fix(security): fail closed on ambiguous dependency-review HTTP responses

[seonghobae]

Current authoritative execution receipt — 2026-09-12

• Exact head: f27c5cfa4a61679e6ebb109d9e5972bd8a4f650d; protected base: main@fb17ef556f94f673234aa557254ae52779e9a7b0; exact tree: edccae8e0d7426e1c2d7be7c13e71571c2c5d38c.
• Ordinary two-parent restack; exact-tree verification: focused 22; full 3047 passed, 1 skipped, 36 subtests; git diff --check PASS.
• All predecessor hosted results are invalidated. New exact-head checks and qualifying independent approval are required before ordinary merge.

---

Security owner outcome

This PR is the canonical ContextualWisdomLab/.github owner lane for the Dependency Review admission boundary. It now consolidates the valid security deltas from protected #1724 and predecessor diagnostic #1643 without weakening the pinned Dependency Review action or any sibling scanner.

Three owner defects are repaired together:

1. pull-request HTTP 403/404 and every other non-200 compare result previously could be normalized to an unavailable/successful state in the reusable workflow; only HTTP 200 may now authorize the action;
2. thin reusable-workflow callers had omitted the least-privilege contents: read + pull-requests: read permission envelope that a called workflow cannot elevate itself;
3. the compare preflight trusted repository/base/head strings before transport; both the reusable workflow and bundled Security Scan now require exact immutable base/head object IDs and one legal non-dot owner/name repository identity before curl.

Test-first and carryover lineage

The original #1725 RED/GREEN lineage remains intact for non-200 fail-closed behavior and caller permissions. Current successor commits add #1643's still-valid immutable-identity requirement test-first:

• 3736634f95bf132bbbe208ffc80103863fe3a7c1 adds executable reusable-workflow regressions that require named/malformed revisions and malformed/dot-segment repository identities to fail before curl, while legal ContextualWisdomLab/.github reaches exactly one token-authenticated compare;
• b1e6263d9d9626b6cfd2046ce9147ab67867beec adds the corresponding reusable-workflow production validation;
• 8b86c0d2c6b0186538db1ed263f7cb9d222f3ca1 carries fix(security): validate immutable dependency-review identity on current main #1643's conflict-free bundled Security Scan identity preflight onto the current owner tree without force-push or destructive rebase;
• ae128374a2e38e60ada8bf5e89a9c7a4137f864f records the decisive A/B evidence and unified security invariants in canonical doctoring;
• 58a0b4c8ecc3073a64bd91457101229a21f020d4 adds a dedicated bundled-scan regression so the carried validation cannot silently disappear.

The temporary #1643 canary itself is deliberately not part of this publishable successor.

Decisive A/B evidence from #1643

Exact-head canary run 33589436750, job 100120235906, checked out a6a2759640e6aa1d1e1219e1cd7aacdeffef32c0 and compared exact base bb14b014eee31e6abdb5d2fffbb805aa29420eac to that head for ContextualWisdomLab/.github.

• anonymous request: HTTP 404, curl exit 0;
• job-token request with contents: read + pull-requests: read: HTTP 200, curl exit 0.

Therefore an anonymous response is not an availability authority. The least-privilege job token is the supported comparison boundary, and non-200 authenticated results remain fail-closed.

Historical protected-main relationship — 2026-09-07

Protected source/base is main@c9052e607e5f3cc76e73207e7786b21500721b79; exact owner head is 0bb8f7c06cb2ce291101e7014afe90bef0fe40c4. The direct ordinary adoption records predecessor c2e8ab0e535245f8f53801ad6a11e107fe492341 and protected main as its two parents. The exact tree differs from main in only the six owner paths listed above. Reverse PR #1995 is closed and no longer participates in acceptance.

