[seonghobae]

CodeQL direct-SARIF publication — source only / operational HOLD

Publication boundary

This Draft publishes the independently assessed source only. Do not mark Ready, merge, enable auto-merge, dispatch/rerun CodeQL, or activate this handler while the operational holds below remain. Parent remains the sole S1 executor. Source publicity in this central public repository is authorized; no credentials, installed App grants, runner configuration, retention policy, artifact deletion, protection, or deployment is changed by this publication.

The modified workflow remains subscribed only to repository_dispatch (codeql-scan / codeql-scan-v2) and executes from the protected default branch. This feature-branch push does not match a native push trigger. Draft is intentional: the existing codeql-pr.yml draft guard skips language detection and its dispatch coordinator, Strix and merge-scheduler opened-event jobs are draft guarded, and OpenCode checks live Draft before requesting review dispatch. Noema skips model/sidecar preparation on its live-Draft gate. Existing metadata/bootstrap/coverage jobs may materialize; this is not a zero-jobs claim. No manual workflow dispatch or reviewer request is part of this publication.

A later protected adoption of this workflow would make it available to subsequent ordinary repository_dispatch events across consumers. A source merge is therefore not an operationally inert transition: retain the activation hold until the existing custody and capability owners admit it, or independently review a default-off activation fence first.

Exact source custody

Item	Identity
Source base / sole parent	6a03ae990eb4769869f4f77970cc21ed35141e09
Published commit	7bc2f507889a3f523c3df31ace13614792ae7d2c
Complete independently reviewed tree	46fd2145f28960ce8e9995271818f52e057b626d
Complete native full-index patch SHA-256	c329e66007fd0ddfa978eb05f2f8f61deeb5334baf2db3b50e06f1467c76c5c5
Independent R1 closure report SHA-256	9859ee5e539ae0b4460efc6180a3f803d67cb49f83596c7d1bad57a65523a837
Helper SHA-256	7bac0a40a93d3f72cb40a51abf070e977c5526282c0f0748ae4c26b5f406a164
Helper test SHA-256	a9c6d8455b72c98e2cd6b3a1b176eb0b225080f53b5a5dfeb05993abd3b09bdd

All 831 leaf paths/modes/bytes and the portable source archive were checked against native Git. Applying the sealed five-path patch to the exact base reconstructed the stated tree. The committed tree, not a dirty index, is the publication payload. No source adaptation or test replay was needed: fresh protected main is still the original base.

Repair and verified scope

• Replace quota-failing Actions CreateArtifact SARIF transport with the supported target code-scanning SARIF API; keep original/upload/processed evidence distinct, one POST, no ambiguous-ACK replay, complete processing and exact upload-associated analysis readback.
• Preserve Medium/GHAS gates, exact receipt/run/attempt/language/source identities, receiver, fixed diagnostic and separate read/status/wake/upload authority. A permission declaration is not proof of an accepted installed target capability.
• R1 closure syncs the custody namespace parents through the first existing anchor before evidence/intent/POST, preserving the existing file and leaf-directory fsyncs and exclusive retry refusal.
• Independent two-path R1 delta review: SOURCEPASS, no blocking source finding. The inherited whole-CodeQL assessment is reused only for unchanged bytes; the prior R1 NONPASS is preserved and closed, not erased.

Retained actual local evidence, read back against exact source/log/JUnit/exit receipts:

Check	Result
Twelve-file CodeQL cohort including additions	436 passed; 0 failures/errors/skips; exit 0
Helper coverage	86 passed; 265/265 statements and 104/104 branches, no excluded/missed/partial
New R1 regressions	24 passed, including 21 pre-POST fsync faults with zero synthetic API calls and no replay
Independent adversarial controls	34 passed
Actual extracted settlement shell controls	20 passed; every negative zero fake wake POSTs
Full actionlint with repository configuration and no exclusions	exit 0

The overlapping cohorts total 493 unique green identities / 603 executions, not 603 unique cases. The independent delta reviewer freshly exercised only the bounded 27 identities on predecessor/successor plus collection and coverage-data readback; the complete 436/86 cohorts were not relabeled as fresh. No real runner, real SARIF POST, S1, power-loss/crash simulation, or hosted CI acceptance is claimed by these receipts.

Source-owner reconciliation

Fresh all-436-open-PR inventories, including every paginated file tail, found no existing addition of this helper/test/runbook. Historical shared CodeQL paths remain owned by their existing lanes. In particular #2657 remains OPEN at e04587abd3cdd228651bf8b64d71a5efd6f29efc; its live-base-ref repair and owner are not superseded, edited, merged, or absorbed here.

Native composition of this exact candidate with #2657 is conflict free at tree b7eb0382b35d896004b4fff3d3cf5f63cf3f7a00. Reversing only this sealed candidate patch recovers #2657's entire tree exactly. This is source composition evidence only; union tests were NOT_RUN and peer adoption is not claimed. Any later adoption must re-fence main and #2657 and execute newly invalidated composition controls through the existing owner.

Operational gates — HOLD, not present

• Assigned-host / persistent-volume original-byte survival, including ephemeral-worker teardown.
• Existing lifecycle owner's backup and minimum seven-day retention admission. Host-local fsync, authenticated logs and fresh processed-analysis GETs do not discharge it. No retention setting is changed here.
• Accepted target-scoped security-events: write App/installation capability, distinct from analysis-read, status and lifecycle tokens. It is not established by this source or a successful read.
• The nonblocking analysis-0.json integrity-scope observation remains: do not claim all-file metadata hashing.

Exact next normal-adoption action: parent/source owner first keeps this Draft and resolves the assigned-host custody/backup/seven-day and target-write capability holds (or obtains a separately independently reviewed default-off activation fence). Then re-fetch current main and #2657, reconcile only changed source/composition inputs, and use the normal exact-head review/check/Ready/protected-adoption route without bypass or force. Ready can itself start existing CodeQL dispatch; only the parent may release that execution. Publication is not approval, protected shipment, or operational activation.

Refs #2657. No issue is closed by this source-only PR.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}