fix(security): fail closed on unavailable dependency review

[seonghobae]

Purpose

Replace the stale, conflicted #799 integration path with a bounded current-main repair for #810. Preserve #799 as historical evidence only; do not import its divergent removal of later Strix work.

Root cause

The central required Security Scan could conclude success when the exact dependency-review comparison returned HTTP 403 or 404. The support probe emitted supported=false, exited zero, and skipped the pinned Dependency Review action. A hard supply-chain evidence boundary had therefore been modeled as an optional capability optimization.

Remedy and TDD identity

• exact protected base: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• RED commit b06bb25c1af99b784730209dceb299cd493734f7 reverses the stale fail-open queue contract;
• GREEN commit 71947d24828cfb42806f5ef0a8abf83f9279d0af accepts only HTTP 200, preserves curl transport status separately, bounds connect/total time, discards the response body, checks out the explicit PR-head repository/SHA, and emits exact-identity failure evidence;
• transport-failure regression b527192d7b758fc2f8a95545f25545cec7747c99 proves a partial transfer that prints 200 but exits non-zero cannot pass;
• exact current head: 59d702f30fa419a016e24c18e87e05c76fbee4a3;
• read-only permissions and immutable action pins remain unchanged.

Scope correction

Unrelated scheduler-secret and Python-lock-materializer source/test changes that had accumulated on this branch were removed. Flattening an include-bearing requirements lock under a generated filename does not preserve relative include targets and requires a separately designed, test-first path-preservation contract.

The final scope changes only the Dependency Review control plane and its durable architecture, operator, release-note, and workflow-contract evidence. The existing executable mode of scripts/ci/materialize_base_python_requirements.py is preserved; the final mode-only correction introduces no source-content change.

Acceptance contract

Merge only after:

1. all exact-current-head deterministic, security, dependency, and required workflows are terminal and clean;
2. Dependency Review reaches the immutably pinned action through a complete exact HTTP-200 comparison whose transport exits zero;
3. current automated review has no valid unresolved finding;
4. a qualifying counted non-author formal approval exists; and
5. repository protection permits normal integration.

After merge, require a protected-main public-repository consumer run proving a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate before closing #810.

Summary by CodeRabbit

• 보안 강화

  • 보안 스캔이 PR의 정확한 기준·변경 커밋을 검증하도록 개선되었습니다.
  • 의존성 검토에서 네트워크 오류, 불완전한 응답, 빈 응답 및 비정상 상태 코드를 허용하지 않습니다.
  • Trivy와 Scorecard 결과가 정확한 변경 커밋에 연결됩니다.

• 문서

  • 의존성 검토의 실패 종료 정책, 권한 범위 및 예외 처리 기준을 문서화했습니다.

• 테스트

  • 보안 스캔의 커밋 검증과 실패 처리 동작에 대한 자동화 테스트를 강화했습니다.

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in:55 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 359a2b60-e7b1-4cd8-a157-96cf03d26796

📥 Commits

Reviewing files that changed from the base of the PR and between 07efb4a and ef3d210.

📒 Files selected for processing (3)

• CHANGELOG.md
• requirements-pip-audit-ci-hashes.txt
• tests/test_required_workflow_queue_contract.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c52c7aa-33d3-4477-8a84-d7cf70105d89

📥 Commits

Reviewing files that changed from the base of the PR and between 3cc65a7 and 07efb4a.

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

dependency-review 게이트가 exact base/head 비교의 HTTP 200 증거만 허용하도록 변경되었습니다. 오류, 빈 응답, 부분 전송, 비정상 상태 코드는 실패 처리합니다. PR head checkout, 회귀 계약 테스트, 운영 문서를 갱신했습니다.

