From 1f3643a4f4465e474ced018bc51df6afa0910a57 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:23:53 +0200
Subject: [PATCH] Stop the CodeQL row promising a verdict the section below
 leaves open (#26)

What was wrong. The `CodeQL` row sent a reader to the section on which contexts
arrive for which of the two strings a required set can hold, and that section
says of the upload-derived name that the question is open. Read at `origin/main`,
which is `1593bb1` as this is written:

    git show origin/main:docs/quality-parity.md | sed -n '286,291p'
    No pull request from a fork has been opened here. The condition above has two
    arms and only the second was walked: the branch measured above is in this
    repository, and a read-only token is what the two arms have in common rather
    than what makes them one route. `CodeQL` did arrive on that pull request, so
    nothing here says whether it arrives from a fork, and the fork clause of #62 is
    open for it.

So the section answers the `zizmor` case and leaves the `CodeQL` case standing.
The neighbouring row is accurate because a measurement in that same section
decides against the upload name there, and this row was written as though the
same work had been done for both.

What it costs the set. The required set issue #26 assembles is taken from this
document, and a name the document sends somewhere that gives it no verdict is in
the same condition as a name with no row at all: it reads as kept or as dropped
with equal justice, and the two readings produce two different gates. The sweep
that gave five names a verdict cannot find this one, because it asks whether the
literal is present and the literal is present:

    git grep -h -oE '\{Name: "[^"]+"' origin/main \
      -- internal/contexts/contexts.go | sed 's/{Name: "//; s/"$//' | sort -u \
      | while read -r n; do
          git grep -q -F "$n" origin/main -- docs/quality-parity.md \
            || echo "no literal in doc: $n"
        done | grep -i codeql ; echo "exit=$?"
    exit=1

How it was found. By following the row's own pointer into the section while
walking the first clause of #26, rather than by the sweep above.

What this changes. The row names both strings, says that which of the two a
required set can hold is open rather than settled below, and names the issue
holding the walk that would settle it. It decides nothing. The fork route is
still unwalked and this change does not walk it.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 docs/quality-parity.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/quality-parity.md b/docs/quality-parity.md
index 6351098..f3ce080 100644
--- a/docs/quality-parity.md
+++ b/docs/quality-parity.md
@@ -53,7 +53,7 @@ today no tick does.
 | `ABI floor build` | Dropped | It exists so a plugin loads against the oldest server it claims to support, and nothing here loads into a host. |
 | `Package (JPRM) / Build package` | Dropped | This repository ships no plugin, so there is no package to build. |
 | `Package (JPRM) / Generate SBOM` | Kept in substance, moved out of the gate | A bill of materials is owed for anything downloadable, and this one is produced by the release build rather than by a check on a pull request. Issue #37 builds it and nothing in this tree produces one today. |
-| `CodeQL` | Kept, retargeted | Static analysis of the runner's own source, in the language record `0001` chose rather than in C#. Two strings arrive here for it, the job's and the code-scanning upload's, and the section on which contexts arrive says which of the two a required set can hold. |
+| `CodeQL` | Kept, retargeted | Static analysis of the runner's own source, in the language record `0001` chose rather than in C#. Two strings arrive here for it, the analysis job's `CodeQL (go)` and the code-scanning upload's `CodeQL`. Which of the two a required set can hold is open rather than decided below: the section on which contexts arrive separates the strings, and says of the upload name that the route which would decide it has not been walked. Issue #62 holds that walk. |
 | `Analyze (csharp)` | Dropped as a name | The language-specific analysis job is replaced by the equivalent for this language rather than carried across under a name that describes nothing here. |
 | `DCO sign-off` | Kept unchanged | Already in the tree, asserting the text at `DCO` on every non-merge commit. |
 | `Deterministic PR-hygiene checks` | Kept, adapted | The class the other checks miss is the pull request itself, and one of the three refusals is this board's own invariant about a record moving with the code it describes. It is in the tree as the `pull request` job, judged in `internal/pullrequest/` and run from `.github/workflows/pull-request.yml`. |