Consumer evidence and release boundary

Before caller permission repair, immutable reusable-workflow consumers such as ContextualWisdomLab/newsdom-api#784@1623977e6c37c78cb1a94a7a48c48f6d02cac86c (33622976911) and ContextualWisdomLab/mightyETL#330@65efdf7b4064df5b9811c0403defb707e6efbc02 (33623035969) terminated startup_failure with zero jobs. After explicit caller permissions, fresh exact heads materialized Dependency Review runs in newsdom-api, mightyETL, scopeweave and Argos.

After this PR reaches protected main through ordinary protection, consumers must pin the reusable workflow to that immutable protected-main SHA. No caller returns to @main, a PR head, or another mutable owner ref.

Exact-head gate

All predecessor check/review evidence is invalidated. The authoritative current-head materialization is the live tally in the receipt above; exact-head approval remains absent, and nonterminal/failed gates are not transferable. Keep Ready for independent review admission while ADR-0025 remains Proposed until this unchanged successor has terminal passing required checks, substantive-clean current reviews/threads, current base/mergeability, and ordinary protected admission.

Refs #810, #1150, #1643, #1724, #1728, #1731, #1734.

[coderabbitai]

Warning

Review limit reached

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 61266cc5-6613-4be1-9132-54411727659d

📥 Commits

Reviewing files that changed from the base of the PR and between fb17ef5 and f27c5cf.

📒 Files selected for processing (6)

• .github/workflows/dependency-review.yml
• .github/workflows/security-scan.yml
• docs/adr/0025-dependency-review-fail-closed-permission-envelope.md
• docs/doctoring/dependency-review-fail-closed-permission-envelope.md
• tests/test_dependency_review_bundled_scan_identity_contract.py
• tests/test_dependency_review_reusable_workflow_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fleet handoff — a second migration defect is now live-evidenced and belongs in the central consolidation contract/doctoring before #1725 leaves Draft.

RCA: #1724's thin-caller replacements removed each caller workflow's permission envelope. A reusable workflow cannot elevate GITHUB_TOKEN permissions passed by its caller; the central workflow requests contents: read + pull-requests: read. On repositories whose default token does not already include that scope, the call fails before job creation. This is consistent with GitHub's reusable-workflow contract that permissions may only be maintained or downgraded across the call chain.

Exact RED evidence after immutable pinning (so mutable-ref resolution is no longer confounded):

• newsdom-api fix(coverage): gate PyO3 test deferral on exact-head native peer checks #784 1623977e6c37c78cb1a94a7a48c48f6d02cac86c: Dependency Review run 33622976911 -> startup_failure, zero jobs; referenced workflow resolved exactly to .github@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03.
• mightyETL chore(deps): bump typing-extensions from 4.15.0 to 4.16.0 #330 65efdf7b4064df5b9811c0403defb707e6efbc02: run 33623035969 -> startup_failure, zero jobs.
• Original caller workflows prove the permissions were part of the pre-migration contract: scopeweave and newsdom-api had contents: read + pull-requests: read; Argos had the same; mightyETL had contents: read, which is insufficient once the centralized workflow itself also requires pull-requests: read.

Consumer GREEN repair is now applied without touching this owner branch: explicitly retain permissions: {contents: read, pull-requests: read} in the thin callers. Fresh exact heads now materialize instead of immediate zero-job failure: newsdom-api 9a798d5ac7b9b295a1accb2327fc76611352290f run 33623818000 queued; mightyETL 4576f863ede9fca0673d6cce5ae8a4093246f5ab run 33623854807 queued; scopeweave db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f run 33623761776 queued; Argos #557 ee4c5dd326977407435b0f2425fdecebc34a810f run 33623867278 pending.

Owner-path acceptance: extend #1725's central contract/ADR/doctoring/example caller so every reusable Dependency Review caller is required to pass at least contents: read and pull-requests: read; preserve the existing 403/404 fail-closed RED/GREEN; then merge normally and publish the resulting protected-main exact SHA for all four consumers to pin. No caller should return to @main.