Changes

공급망 검증 제어

Layer / File(s)	Summary
Exact-head dependency-review 게이트 .github/workflows/security-scan.yml, tests/test_required_workflow_queue_contract.py	PR head 저장소와 정확한 SHA를 checkout합니다. API probe는 응답 본문을 저장하지 않습니다. 전송 코드 0과 HTTP 200을 모두 확인하지 못하면 게이트를 실패시킵니다. 회귀 테스트는 부분 전송과 GITHUB_OUTPUT 미생성을 검증합니다.
Fail-closed 운영 계약 문서 docs/doctoring/dependency-review-fail-closed.md, CHANGELOG.md	fail-closed 정책, 권한 범위, 오류 분류, 수용·롤백 조건과 관련 표준을 문서화합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk:⚪ Minimal · up to 07efb

The dependency-review gate is changed to fail closed when comparison evidence is unavailable, and no actionable merge-blocking risk remains in the supplied evidence beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
participant PullRequest
participant security_scan
participant GitHubCompareAPI
participant dependency_review
PullRequest->>security_scan: PR head repository와 head SHA 전달
security_scan->>GitHubCompareAPI: 정확한 base...head 비교 요청
GitHubCompareAPI-->>security_scan: HTTP 상태와 전송 결과 반환
security_scan->>dependency_review: 전송 코드 0 및 HTTP 200일 때 실행

Loading

Possibly related issues

• security: fail closed when dependency review is unavailable EgressWeave#76: unavailable 또는 non-200 API 증거를 실패 처리하고 exact PR head 식별을 강제하는 목표가 같습니다.
• [Fleet incident] Disable orphaned implementation, release, and PR-integration workflow identities EgressWeave#202: Dependency Review가 건너뛰어지는 동작을 제거하고 exact-head 증거를 요구하는 목표가 같습니다.

Possibly related PRs

• ContextualWisdomLab/.github#840: 다른 workflow 경로에서 fail-closed 검증과 정확한 커밋 식별을 강화합니다.
• ContextualWisdomLab/.github#928: workflow별 immutable CI 증거에 fail-closed 검증을 적용합니다.
• ContextualWisdomLab/.github#969: 공급망 보안 게이트의 fail-closed 검증을 강화합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 dependency-review를 사용할 수 없을 때 fail closed로 처리하는 주요 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-review-fail-closed-current-main-20260809

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch and abort unless exact head is still 71947d24828cfb42806f5ef0a8abf83f9279d0af. There is one blocking source defect in the current GREEN candidate: the dependency-review probe still uses status="$(curl ... || true)". That discards curl's transport exit code. A partial-transfer/body-write/TLS/transport failure can therefore emit HTTP 200 and still reach supported=true, contradicting this PR's own fail-closed contract and the historical regression already observed in predecessor work.

Fix test-first on this existing branch only. Add a permanent regression that models a fake/controlled curl which writes HTTP 200 to stdout but exits nonzero (for example curl exit 18 partial transfer) and proves the support probe fails rather than setting supported=true. Then change the shell to preserve both channels independently: capture curl output/status without || true erasing the exit code, restore set -e, and require bothcurl_status == 0and exact HTTP status 200 before emitting supported=true. Any nonzero transport exit, empty/malformed status, or non-200 status must produce only bounded exact repository/base/head/status/transport diagnostics and exit 1. Continue discarding the response body, keep 10s connect/30s total timeouts, exact-head checkout, read-only permissions, immutable dependency-review action pin, and no credential/model/ruleset changes.

Strengthen tests/test_required_workflow_queue_contract.py or a focused companion to reject the literal || true support-probe pattern and require the captured transport-status branch. Run the focused fail-closed contract, complete central suite, compilation, git diff --check, Strix quick gate, then exact-head security/supply-chain gates. Do not mark this head accepted from the current queued checks; they are stale as soon as this repair lands.

[seonghobae]

Exact-head RCA and proof for 8fc17de86d1d22c9c11946dd7f70ff934c0b553a:

• First failing boundary on predecessor 71947d24828cfb42806f5ef0a8abf83f9279d0af: the support probe used command substitution with || true, which erased curl's transport exit. A partial transfer could emit HTTP 200, exit nonzero, and still reach supported=true.
• Technical root cause: HTTP response status and transport integrity were collapsed into one string channel. Systemic control: the permanent executable regression now supplies a controlled curl that prints 200 and exits 18, and requires fail-closed behavior with no GitHub output.
• Remedy: capture the curl transport exit separately under a bounded set +e region, immediately restore set -e, normalize the body-free HTTP status, and require transport exit 0 plus exact HTTP 200. Diagnostics remain bounded to repository/base/head, normalized HTTP status, and numeric transport exit.
• Preserved boundaries: discarded response body, 10-second connect/30-second total timeouts, exact-head checkout, read-only permissions, immutable dependency-review pin, and no credential/model/ruleset changes.
• RED: focused contract failed 2 tests, including the executable HTTP-200/exit-18 counterexample.
• GREEN: focused 2 passed; complete central suite 978 passed + 16 subtests; compile/diff checks clean; Strix self-test PASS.

