fix(codeql): recover reruns after pre-runner cancellation

[seonghobae]

Root cause

The required CodeQL PR workflow treated github.run_attempt != 1 as proof that an earlier attempt had already dispatched the native scan. That is false when earlier attempts are cancelled before runner assignment.

Concrete consumer evidence is ContextualWisdomLab/accounting-information-platform#49@065f9ab7038bf35db4ef129827de6ab8ee6a1038, CodeQL run 33890965185:

• attempt 1 detect job 101082241642: cancelled, runner_id=0, steps=[];
• attempt 2 detect job 101128192785: cancelled, runner_id=0, steps=[];
• attempt 3 obtained runners, but actions job 101220582725 and python job 101220582747 found no authenticated terminal codeql-dispatch/<language> status and failed solely at the RUN_ATTEMPT != 1 guard.

The unchanged consumer head therefore could not recover when runner capacity later became available.

RED / minimal causal repair

• RED 4c62031fb253cec6abb39ac14c0dc124db6a61e6 executes the production dispatch Bash block with a later attempt, no authenticated verdict, exact live head, OIDC/app-token boundary stubs and the observed AIP run/job identity. It requires bounded codeql-scan dispatch with verdict=pending instead of an attempt-number veto.
• Candidate fabc998d3efffee61e288e14624d5a933026b2ff removes only that veto. Live PR/head revalidation, creator-bound terminal status consumption, exact run/job validation, OIDC exchange, one-language payload and fail-closed pending/failure behavior remain intact.
• Doctoring e47de34288fba93b990a39031503c3e59caeb680 records the reproduction, rollback boundary, duplicate-recovery risk and post-integration canary.
• ADR alignment 67a6bc95ac9a85cdf59c0f5ce08ae0a09c5a3980 removes the stale “attempt 1 dispatch / attempt 2 consume” architecture claim. ADR 0025 now makes recovery evidence-driven: run_attempt is metadata, not a dispatch receipt; absent a trusted exact-head terminal verdict, the exact shard may redispatch and remains pending until the authenticated central handler produces a terminal status.

The same target-repository / PR / language concurrency lane bounds duplicate recovery. A manual rerun can replace an already queued same-shard native dispatch before a terminal receipt exists; if that churn is material, the successor design must add an authenticated pending/dispatch receipt rather than restoring attempt-number inference.

Concurrent-main adoption

Protected main advanced independently from 27d7331cc4e0ae73f2d10122e9f2a8f437c90641 to 8aea81323d93e90c79b71d7718de2798919fa1df in three commits touching opencode-review.yml, AGENTS.md, and CLAUDE.md. Those paths do not overlap this PR's four-file delta. Commit 510e3378f2fc30129debc776f4a187474f5ff6fa adopts that intervening protected-main tree as a normal two-parent descendant; no rebase, force-push, or delta loss was used. Compare main@8aea813… -> 510e337… is ahead 7 / behind 0 and still contains only this PR's four changed files.

Current exact state and acceptance

Current exact development head is 510e3378f2fc30129debc776f4a187474f5ff6fa on protected main@8aea81323d93e90c79b71d7718de2798919fa1df. Keep Draft until this unchanged head has the focused regression, existing CodeQL contracts, complete central tests, 100% owned coverage/docstrings, workflow syntax, security gates, code-current documentation, resolved review findings and qualifying independent approval.

After ordinary protected integration, rerun the unchanged AIP #49 exact head and require real authenticated terminal codeql-dispatch/actions and codeql-dispatch/python verdicts. No leaf workaround, provider substitution, synthetic status, self-approval, admin bypass, force push or required-gate weakening is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head verification sweep for e47de34288fba93b990a39031503c3e59caeb680: Python Security 33953038123, SAST Semgrep 33953038106, CodeQL PR 33953038159, and Security Scan 33953038143 are all still queued. CodeQL detect job 101271230246 has not executed yet. There are no submitted reviews and no review threads. Protected .github/main remains 6d7fbebec8aec31d88a30a36e71ca5b3925d241d, so no intervening base delta has been adopted yet.

Accordingly the executable test-first regression and minimal source repair remain a development candidate, not hosted GREEN or merge-ready evidence. ADR 0025 is still Proposed and its attempt-one/attempt-two prose must be reconciled before this Draft can advance; do not mark it Accepted merely because the recovery defect is understood.

[seonghobae]

Non-force restack completed on protected main@71dd84d40576281a6218f622d685d13c6b2f5e7b as merge descendant db15e4c516e3eedc6fe41ed5a298857529f0aac0. The intervening main commit #1883 changed admission-controller/audit/scheduler code and tests only; #1902 changes only codeql-pr.yml, its focused rerun regression, and its doctoring trace, so the combined tree preserves both deltas without destructive rebase or force-push. Live PR metadata now reports mergeable=true.

Keep Draft: ADR 0025 still describes the older "attempt one dispatch / attempt two verdict read" sequence and must be made code-current before merge, and this restacked exact head still needs its own full test/coverage/docstring/workflow/security/review evidence. After ordinary protected integration, acceptance remains rerunning unchanged accounting-platform #49 and observing authenticated terminal codeql-dispatch/actions and codeql-dispatch/python verdicts.

[seonghobae]

Fresh owner-head adoption: protected main advanced again to 27d7331cc4e0ae73f2d10122e9f2a8f437c90641 via #1907 after the previous restack. That intervening delta is AGENTS/CLAUDE verification guidance and does not overlap #1902's CodeQL workflow/test/doctoring files. I adopted it with another normal two-parent descendant, 96919601105239c0b035534bbe8961563d113f42, preserving the #1902 blobs exactly and updating the branch with force=false.

Keep Draft. This restack does not address the still-stale ADR 0025 and predecessor checks/reviews do not transfer. Require all evidence on 9691960... before any merge.