[seonghobae]

Fresh owner-path re-read confirms the permission handoff has advanced correctly to an explicit RED at ee0f1ce544965772775b590050e40476df4ea8f6 (test(security): require caller permission envelope). The new contract requires the reusable workflow's documented thin caller to contain permissions: contents: read and pull-requests: read, while the workflow source at this exact head still shows concurrency immediately after on: and therefore does not yet satisfy that test. Keep this as RED rather than weakening the assertion.

Next owner GREEN should minimally update the canonical example/doctoring contract to include the two caller read permissions, preserve the existing non-200 fail-closed production repair, adopt protected main@8eaa65005005ac1e67e21f18f8627529d0f41f5c non-destructively, and reacquire exact-head gates before normal merge. Once that fixed protected merge SHA exists, the four consumer PRs can replace their temporary 0bcd22... pins with that immutable fixed SHA and rerun their real gates.

[seonghobae]

Fresh-base owner handoff for exact head 403ca1c4de8b3e477b5a9b1c102188278286b2c8 (read-only; no source/ref/PR-state mutation): protected ContextualWisdomLab/.github/main is now 63bf49835da44aa8257eb76a92368e6485ae6e94 via #1728, while this Draft still records base b4eec000d21084accb736d289eb64cfd78e7a91a and is currently non-mergeable. Preserve the HTTP-non-200 fail-closed and least-privilege caller-permission RED/GREEN deltas; non-force reconcile with the live protected base, then re-run focused tests and every exact-current-head required/security/provenance check. Do not transfer the prior 403ca1c4… evidence across the new integration head. Consumers must continue to wait for the resulting protected-main immutable SHA and then pin that exact SHA; no @main, PR-head, skipped/cancelled/queued, or predecessor evidence is release authority.

[seonghobae]

Fresh Naruon reproduction confirms this PR's permission-envelope RCA on a fifth consumer. ContextualWisdomLab/naruon#1539@6e7a8d8a947fec1ffdfff15f165b3a171ec2e03e pins reusable Dependency Review at protected .github@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1; run 33630975578 resolves that referenced workflow but ends startup_failure with zero jobs. The Naruon thin caller currently omits caller-side permissions, matching the already-proven newsdom-api/mightyETL failure class in this PR. I am routing the consumer repair to #1539 without changing this central branch. GREEN for Naruon should include a fresh immutable central pin plus caller contents: read / pull-requests: read, followed by a real dependency-review / dependency-review job on the unchanged repaired caller head.

[seonghobae]

Current-main ancestry reconciliation rationale before write: protected main advanced to 78271917b526469c559fa75cb5ee39426e5494d1 after this Draft lane's prior reconciliation. Fresh compare is ahead_by=8 / behind_by=4 with merge base 63bf49835da44aa8257eb76a92368e6485ae6e94, but the effective tip-to-tip content delta remains exactly the four owner paths already named by this PR: reusable Dependency Review workflow, Proposed ADR-0025, doctoring, and executable contract test. The branch's latest commit 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c specifically reconciles the newer reusable-workflow contract (including comment_summary_in_pr and harden-runner tests), and every non-owner path is already content-identical to current protected main.

I will therefore preserve both histories without force/rebase by creating a two-parent reconciliation commit with the current branch tree unchanged, parents 2595e246e8f4aba89fd1bbf0fe4c6980d0ee026c and protected main@78271917b526469c559fa75cb5ee39426e5494d1, then move only this owner branch by fast-forward. This is ancestry repair only: no security behavior, ADR status, test expectation, or current protected-main intent is discarded.

[seonghobae]

Consumer owner-path acceptance from writable newsdom-api#784: current caller exact head b14586c218bb60e614136bef94e9fd8163f4d4b8 pins central workflow SHA 5f8e5b2a79e709c4ab1a4179a605d34c458b13a1. That protected-main commit still treats authenticated HTTP 403/404 compare responses as available=false and skips the hard gate; therefore it is not an acceptable security contract for the consumer. #1725 correctly owns the fail-closed repair. GREEN handoff requires: (1) unchanged #1725 protected-main descendant with non-200 fail-closed + caller permission/identity tests terminal-green, (2) ordinary protected merge, (3) canonical immutable owner release/tag for the reusable workflow (the repository currently exposes no Releases), and (4) newsdom-api caller/test constant bumped to that released owner identity followed by exact-head dependency-review / dependency-review terminal GREEN. Do not resolve by returning to @main, retaining 5f8e, or treating 403/404 as availability success.

