github#2536@18c886cbb8c41f5f9c2bcae99640b97d53a4806e
• ancestry: ordinary two-parent integration preserves prior fix(ci): retire queued runs when PR returns to Draft #2537 head bf8acdc6855e854692b4bf940b97490400a9b33d and adopts the exact security/coverage owner head as the second parent
• effective prerequisite-relative delta: the original seven queue-retirement paths only; 11 ahead / 0 behind
• RCA: exact run 36710180872, job 109887107430, failed on PyO3 GHSA-36hh-v3qg-5jq4 and GHSA-chgr-c6px-7xpp; the canonical prerequisite already repairs and contracts those dependencies
• workflow-consumer suite: 672 passed; warnings-fatal repository suite: 5,259 passed, 5 optional skips, 40 subtests
• stale contract repair: the SAST single-consumer oracle now requires the full closed-and-Draft admission guard
• publication: ordinary single-parent fast-forward from cf8fa367a590c97a440e434731d469909920e4bc, tree 536bc45136c2c9ad406fac0dd54ec5caeb2f2ab2, force=false
• lifecycle: Ready only for fresh exact-head hosted Checks and independent review; ordinary merge remains HOLD

No predecessor result transfers. No force update, manual rerun, synthetic status, bypass, merge, or release was used.

Concurrent exact-head refresh (2026-10-01)

A concurrent ordinary child advanced this Draft PR from 76aa57533b1332af2d3976e32437dba70fafe47a to exact head 37ce2e405ab96963a59c96e4e98024ab1a51af32 (tree 6c8b45a22253260c5d25e1ce1683115bec37f4ef) to restore the queue-health credential fallback. The current head is a one-parent fast-forward, and canonical base #2536@18c886cbb8c41f5f9c2bcae99640b97d53a4806e is an ordinary ancestor. GitHub re-evaluation reports mergeable.

The effective base-relative delta remains bounded to the ten queue-retirement paths (+175/-18). Draft-event Security 36779949657, SAST 36779949766, and CodeQL 36779949579 are skipped and are not passing evidence. Keep Draft/Proposed; retarget or integrate the newer #2040 successor only after its exact-head Checks and ownership boundary stabilize, without copying mutable source or force-updating this active writer.

Latest review-authority restack (2026-10-01)

Exact head 0dacd79d00907c9c310a86f3a0cc423955eeb79c (tree 1d5a611b1c1ad63a451b5c0114ee4146c5993981) is an ordinary two-parent merge of prior #2537 head 37ce2e405ab96963a59c96e4e98024ab1a51af32 and current base owner #2536 head 6a37e4cdfbd8bf6f3a60645a0ad7c13e1b9c1ae3. The merge was conflict-free and preserves the complete ten-path queue-retirement delta while adopting the latest review-authority, Noema, Strix, and security contracts.

Fresh local exact-tree evidence: queue-retirement contracts 25 passed; integrated parent contracts 62 passed, 2 optional skips; unfiltered warning-fatal repository suite 5,261 passed, 5 optional skips, 40 subtests; the only changed production module reports 10/10 documented (100%); compileall, diff-check, conflict-index, ordered-parent, and tree-SHA verification pass. The branch remains Draft/Proposed. Fresh hosted exact-head evidence and an independent current-head approval are required before Ready or merge. No force update, bypass, manual rerun, synthetic status, or predecessor-GREEN transfer was used.

Stacked required-workflow scope correction (2026-10-01)

• exact head: 3d2656bae0e38ce38c331037f0938b97bd4688cb (ordinary child of f79c8f2e1d1a7d2e1db94ae3fbfc120aa827e716, tree c7f93c58c372c1519c48786273cecc242a70c770, force=false)
• RCA: base-ref-agnostic workflow triggers do not widen active ruleset 18156473 beyond ref_name.include=["~DEFAULT_BRANCH"]; feature-base stacked PRs therefore do not materialize central Security, SAST, or CodeQL through that ruleset
• RED: the new owner contract rejected the rollout document and all three misleading workflow comments
• GREEN: 94 scope, ruleset-audit, CodeQL, Security, docs-only, and Draft-admission contracts pass; git diff --check passes
• product Gap: CONTROL-STACKED-REQUIRED-WORKFLOW-SCOPE-01 records the causal owner, exact consumer canary ContextualWisdomLab/OpenCode#3@c15dabc5…, and the prerequisite-merge/retarget lifecycle
• lifecycle: this remains Draft / Proposed / merge HOLD; hosted exact-head Checks and a qualifying independent approval are still required