Hosted exact-head security and supply-chain results remain authoritative.

[seonghobae]

@opencode-agent review

Evaluate exact current head 8fc17de86d1d22c9c11946dd7f70ff934c0b553a against independently resolved live main6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. Keep source revision, current-base compatibility, deterministic checks, model judgment, and qualifying independent human approval as separate evidence channels; do not infer merge authority.

[seonghobae]

Follow-up at current head 59505c1d: declared optional PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN under workflow_call.secrets in both reusable review schedulers, added the permanent contract test and fail-closed operations note. This enables callers to pass only the two required review credentials instead of secrets: inherit. Evidence: actionlint passed; focused contract suite 52 passed. The full suite reached 974 passed with 5 pre-existing platform-gated trusted-uv tests failing on this macOS arm64 workstation before the archive-verification assertions; no unrelated source was changed. No self/Admin/bypass approval or merge was used.

[seonghobae]

@opencode-agent review

Review exact current head 59505c1d89eb7ea816e921b6da38079c736608c2 against independently resolved live main6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. Nine exact-head hosted workflows are terminal-success and no review thread is unresolved. Verify dependency-review unavailable, skipped, neutral, and absent evidence fail closed without manufacturing a dependency finding, while successful exact-head evidence remains distinct from semantic review and merge authority. Automated judgment is not qualifying independent human approval or merge authorization.

[seonghobae]

@coderabbitai review
@opencode-agent review
@cwl-noema-review review

Review exact current head 59505c1d89eb7ea816e921b6da38079c736608c2 only. All nine exact-head quality, security, and supply-chain workflows are terminal-success. Validate that dependency-review capability accepts only a transport-successful HTTP 200 for the exact base/head comparison, with 10-second connect and 30-second total bounds, response body discarded, literal PR-head repository/SHA checkout, read-only permissions, and no substitute security gate. Review only; do not mutate, merge, or alter protections.

[coderabbitai]

@seonghobae I will review PR #897 at exact head 59505c1d89eb7ea816e921b6da38079c736608c2 only.

I will verify the dependency-review fail-closed boundary and the listed workflow invariants. I will keep exact-head check evidence separate from review judgment, approval, and merge authority. I will not modify code, merge, or change protections.

I used the repository guidance that only successful checks for the exact current head are valid merge evidence.

---

🧠 Learnings used

Learnt from: seonghobae
Repo: ContextualWisdomLab/.github PR: 0
File: :0-0
Timestamp: 2026-08-05T13:44:10.007Z
Learning: For PR `#782`, only successful checks associated with the exact current head are valid merge evidence. Do not treat queued, in-progress, cancelled, predecessor-head, temporary-workflow, or administrative-bypass results as passing evidence. Before a formal approval, verify that the direct security and supply-chain workflows, the permanent hourly NVIDIA NIM contract, current-head reviews, unresolved-thread checks, and an independent approval have completed successfully.

---

Learnt from: CR
Repo: ContextualWisdomLab/.github PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-07-29T06:47:25.581Z
Learning: Applies to opencode.jsonc : All reviewer agents in `opencode.jsonc` must keep `"edit": "deny"`; reviewers must never implement changes.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-current-head review request for 59505c1d89eb7ea816e921b6da38079c736608c2 over protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.

Review the bounded six-file supply-chain evidence repair: dependency-review support accepts only HTTP 200; non-200, timeout, or unavailable comparison fails closed with exact identity and operator guidance; response bodies are discarded; checkout is bound to the explicit PR head repository/SHA; and read-only permissions plus immutable action pins remain. Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation are terminal-success on this exact head. No review thread exists.