[harbourviewcompany-create]

Evidence log — 2026-09-02

Exact current head: 58a0b4c8ecc3073a64bd91457101229a21f020d4.

• Current protected main: 8c085835fbf77de2321b72fa6b8dd946227e523e.
• GitHub compare: diverged, ahead_by=14, behind_by=7, merge base 78271917b526469c559fa75cb5ee39426e5494d1.
• GitHub currently reports the PR mechanically mergeable; there is no active merge conflict reported by the API. The branch is nevertheless behind current main, so current-head validation is not yet transferable.
• Exact-head required/security runs are queued/pending: OSV 33637850661, Secret Scan 33637849083, Security Scan 33637849313, CodeQL 33637849320, Scorecard 33637849319, SBOM 33637849219, SAST 33637849226, Python Security 33637849275.
• Security Scan currently has four queued jobs (osv-scan, dependency-review, trivy-fs, scorecard) in run 33637849313; no terminal result exists yet.
• Combined commit status currently exposes only CodeRabbit success; required GitHub Actions evidence is therefore non-terminal.
• Existing independent review evidence is stale: the recorded review was against predecessor head 403ca1c4..., not this exact head, so it is not treated as current approval.

Gate decision: HOLD. Do not mark ready or merge until the branch is reconciled against current protected main, focused QA passes on the resulting exact head, all applicable required/security checks are terminal and passing, and current qualifying review/thread requirements are satisfied.

[seonghobae]

Fresh LineageWeave consumer evidence from ContextualWisdomLab/LineageWeave#983@b69efde292a4bcf0c8ef78da31379965e9a34339:

Security Scan run 34303750908 materialized normally. Exact-head changed-scope, Trivy (102316331581), OSV (102316331665), and Scorecard lanes reached GREEN. Dependency Review job 102316331603 checked out and verified the exact b69 head, then failed specifically at Check dependency review support; the delegated Dependency review step was skipped. This reproduces the fail-closed admission problem on another exact immutable consumer head after ordinary workflow materialization. No LineageWeave-local substitute scanner, synthetic receipt, or gate waiver was introduced.

Keep this as consumer RED for the canonical owner repair/release path: after owner integration, the acceptance target remains an authenticated HTTP 200 compare plus an actually executed Dependency Review verdict on a consumer pinned to the immutable released owner revision.

[seonghobae]

Fresh LineageWeave consumer evidence on exact ContextualWisdomLab/LineageWeave#983@e2bcba49dd9b2baab129de9c3872d77f654dd16a reproduces the same owner-boundary admission failure after the leaf checkout is exact. Security Scan 34309004543, dependency-review job 102332004493: checkout exact dependency-review head = GREEN, Verify Dependency Review head checkout = GREEN, Check dependency review support = RED, and the actual Dependency review action is skipped. On the same exact head, Trivy job 102332004482 and Scorecard 102332004500 are GREEN; OSV also materialized independently. This remains fail-closed consumer evidence, not a request for a LineageWeave-local substitute or waiver. Please preserve the owner path through protected integration + immutable consumer pin + authenticated HTTP-200 compare + actually executed dependency verdict before counting the repair delivered.

[seonghobae]

LineageWeave consumer evidence update. Exact predecessor 69f7e6a3f74dd94d004268d3cc47b0e14f3e1d01 Security run 34326058042 reached exact checkout/verification and changed-scope successfully, then failed closed at Check dependency review support; the delegated Dependency Review action itself was skipped. OSV and Trivy completed successfully, so this is not evidence for a LineageWeave-local scanner defect and no leaf substitute/waiver was added. Current LineageWeave parent 031cb4fe51d43ac3d8f792fe8180ab858617d1bc has fresh Security run 34328980662 queued and will be treated as a new exact-head receipt rather than inheriting this predecessor verdict.