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e1e1ad13-f0ed-440d-bdc8-3790fe5a890f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head COMMENT review for f1823128a51d74590eec524e183a09fcbdd47f0f against main@37b10243cec3d160ecc9c1be75c71428b160a703. The four required workflows now subscribe to converted_to_draft, enter their existing per-PR concurrency group, and skip every ordinary entry job on a Draft payload before runner admission. Ready, push, schedule, and manual behavior remains governed by the existing conditions; scanner thresholds and permissions are unchanged. The executable contract covers all four workflow owners. I found no source-backed blocker in this exact diff. This COMMENT is not approval: four current exact-head runs are queued, earlier skipped replacements are not GREEN evidence, and qualifying independent approval is absent.

[seonghobae]

Fresh live confirmation of the incident boundary (2026-09-30): fast-mlsirm #2299 and #2301 were converted from Ready to Draft at unchanged exact heads ded3ad85e19061ff38a4f84604ed032ebbcf44f0 and e51a4d94244f3ae34688a2353f7483cc784c548c. Each conversion produced only a new skipped CI run (36710535442, 36710532709). It did not create a replacement CodeQL PR, SAST Semgrep, Security Scan, or Python Security run, so the prior failed CodeQL PR runs (36688833003, 36696423987) remain and their exact central dispatch runs (36708176563, 36709991599) are still queued. This is current operational evidence for the missing converted_to_draft admission path repaired here; it is not merge approval. Post-merge acceptance still requires observing all four replacement workflows retire stale queued work without runner admission.

[seonghobae]

stack-ordering을 current evidence에 맞춰 Ready→Draft/Proposed로 교정했습니다.

• child exact head: bf8acdc6855e854692b4bf940b97490400a9b33d
• prerequisite: fix(security): refresh shared PyJWT and PyO3 locks #2531 d1aa3659fca527a6c7330151f3ab4df3d7578391
• prerequisite는 exact-head CodeQL Python/Actions terminal failure와 미도착 후속 verdict 때문에 Draft입니다.
• 이 PR의 converted_to_draft queue-retirement delta와 tests/ancestry는 그대로 보존합니다.

부모가 ordinary protected merge 및 terminal GREEN을 획득하기 전에는 이 자식도 Ready/merge 후보가 아닙니다. Close, bypass, Force Push, destructive rebase, manual rerun은 수행하지 않았습니다.

[seonghobae]

Concurrent owner finding for exact head 8ea475074603fa284ad2fc8c620638dda9278a39: #2548 now edits the same CodeQL workflow and Draft-admission test with an incompatible policy. This PR's converted_to_draft trigger is valid queue-retirement delta; #2548's consumer Draft materialization addresses a separate real gap. Neither may overwrite the other.

Resolve as one single-writer event contract, with RED fixtures for: (1) consumer Draft heads materialize CodeQL, (2) a transition back to Draft enters the same concurrency group and cancels stale Ready work without assigning a new scan, (3) native .github Drafts avoid unnecessary runner admission where intended, and (4) closed events remain excluded. Keep Draft / Proposed and preserve both semantic deltas through ordinary integration; no force update, simple Close, or predecessor-evidence transfer.

[seonghobae]

Canonical current-head receipt

Head f6dfbd84d9378a2e40dc31fed6f4eebe21732ab2 is the active queue-retirement / CodeQL Draft-event owner. It reconciles the consumer-Draft, native-owner-Draft, conversion, and close cases in one executable matrix. Exact-head runs 36842150755, 36842150550, and 36842150684 are skipped because this PR is Draft and are not acceptance evidence. Dependent #2548 integrated this head by ordinary ancestry at cf1dccdd33ab7b3e0f20afac178d9bb316790dbd. Keep Draft / Proposed / merge HOLD; no force update, bypass, status synthesis, or predecessor approval transfer.