Keep the exact head unchanged. Do not update the branch, synthesize author approval, substitute another scanner for dependency-review evidence, add credentials, merge, release, or bypass protection.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 4 minutes and 33 seconds before sending another message.

[seonghobae]

@opencode-agent review

Re-evaluate exact current head 3af29c40796490ced463a9a6de7c4495a4ae97c8. 리뷰 확인 for the bounded-include increment; do not treat Checks wait as a blocker.

[seonghobae]

@opencode-agent

Please perform a fresh exact-head semantic review of 3af29c40796490ced463a9a6de7c4495a4ae97c8, keeping source findings separate from merge-readiness evidence. Do not infer approval from wrapper checks; submit a formal review only if the current head is defect-free under the protected control-plane contract.

[seonghobae]

@cwl-noema-review

Please provide an independent exact-head review of 3af29c40796490ced463a9a6de7c4495a4ae97c8. Confirm that unavailable or skipped dependency-review evidence cannot satisfy the required security contract, and submit a formal review verdict rather than a status-only acknowledgement.

[seonghobae]

@coderabbitai review

Please review exact head 3af29c40796490ced463a9a6de7c4495a4ae97c8, focusing on whether every unavailable, skipped, neutral, or metadata-incomplete dependency-review path fails closed and cannot satisfy the required security contract.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 50 minutes and 4 seconds before sending another message.

[seonghobae]

Returned to Draft because this branch overlaps the authoritative prerequisite #821 and no longer matches its own four-file bounded-scope claim.

#821 already owns the fail-closed dependency-review boundary and exact-head focused quality gate. This branch contains a useful incremental refinement—capturing the curl exit status independently while discarding the response body—but its current eleven-file diff also duplicates the security workflow, materializer/governance changes, and scheduler-token changes outside that refinement.

After #821 reaches protected main, rebuild this as a narrow follow-up retaining only the independently justified transport-status refinement, its focused regression proving a numeric HTTP 200 plus non-zero curl exit still fails closed, and bounded doctoring/changelog evidence. Remove duplicated prerequisite and unrelated scheduler/materializer changes, then reacquire exact-head checks and independent review.

[seonghobae]

@coderabbitai review

Please review exact head 94f799f7e0701e1a317bbe407759988cbad915c4. The branch is now narrowed to the dependency-review fail-closed control plane; unrelated scheduler-secret and incomplete requirements-include materializer changes were removed. Verify exact-head checkout, curl transport/HTTP-200 binding, body discard, timeout bounds, and the permanent fail-closed contract.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 16 minutes and 31 seconds before sending another message.

[seonghobae]

@opencode-agent

Please perform a fresh exact-head semantic review of 94f799f7e0701e1a317bbe407759988cbad915c4. Confirm that only a complete HTTP-200 exact base/head comparison can reach the pinned dependency-review action, every transport/non-200/malformed outcome fails closed without response-body disclosure, and the scope cleanup removed unrelated changes. Submit a formal current-head verdict.

[seonghobae]

@cwl-noema-review

After a qualifying exact-head OpenCode verdict, independently review 94f799f7e0701e1a317bbe407759988cbad915c4. Confirm unavailable dependency evidence cannot be converted into a passing security contract and that no complementary scanner is treated as a semantic substitute.

[seonghobae]

@opencode-agent review exact head 3cc65a7b24371ee453875d9efe06e82ff06477b7 and submit a formal current-head verdict.

[seonghobae]

Additional downstream RED evidence from Inkspan confirms this owner path is still release-relevant.

Affected downstream source: ContextualWisdomLab/inkspan PR #384 exact head 78d3f447315f85830b26c4bf81bdb5c376f1fcdf against protected mainfd75c835a2a7c5d9a1f57c3e080364237d69819a at observation time. Inkspan Security Scan run 32875283556, dependency-review job 97891634200, is associated with that exact PR head and completed success, while its pinned Dependency review step completed skipped immediately after Check dependency review support completed success.