[seonghobae]

Fresh LineageWeave consumer receipt — ContextualWisdomLab/LineageWeave#983@92e6016eefb3376132a0bd7f35a23b63efad4a87, Security run 34333493168. Exact-head changed-scope detection is GREEN; OSV, Trivy filesystem scan, and Scorecard are GREEN. Dependency Review job 102409816104 checks out and verifies the exact head, then fails closed at Check dependency review support; the delegated Dependency review action is skipped and therefore no dependency verdict exists. This is current consumer evidence for the canonical support/admission boundary, not a LineageWeave vulnerability finding and not authority for a leaf-local substitute. Keep owner acceptance strict: authenticated support preflight + actually executed dependency verdict are both required before consumers can count the gate.

[seonghobae]

Fresh LineageWeave consumer evidence, exact PR #983 head b65d4301552f95de75eb51e085eb0f31dcdf5413: Security Scan run 34335655790 materialized normally. dependency-review job 102414895493 checked out and verified the exact head, then failed at Check dependency review support; the delegated Dependency review step was skipped. In the same exact run, changed-scope, Trivy and OSV completed GREEN. This reproduces the canonical admission defect after successful exact-head checkout, not a LineageWeave dependency finding. No leaf-local substitute/waiver was added. Please preserve this consumer case through protected owner promotion and require an actually executed Dependency Review verdict before consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer evidence from #983 exact 87a462c621a45cf7b79c0e2dbb332011f54203ed (2026-09-09): Security Scan run 34338077607 checked out and verified the exact dependency-review head successfully, then job 102422456470 failed only at Check dependency review support; the actual Dependency review step was skipped. Changed-scope admission succeeded, OSV job 102422456474 succeeded, Trivy job 102422456577 succeeded, and no LineageWeave-local substitute/waiver was added. This reproduces the canonical support/admission boundary on a current consumer head; it is not evidence that the dependency verdict itself ran. Consumer will require a fresh authenticated HTTP-200 admission and executed Dependency Review after this owner repair reaches immutable protected truth.

[seonghobae]

Current LineageWeave consumer confirmation after the product head advanced normally: #983 exact 77e7710e18e51e70f1dca595142b24c2459c2a0d, Security run 34340137679. Exact dependency-review checkout and head verification succeeded; Check dependency review support failed; the actual Dependency review step was skipped. Changed-scope, OSV and Scorecard lanes are GREEN. This reproduces the same canonical admission boundary on the new exact consumer head after a real product test delta; no LineageWeave-local substitute, synthetic receipt or waiver was added. Acceptance still requires the owner repair to reach protected immutable truth followed by a fresh consumer run in which support admission succeeds and Dependency Review actually executes.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head 08164b7531832e58aa6193fab905df8af2cbc34a: Security run 34344807138, dependency-review job 102444088978. Exact head checkout and verification succeeded; Check dependency review support failed, so delegated Dependency review was skipped. Changed-scope, Trivy, OSV and Scorecard all completed GREEN. Treat this as canonical support/admission evidence; no LineageWeave-local substitute, synthetic status or waiver was added.

[seonghobae]

Fresh LineageWeave consumer evidence at exact consumer head 5398c939963ba27eeaa86cd55f5293c325db97bb: Security Scan run 34350221808, dependency-review job 102461426061. Exact dependency-review checkout and exact-head verification both pass; Check dependency review support then fails and the actual Dependency review step is skipped. Sibling changed-scope, OSV, Trivy, and Scorecard lanes are GREEN. This remains a fail-closed owner-path admission failure, not a LineageWeave vulnerability/scanner failure. No consumer-local substitute or waiver was added.