[seonghobae]

Current authority — central stale-dispatch retirement

Exact head f79c8f2e1d1a7d2e1db94ae3fbfc120aa827e716 (tree fe6dea41620196db2590dcc93ad31d1b9ccc50a0) is an ordinary one-parent fast-forward from f6dfbd84d9378a2e40dc31fed6f4eebe21732ab2; publication used force=false.

RCA repaired at the canonical .github owner:

• Draft previously returned before central cleanup, and closed PRs never reached the open-PR loop.
• Central CodeQL/OpenCode/Strix runs are now recognized only by exact protected workflow path plus repository/PR/40-SHA run-name identity.
• Inventory and destructive-boundary revalidation cover queued, in_progress, waiting, pending, and requested.
• Cancellation is authorized only after fresh run + PR reads prove a closed target or head mismatch. Current-head, malformed, unrelated, or unreadable authority is preserved.
• Cleanup is bounded to the transition event's one PR. Consumer github.token is not treated as central Actions authority; without an explicit organization token the operation fails closed.
• converted_to_draft and closed may use the scheduler control job only for cleanup; closed inspection returns before review, branch update, auto-merge, or merge paths.

Exact-tree local evidence:

• full warnings-fatal suite: 5,281 passed, 5 skipped, 40 subtests;
• focused owner/admission suite: 458 passed;
• branch coverage: 18,334 statements / 7,544 branches = 100%;
• Strix quick gate: PASS;
• Ruff E9/F/I, compileall, and diff-check: PASS.

Post-publication GitHub reports open, Draft, and mechanically mergeable. Exact-head CodeQL/SAST entry work is skipped under the current Draft contract; OpenCode/Noema are queued and Strix transport is in progress. These are nonterminal/skipped lifecycle records, not acceptance evidence. Keep Draft / Proposed / merge HOLD until fresh hosted exact-head terminal evidence and a qualifying independent approval exist. No rerun, synthesized status, bypass, force update, Close, or merge was used.

[seonghobae]

Cross-repository runtime evidence — Draft queue retirement

Fresh consumer evidence confirms this owner defect on an independently deployed repository:

• Consumer: ContextualWisdomLab/opencode#3
• Exact head: c15dabc57a495ecb5e324b7ae4fe50c255212ab9
• Native workflow: test run 36853164446, .github/workflows/test.yml
• Run creation: 2026-10-01 11:05:22 UTC; last platform update: 11:05:23 UTC
• Four jobs remain queued with no runner assigned: unit (linux), unit (windows), e2e (linux), e2e (windows)
• PR Add Superset workspace config #3 was converted to Draft at 11:59 UTC for its unready mutable prerequisite; a fresh post-transition refetch still shows the same four jobs queued.

This is queue-waste evidence, not acceptance evidence and not a request for a synthetic rerun/cancellation event. The consumer must not copy this owner workflow. The existing exact-head #2537 repair remains the canonical RED→GREEN path; integration/release/consumer rollout must retire such queued work automatically on future Draft transitions. #2537 remains Draft/Proposed on mutable prerequisite #2536, so this evidence does not authorize Ready, merge, bypass, or predecessor closure.

[seonghobae]

New exact reproduction for the queue-retirement owner — consumer ContextualWisdomLab/fast-mlsirm#2296@5ce544e2b063399fbbf72cf75d58d8abfe8853f1.

• Ready CI run 36866529373 had active Python 3.12/3.14, Rust, and focal-GPU jobs.
• The necessary Ready → Draft correction produced the lifecycle event and GitHub cancelled those active jobs without a manual cancellation.
• The superseded Ready payload still allowed aggregate job 110386530075 (python) to execute under always(); step Require every CPython matrix leg and actual GPU evidence then failed because its required dependencies were cancelled.
• Exact workflow source subscribes to converted_to_draft and uses per-PR cancel-in-progress, but the aggregate guard is evaluated from the stale Ready event payload. It does not suppress the superseded aggregate when needs.python-matrix.result / needs.focal-gpu-native.result is cancelled.