First causal boundary / falsifiable RCA: the currently protected central workflow still treats unavailable comparison support as a successful capability probe and converts the required dependency-review evidence path into a skipped action. If that proposition is wrong, a protected-main consumer run should show a non-success gate whenever the exact comparison cannot be established; this Inkspan run instead shows success + skipped required evidence.

Acceptance for #897 remains fail-closed: comparison transport must complete successfully, exact base/head comparison must return HTTP 200, the immutable dependency-review action must actually run, and only then may the gate pass. A 403/404/transport failure/empty or partial response must be terminal non-passing evidence. The smallest remedy remains this existing #897 central-writer change; no Inkspan-local workflow workaround is correct because the organization ruleset owns the required workflow.

Post-merge GREEN proof required before closing the owning defect: rerun an Inkspan public-repository PR on an exact current head and verify (1) the central Security Scan checks out/identifies the intended exact source generation, (2) the comparison reaches HTTP 200 with successful transport, (3) the Dependency Review action is not skipped, and (4) the job is terminal success only after that action. Inkspan will continue treating run 32875283556 / job 97891634200 as non-passing supply-chain evidence despite the outer workflow conclusion.

[seonghobae]

Fresh Inkspan consumer canary for the current exact owner head, captured after protected-main synchronization:

• Consumer: ContextualWisdomLab/inkspan PR Reject trivial approvals for material changes #222, Draft, exact head 09f941c8a34eaf9461dd27fc185d64f158f9cf94, live base main@fd75c835a2a7c5d9a1f57c3e080364237d69819a.
• Consumer Security Scan run 32893517332 completed success, but job 97950681554 (dependency-review) shows Check dependency review support: success followed by the pinned Dependency review step skipped. Under Inkspan's fail-closed evidence contract that is non-passing despite the green job/run. This is the live protected-central behavior, not predecessor evidence.
• Current owner candidate is still fix(security): fail closed on unavailable dependency review #897 exact head 1d3624869b6dedc84af086bb15bdbce498ca3fe3 against live .github/main@95b05b393c75931044b405ae491079d336d89293; all review threads are resolved. Its own exact-head Security Scan 32866557994, dependency-review job 97863158507, reaches Checkout exact dependency-review head, Verify Dependency Review head checkout, Check dependency review support, and Dependency review, all success.

This gives a current RED consumer / candidate-GREEN pair at the actual owning boundary. Keep the remedy fail-closed: do not convert unavailable comparison evidence into skip/success. Before normal integration, independently revalidate #897's unchanged exact head/live base, current required jobs and checkout identities, current formal review state, and protection; do not transfer stale reviews or bypass the two-approval policy. After protected integration, re-run an Inkspan public-repository PR canary and require the Dependency Review action itself to execute terminally on the exact submitted head before treating Security Scan as release evidence.

[seonghobae]

Exact-current-head convergence and verification (2026-08-26)

• protected base: main@33dc57d7984b937e4f5ab915d5eae69a0f42e3a5
• exact head: f22662e3373bb928e27482e329ebdbc15a05ef5c
• remote tree: b8d99972081ba94299d6d203dae43ad6fb90f14e
• parents: prior owner head 1d3624869b6dedc84af086bb15bdbce498ca3fe3 + protected main 33dc57d7984b937e4f5ab915d5eae69a0f42e3a5
• non-force fast-forward publication; remote tree/parents match the independently verified local merge
• focused Security Scan/required-workflow contracts: 66 passed
• full central suite: 1,439 passed, 1 skipped, 16 subtests
• full Strix quick gate: PASS
• git diff --check: PASS
• unresolved review threads immediately after publication: 0
• exact-current-head formal approvals: 0

The newly dispatched security, CodeQL, SBOM, provenance, and quality runs are queued and remain non-passing until terminal. #1222 still requires a downstream ScopeWeave exact-head SAST/Trivy canary after both owner changes integrate; this source convergence is not operational acceptance by itself.