[seonghobae]

Fresh LineageWeave consumer evidence on exact PR #983 head 52b6b9306afd698c1ee27414cf9e3239b35c7455: Security Scan run 34353385899 checks out and verifies the exact Dependency Review head, then job 102471928899 fails at Check dependency review support; the actual Dependency review step is skipped. Trivy (102471928959), OSV (102471928836), and Scorecard (102471928895) are GREEN on the same run. This reproduces the delegated support-admission failure without a LineageWeave scanner finding. Please preserve fail-closed semantics and repair in the canonical reusable owner; consumer has not added a substitute/waiver.

[seonghobae]

Fresh LineageWeave consumer evidence on exact PR #983 head 3694f1d895d3366470e1bb32f749d05957c4bce2: Security Scan run 34359919082 reaches exact checkout/head verification, then dependency-review job 102493964514 fails at Check dependency review support; the actual Dependency Review step is skipped. Same-run Trivy, OSV and Scorecard complete GREEN. This reproduces the canonical admission defect without a leaf shim or waiver. Keep #1725 Draft/unreleased until protected integration; only a post-integration consumer run with an actually executed Dependency Review verdict can satisfy this boundary.

[seonghobae]

Fresh LineageWeave consumer RED on ContextualWisdomLab/LineageWeave#983 exact 5c34e522f0751841b54a2dbf60f99a3c637d6395: Security run 34366564498, dependency-review job 102516792503 checks out and verifies the exact head successfully, then fails at Check dependency review support; the delegated Dependency Review step is therefore skipped. Same-head Scorecard and OSV lanes are GREEN. This reproduces the owner-side support-admission defect after a new consumer head without a leaf shim or waiver. Keep #1725 fail-closed until its repair reaches protected integration and a released/exact owner SHA can be consumed; do not treat this mutable PR head as a consumer dependency.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact e262161078ca1e0aeec1568f25ada196984064cd (Security Scan run 34373412662): changed-scope and exact checkout/head verification completed, then dependency-review job 102540091614 failed at Check dependency review support; the actual Dependency review action was skipped. Sibling leaf-local scanners remain independently executable (OSV/Scorecard and the scan lanes are not replaced here). This reproduces the canonical admission failure on a current immutable consumer head. LineageWeave keeps the gate fail-closed and has not added a substitute status, waiver, mutable owner-head pin, or local bypass. Consumer acceptance remains pending an ordinary protected owner release plus an actually executed dependency verdict on the pinned released contract.

[seonghobae]

Fresh LineageWeave immutable-consumer reproduction on PR #983 exact head 557bc5d229e1e9261700f116ef7511067d65472c: Security Scan run 34376255288, dependency-review job 102549730849 checked out and verified the exact head successfully, then Check dependency review support failed and the delegated Dependency review step was skipped. Same run's OSV, Trivy, and Scorecard jobs are GREEN. This remains a canonical .github support/admission defect; no LineageWeave shim, waiver, synthetic receipt, or mutable owner-head dependency was added.

[seonghobae]

Fresh immutable consumer reproduction from ContextualWisdomLab/LineageWeave PR #983 exact head a2a7d55a6cd919429411d0d4fba56a6d3ff6c5cb: Security run 34385176859, dependency-review job 102579580608. Exact-head checkout and Verify Dependency Review head checkout succeed; Check dependency review support fails and the delegated Dependency review step is skipped. Same run OSV (102579580438), Trivy (102579580551), and Scorecard (102579580448) are GREEN. This remains canonical owner/control-plane admission evidence; no LineageWeave-local substitute, waiver, or mutable owner-head dependency is being introduced.

[seonghobae]

Fresh LineageWeave consumer reproduction on PR #983 exact head de233fe3848fd1244440ee1f161f2ae04bd916f0 (Security run 34391713084): changed-scope detection succeeds; dependency-review exact-head checkout and head verification both succeed; Check dependency review support fails and the delegated Dependency review step is skipped. Same-head Trivy filesystem, Scorecard, and OSV lanes are GREEN. This remains a canonical owner admission/control-plane repair; LineageWeave did not add a local substitute, waiver, or synthetic success receipt.