This extends the stale-event acceptance contract: retirement must cancel obsolete work without emitting a false terminal failure from an always() aggregate on the superseded generation. The consumer run is evidence only; do not copy a mutable owner implementation into consumers or treat cancellation as source-test failure. Add owner RED coverage for a required aggregate with cancelled needs, repair it centrally, obtain exact-head GREEN and an immutable owner release, then bump consumers normally.

No rerun, wake commit, synthetic status, bypass, merge, or evidence relabeling was performed.

[seonghobae]

Valid #2537 CodeQL admission repair has been carried into the canonical owner-union PR #2549 without retiring this predecessor.

• fix(ci): retire queued runs when PR returns to Draft #2537 source repair remote commit: 9143d6e1430ebb4959a27a00e4288ae967ad308c
• source repair tree: 4f6c2264adee4a72f52eaf893610412a8ab06e4e (matches locally verified repair tree)
• fix(sbom): preserve publication tree authority #2549 current exact head: c8d8e1fc8f3f526ee621ac013cac6a8e816195a2
• fix(sbom): preserve publication tree authority #2549 exact tree: c12c09a196eb33e437c8689236f7ee353521406d
• fix(sbom): preserve publication tree authority #2549 ordered parents: prior owner head 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a and this repair 9143d6e1430ebb4959a27a00e4288ae967ad308c
• exact integrated-tree local evidence: 5,437 passed, 5 skipped, 40 subtests; 100% statement/branch coverage; 100% production docstrings; independent review 0 Critical / 0 Important

Both PRs remain open/Draft as applicable. This records the verified successor carry path only; it does not authorize closure, merge, bypass, or predecessor retirement.

[seonghobae]

Cross-repository admission RCA: LineageWeave#1142 exact head 921f2df9629b8fbdef707b04469b45b2a1ed6299, Security Scan run 36906546094, job 110518483146.

Exact checkout identity passed; osv-scan and Trivy passed; dependency-review's preflight compare endpoint returned HTTP 403 for public repository ContextualWisdomLab/LineageWeave (83eba561…921f2df…) and failed closed. Naruon at the same workflow generation reached the endpoint with HTTP 200, so this is repository-specific dependency-graph/API authorization/configuration, not a scanner queue or leaf source vulnerability. Please preserve fail-closed behavior and repair/provision the exact-revision evidence capability at the canonical owner; do not wake/rerun the consumer until the cause changes.

[seonghobae]

Fresh canonical queue/verdict evidence for current owner head 3d2656bae0e38ce38c331037f0938b97bd4688cb.

Four current-head consumers now show the same boundary: dispatch succeeds, then Python/Actions compatibility jobs fail at “Release runner or enforce current-head CodeQL verdict” because no authenticated terminal verdict settled.

• .github ci: gate what a package's registry page will actually show #2261 5f71d5f0…: CodeQL PR 36873538750; dispatch 110407534397 GREEN, enforcement jobs 110407190249 / 110407190617 RED.
• .github fix(ci): restore inherited coverage and docstring gates #2550 4743e7f8…: CodeQL PR 36872425316; dispatch 110403499053 GREEN, enforcement jobs 110403398483 / 110403398648 RED.
• fast-mlsirm fix(gitleaks): honor lone string classifications as one label #2070 d42f64a0…: CodeQL PR 36892998059; dispatch 110474201970 GREEN, enforcement jobs 110473891881 / 110473891844 RED.
• fast-mlsirm security(attestation): bind immutable artifact size in scientific-validation receipt #2314 0538c1ec…: CodeQL PR 36882464526; dispatch 110437854458 GREEN, enforcement jobs 110437628981 / 110437629028 RED.

Each consumer has successful standalone CodeQL/security evidence where applicable, but that does not satisfy this compatibility contract. All four are Draft/merge HOLD. This is queue/verdict admission evidence, not justification for source-neutral reruns or bypass.

[seonghobae]

Owner routing clarification for unchanged exact head 3d2656bae0e38ce38c331037f0938b97bd4688cb.