[seonghobae]

Inkspan consumer revalidation for the current fail-closed owner path (no Inkspan-local workaround): ContextualWisdomLab/inkspan#201 is currently at exact head 580ac1ad7453d5f6c443b1cea52493bef822844e. Its exact-head Security Scan run 32893518157 completed GitHub-success, but dependency-review job 97950684539 shows Check dependency review support: success followed by pinned Dependency review: skipped, while the job itself concludes success. Under Inkspan's exact-evidence contract this remains non-passing and reproduces the fail-open consumer symptom this lane owns. Acceptance after this owner repair reaches protected central main: rerun the unchanged/descendant Inkspan head and require the pinned Dependency Review action to execute only after a transport-successful exact base/head HTTP-200 comparison; non-200/failed-transfer/invalid identity must fail the job, not skip green. Current Inkspan CI success does not substitute for that proof.

[seonghobae]

Additional live public-consumer RED evidence for the existing fail-closed owner path; no Inkspan-local workflow workaround is correct.

Affected consumer: ContextualWisdomLab/inkspan#176, exact contributor head e1345c45ba9bf8e75bdab8ad7f56c7d7437f1470.

• Security Scan run 32871290622 is aggregate success.
• dependency-review job 97878683147 is aggregate success.
• its actual Dependency review action step is skipped after Check dependency review support succeeds.

Under Inkspan's release/governance contract this is a false-green supply-chain classification: skipped required evidence is non-passing, even when the job/run aggregate is green.

First causal boundary remains central required security-scan.yml, not Inkspan source. Acceptance for this owner repair is unchanged and falsifiable: a public consumer PR must either (a) reach the immutably pinned Dependency Review action against the submitted exact base/head and make its result authoritative, or (b) fail closed before a green job can be produced. After integration, rerun Inkspan #176 (and other affected current consumer heads such as #389) and require the Dependency Review action itself to execute rather than infer acceptance from aggregate status.

No duplicate owner/source branch requested; this comment only binds an additional exact affected SHA/run/job to the existing #897/#810 repair.

[seonghobae]

Fresh owner-path reconciliation found the same revision-identity failure mode on this Security Scan repair. GitHub currently reports protected main@60a34005e59efe2b622897e3c7b06882bdf63aee and actual PR contributor head c869a825e99a492b89adbd3956ea95b45fb52180, while the PR body still claims protected base 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba and exact current head 59d702f30fa419a016e24c18e87e05c76fbee4a3. The actual head has terminal-success current workflow runs (Security 32949573330, SAST 32949573277, CodeQL 32949573285, OSV 32949574337, SBOM 32949573312), but no formal review in the retrieved history is anchored to c869a825...; prior approvals/REQUEST_CHANGES are predecessor evidence. Treat revision-sensitive body and review claims as stale. Owner-path acceptance: refetch main/head, reconcile without force/destructive history, update exact revision evidence, regenerate qualifying review/check evidence on unchanged c869a825... (or its fresh successor), and only then integrate. ScopeWeave continues to treat central reusable Security evidence as non-authorizing until this owner repair and #1222 are protected-shipped and downstream consumer evidence is regenerated.

[seonghobae]

Fresh downstream and owner-state revalidation after protected-main movement:

• Inkspan Fix OpenCode coverage fetch authentication #389 remains 80160413b87f462e811c7e48161e7ea0f01a230d against protected main@128a239f8b71ca16add4b9e15e21752d1ad63ff0.
• Its required Security Scan 32917948414, dependency-review job 98025502696, is still false-green evidence: the job conclusion is success, but the actual pinned Dependency review action step is skipped after the compare probe returned HTTP 403. This remains non-passing for Fix OpenCode coverage evidence scope #118 release acceptance.

Current owner PR #897 is still exact head c869a825e99a492b89adbd3956ea95b45fb52180. Its same-head Security Scan 32949573330 is genuinely GREEN for the repaired lane: dependency-review job 98117715153 completed Checkout exact dependency-review head, checkout verification, support probe, and the actual pinned Dependency review step successfully. All currently returned same-head workflow runs are terminal; inline review threads are resolved. This proves the branch repair itself, not protected integration.

Protected .github/main has since advanced to e00bd7964f332b69cf7b430b0cb5ad486eef8258. GitHub now reports #897 mechanically mergeable, but its recorded PR base SHA remains predecessor 60a34005e59efe2b622897e3c7b06882bdf63aee; current-head branch checks and predecessor review state must not be transferred as live-base integration evidence. There is still no qualifying counted APPROVED review.