[seonghobae]

Fresh LineageWeave consumer reproduction after a test-only parent move:

• consumer: ContextualWisdomLab/LineageWeave#983@7552d5b8166f62753bb4af1ee09811ff74f3186b
• Security Scan run: 34397519399
• dependency-review job: 102620827406
• exact checkout + head verification: GREEN
• Check dependency review support: FAILURE
• delegated Dependency review: SKIPPED
• same run Scorecard 102620827355, Trivy 102620827478, and OSV 102620827566: GREEN

The consumer change adds only frontend/src/PostBody.structuredImageCoverage.test.tsx; it does not alter dependency metadata or the security workflow. This is another exact-head reproduction that admission remains fail-closed before an actual dependency verdict. No LineageWeave shim/waiver/synthetic receipt was added. Owner PR remains the repair boundary; protected publication + immutable consumer bump are still required before this can count as consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head ce0259631582e9f8ce27eb9398f47e96942d0b34 (Security Scan run 34403951783): dependency-review job 102642342277 checks out and verifies the exact head successfully, then fails at Check dependency review support; the delegated Dependency review step is skipped. Same run: OSV 102642342181, Trivy 102642342228, and Scorecard 102642342248 are GREEN. This is still an owner-side fail-closed support/admission boundary; no LineageWeave waiver, substitute scanner, synthetic receipt, or mutable owner-head dependency was introduced. Please preserve exact-head semantics in the canonical repair.

[seonghobae]

LineageWeave current-head consumer reproduction for the central Dependency Review owner path.

Exact consumer: ContextualWisdomLab/LineageWeave#983@8c3f2048a7a5b914b370c2c071c5e1e77e0bcda3.
Security run 34409336292, dependency-review job 102661587337 reached exact checkout and head verification, then failed at Check dependency review support; the delegated Dependency review step was skipped. Same exact run has Trivy 102661587252, OSV 102661587306, and Scorecard 102661587347 GREEN, so this is not evidence for replacing those scanners or weakening the leaf gate.

Please keep the repair in canonical .github and require owner RED→GREEN→protected immutable integration before LineageWeave consumes it. LineageWeave will not add a substitute receipt/waiver, mutable owner-head dependency, or local gate bypass.

[seonghobae]

Fresh LineageWeave consumer reproduction on exact PR #983 head 682c188d7e6a69509572405552881cbb1a6d633a: Security Scan run 34412045494, dependency-review job 102670473058. Exact checkout/head verification succeeds, then Check dependency review support fails closed and the delegated Dependency Review step is skipped. OSV 102670473081, Trivy 102670473049, and Scorecard 102670473233 are GREEN on the same head. LineageWeave has not added a substitute scanner, synthetic receipt/status, waiver, or mutable owner-head dependency. Please treat this as current consumer evidence for the canonical preflight/caller-permission repair; protected owner integration remains the prerequisite before consumer acceptance.

[seonghobae]

Fresh LineageWeave consumer evidence: exact head 45fc14629ffd4b27d6b969f01fabf8ffe0b2e991, Security run 34425499098, dependency-review job 102713109262. Exact dependency-review head checkout and head verification are GREEN; Check dependency review support fails closed, so the actual Dependency review step is skipped. This is the same owner-boundary failure, not a LineageWeave scanner finding. No leaf waiver/substitute receipt/shim added. Please preserve owner RED→GREEN→protected/released acceptance before consumer bump.

[seonghobae]

Fresh LineageWeave consumer reproduction for the central Dependency Review owner path.