The two fresh cross-repository specimens do not expand this PR's single-writer scope:

• LineageWeave Dependency Review HTTP 403 evidence from comment 5937968326 is now preserved at canonical security-availability owner #810 comment 5938657534.
• Dispatch-success / missing terminal CodeQL verdict evidence from comment 5938121109 is now preserved at canonical terminal-publication owner #1929 comment 5938657919.

#2537 remains the Draft queue-retirement / stacked required-workflow-scope owner. No source, base, head, lifecycle, approval, or Check state changed; skipped Draft runs remain non-acceptance evidence.

[seonghobae]

Fresh consumer reproduction — exact-head evidence (2026-10-01 UTC)

No source or lifecycle mutation is requested by this note.

Consumer: ContextualWisdomLab/feelanet-adfs#30 at exact head 02af2ab368b45d676060c7c98b94c7622437271f, base 70c023a601ebc59599584f05503c834829517726.

• GitHub reports the consumer open, Ready, and mechanically mergeable.
• The repair push occurred while the consumer was Draft. It created the organization-required workflow generation for that exact head.
• Required CodeQL PR run 36911450601 is terminal SKIPPED: Detect CodeQL languages, compatibility analysis, and current-head dispatch all skipped.
• Required Security Scan 36911450746 and SAST Semgrep 36911450456 are GREEN. Native dynamic CodeQL 36911445353 is also GREEN, but it is not a substitute for the ruleset-required CodeQL workflow identity.
• Timeline event ready_for_review (32280631723) was recorded at 2026-10-01T19:04:31Z; no fresh required-workflow CodeQL run materialized for the unchanged head afterward.

This is a live post-RED consumer reproduction of the failure scene already codified here by test_codeql_materializes_only_consumer_draft_heads and docs/doctoring/codeql-draft-ready-materialization.md. The existing owner repair—materialize CodeQL evidence for consumer Draft heads while retaining native-owner Draft runner savings—is therefore the causal delta. It is already present in this exact PR head and completely carried into the owner-union successor #2549; creating another repair would violate single-writer/delta-integration discipline.

State remains Draft / Proposed / merge HOLD. No force update, manual rerun, synthetic status, bypass, Draft/Ready toggle, merge, or replacement event generation was used. Model-review Ready-event materialization remains separately owned and is not smuggled into this CodeQL delta.

[seonghobae]

Exact-head Ready admission — 2026-10-02

Direct current-delta review found no new Critical/Important source finding, and all review threads remain resolved. The unchanged exact head 3d2656bae0e38ce38c331037f0938b97bd4688cb was therefore moved from Draft to Ready only to admit independent review and non-skipped hosted Checks; this is not approval or merge authorization.

Fresh exact-head results:

• Security Scan 36932346194: SUCCESS
• SAST Semgrep 36932346232: SUCCESS
• CodeQL PR 36932346245: not GREEN
  • Python job 110604564777: DISPATCH_OUTCOME=success, VERDICT_STATE=pending
  • Actions job 110604564842: DISPATCH_OUTCOME=success, VERDICT_STATE=pending

The authenticated coordinator dispatched successfully; both shards remain fail-closed until terminal GHAS/SARIF verdict settlement reruns those exact jobs. Qualifying approvals remain 0. No manual rerun, state cycling, synthetic result, auto-merge, or predecessor evidence transfer was used.

[seonghobae]

2026-10-02 exact-head lifecycle correction

• Exact head remains 3d2656bae0e38ce38c331037f0938b97bd4688cb; no source/ref mutation occurred.
• Ready admission is not valid yet: CodeQL PR run 36932346245 completed failure for both python job 110604564777 and actions job 110604564842.
• Both exact logs record DISPATCH_OUTCOME=success and VERDICT_STATE=pending; the authenticated terminal dispatch verdict has not been published. Security Scan and SAST are GREEN, but they do not replace CodeQL.
• The PR is therefore returned to Draft / Proposed / merge HOLD. Its valid delta and stack remain open; no rerun, no-op commit, bypass, merge, auto-merge, release, or closure is used.