Smallest safe owner next action remains: reconcile/validate this existing head against the new protected base without force-push/destructive rebase, regenerate any evidence invalidated by base movement, obtain the required qualifying non-author formal approval, and integrate normally only if live governance permits. Then rerun the public Inkspan #389 canary and require the dependency-review action itself—not only the aggregate job—to execute on the exact release head/base comparison before #810 or Inkspan #118 can treat this boundary as GREEN.

[seonghobae]

Fresh downstream canary review found one still-live exact-evidence defect on current #897 head 0911677540deb44c7f4e7ff8a6ff9bf6becc761c against main@139c22f74b96e213510d3f487a5bed3b71f3459b: .github/workflows/security-scan.yml still binds base-sensitive OSV/Dependency Review evidence to ${{ github.event.pull_request.base.sha }} rather than independently resolving the live named protected base tip at job execution. A PR can therefore retain/recreate clean evidence against a predecessor base while protected main has moved, which is non-passing for ScopeWeave's exact-head/live-base contract.

Please keep this in the existing owner lane (no new writer): add a realistic workflow-contract RED that fails while base.sha is trusted directly; resolve ${{ github.event.pull_request.base.ref }} independently to exactly one refs/heads/<base> SHA (fail closed on zero/multiple/malformed resolution); use that live SHA for base checkout/attestation, ancestry/comparison, dependency-graph compare, and dependency-review-action base-ref; retain exact contributor-head checkout/attestation and read-only permissions; then require GREEN plus a downstream ScopeWeave canary whose logged base/head identities equal the independently resolved protected tip and exact contributor SHA. Do not weaken the existing HTTP/transport fail-closed behavior.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 9c565db161800bdf54d2a7c552b3d35b03d0e5d7.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33006256415/job/98300661537)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33006256415/job/98300661537)

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]

Loading

[seonghobae]

Fresh owner-path evidence on exact #897 head 9c565db161800bdf54d2a7c552b3d35b03d0e5d7 against live protected main@31e5f5337d8a8d844c456fe03f123c51b62416c9 shows the remaining current CHANGES_REQUESTED is not a source finding from this security-scan repair. Strix run 33006256415, job 98300661537 materialized the exact PR head/base correctly and its workflow smoke/test path passed, but every model-provider path failed: NVIDIA NIM returned HTTP 429 across three attempts; the OpenRouter/free fallback returned provider/backend failure (Invalid URL/502); and openai-direct/gpt-5.4 returned insufficient_quota repeatedly. The job therefore emitted STRIX_PROVIDER_UNAVAILABLE and failed closed without a vulnerability artifact.

Owner-side next action should be evidence repair, not #897 source churn or an unchanged rerun while the provider state is unchanged: restore one authorized working Strix provider/lease on the existing central control path, then rerun the unchanged exact head and require a terminal scan result whose findings (or clean result) are attributable to 9c565db.... Preserve the current fail-closed behavior when all providers are unavailable. Only after that current-head review/gate is clean should #897 integrate normally; after integration, regenerate a Noema exact-head/live-base Security Scan canary before treating downstream security evidence as authoritative.

[seonghobae]

Exact-current-head review request after terminal gate convergence

Protected base is main@548a97560070d31b03d14bee0ac98a990bd88482; exact PR head is a2524ad68efd254dae4f0442f05c98a09b441ec3. All currently associated exact-head security, SAST, OSV, CodeQL, Python, SBOM, provenance, Strix, and deterministic quality workflows are terminal success; skipped maintenance-only work is not counted as passing evidence. Inline review threads remain resolved, and the visible CHANGES_REQUESTED history is predecessor-head evidence rather than an approval for this revision.

@opencode-agent please submit a fresh formal verdict bound only to exact head a2524ad68efd254dae4f0442f05c98a09b441ec3. @cwl-noema-review please perform the independent current-head review. Preserve required checks and branch governance; do not merge or mutate source from this request.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for a2524ad68efd254dae4f0442f05c98a09b441ec3.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33017656014/job/98339943163)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33017656014/job/98339943163)

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]

Loading