• Consumer PR: fix: verify dashboard accessibility and enforce frontend coverage LineageWeave#983
• Exact head: 60d2f7800dc93b090a9f2659c9a195f8cdcf4320
• Security run: 34431425085
• dependency-review job: 102731140724
• Exact checkout/head verification: GREEN
• Check dependency review support: FAIL
• delegated Dependency review: SKIPPED
• OSV 102731140581, Trivy 102731140608, Scorecard 102731140651: GREEN

This is therefore still the central support/admission defect rather than a LineageWeave scanner finding. LineageWeave will not add a leaf waiver, substitute scanner, synthetic receipt/status, or mutable owner-head dependency. Please preserve fail-closed behavior, complete #1725 on the canonical owner path, publish the protected immutable owner SHA, then consumers can pin/bump to that released contract.

[seonghobae]

SOURCE WRITER CLAIM — bounded ordinary adoption of protected main@691fb78932eff5fbe52db69077848134b0b4e053 into unchanged owner head 4ccb21d8ace608f28d11d72589e5deb78add3a33. Local merge is conflict-free and the effective main-relative delta remains exactly the six Dependency Review owner paths. Fresh merge-result evidence is focused 20 passed and GITHUB_ACTIONS=true full 3,045 passed, 1 skipped, 36 subtests; git diff --check PASS. I will re-fetch head/main immediately before a force=false ref update. No support-probe bypass, scanner substitution, live settings mutation, or consumer rerun is included.

[seonghobae]

SOURCE WRITER RELEASE — ordinary non-force descendant 59063ff7be935849671600d539a57fd1219bd4ae adopts protected main@691fb78932eff5fbe52db69077848134b0b4e053 with parents 4ccb21d8ace608f28d11d72589e5deb78add3a33 and 691fb78932eff5fbe52db69077848134b0b4e053; exact tree 47313bbb1c4d475c4e7a40eace64f6d465775f98. Fresh compare: ahead 20 / behind 0, exact six owner paths. Verification: focused 20 passed; GITHUB_ACTIONS=true full 3,045 passed, 1 skipped, 36 subtests; diff check PASS. Hosted exact-head runs are queued, threads are resolved, approval absent, so Draft is retained. This source hardening preserves fail-closed HTTP 403 behavior; only a live authenticated HTTP 200 consumer canary can prove Dependency Review availability.

[seonghobae]

Exact-head CodeQL RCA

Run 34685813268 is terminal FAILURE on unchanged head 59063ff7be935849671600d539a57fd1219bd4ae. Both required language shards ended with DISPATCH_OUTCOME=success and VERDICT_STATE=pending; the coordinator succeeded after binding the exact repository, protected base 691fb78932…, PR head, required run, required job IDs, and actions/python matrix. Jobs: python 103532639714, actions 103532639740, coordinator 103533189553.

All other current-head required workflows are SUCCESS. This remains a central authenticated terminal-settlement defect under active owner .github#2040; it is not bypassed, manually rerun, or substituted with predecessor evidence.

[seonghobae]

Protected-main restack receipt — 2026-09-12

Exact head f27c5cfa4a61679e6ebb109d9e5972bd8a4f650d is an ordinary two-parent child of prior owner head 59063ff7be935849671600d539a57fd1219bd4ae and protected .github/main@fb17ef556f94f673234aa557254ae52779e9a7b0. Exact tree: edccae8e0d7426e1c2d7be7c13e71571c2c5d38c.

The five new protected-main commits touched six paths disjoint from this PR's six Dependency Review owner paths. Git Data construction reproduced the locally merged tree byte-for-byte, then the ref advanced with force=false.

Exact-tree verification: focused Dependency Review plus new protected-main contracts 22 passed; complete GITHUB_ACTIONS=true python -m pytest -q tests 3047 passed, 1 skipped, 36 subtests passed; git diff --check PASS.

All predecessor hosted results are invalidated. Keep Draft until new exact-head checks are terminal and a qualifying independent approval exists. Source repair remains fail-closed and does not turn a consumer repository's HTTP 403 into authenticated Dependency Review evidence.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: f27c5cfa4a61679e6ebb109d9e5972bd8a4f650d