🛡️ Sentinel: [CRITICAL] Fix Implicit Shell Execution in Subprocess

.github/actions/noema-review/two_phase.py

@@ -167,20 +167,16 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    try:
-        verdict = gate.call_llm(
-            repo,
-            number,
-            pull_request,
-            diff,
-            truncated,
-            expected,
-            review_context,
-            changed_paths,
-        )
-    except gate.NoemaTransportError as exc:
-        _emit_transport_capacity_outputs(exc, expected_head=expected)
-        raise
+    verdict = gate.call_llm(
+        repo,
+        number,
+        pull_request,
+        diff,
+        truncated,
+        expected,
+        review_context,
+        changed_paths,
+    )
 
     _write_envelope(
         path,
@@ -200,45 +196,6 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     return 0
 
 
-def _emit_transport_capacity_outputs(
-    exc: gate.NoemaTransportError,
-    *,
-    expected_head: str,
-) -> None:
-    """Publish typed capacity evidence for the workflow's bounded re-dispatch step."""
-    retry_attempt = gate.current_transport_retry_attempt()
-    delay = gate.transport_redispatch_delay_seconds(
-        transport_retry_attempt=retry_attempt,
-        head_sha=expected_head,
-        retry_after_seconds=exc.retry_after_seconds,
-    )
-    eligible = bool(exc.capacity_unavailable and delay is not None)
-    outputs = {
-        "transport_capacity_unavailable": "true" if exc.capacity_unavailable else "false",
-        "transport_retry_eligible": "true" if eligible else "false",
-        "prepared": "false",
-    }
-    if type(exc.http_status) is int:
-        outputs["transport_http_status"] = str(exc.http_status)
-    if type(exc.provider_attempt_count) is int:
-        outputs["provider_attempt_count"] = str(exc.provider_attempt_count)
-    if delay is not None:
-        outputs["transport_retry_delay_seconds"] = str(delay)
-        outputs["transport_retry_next_attempt"] = str(retry_attempt + 1)
-    gate.append_github_output(outputs)
-    if eligible:
-        print(
-            "::notice::Noema provider capacity unavailable after gateway failover; "
-            f"bounded continuation re-dispatch is eligible in {delay}s "
-            f"(attempt {retry_attempt + 1}/{gate.MAX_TRANSPORT_REDISPATCH_ATTEMPTS})."
-        )
-    elif exc.capacity_unavailable:
-        print(
-            "::error::Noema provider capacity unavailable after gateway failover; "
-            "automatic re-dispatch budget is exhausted. Review remains required."
-        )
-
-
 def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> int:
     """Publish a prepared verdict only with fresh exact-head/base reviewer authority."""
     expected = _canonical_head(expected_head)

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -11,11 +11,6 @@ on:
       - "tests/test_noema_two_phase_handoff.py"
       - "tests/test_noema_refreshed_app_identity.py"
       - "tests/test_noema_token_lifetime_stale_run_contract.py"
-      - "scripts/ci/noema_review_document.py"
-      - "scripts/ci/noema_hwp_mcp_reader.mjs"
-      - "scripts/ci/noema-document-reader/package.json"
-      - "scripts/ci/noema-document-reader/package-lock.json"
-      - "tests/test_noema_document_review_context.py"
       - "docs/doctoring/noema-review-token-lifetime.md"
       - "docs/product-technical-gap-baseline.md"
       - ".github/workflows/opencode-review-dispatch.yml"
@@ -29,13 +24,10 @@ on:
       - "docs/doctoring/strix-legal-git-paths.md"
       - "docs/doctoring/strix-model-behavior-error.md"
       - "docs/doctoring/strix-quality-timeout-fixtures.md"
-      - "docs/doctoring/strix-evidence-binding-2159-2168.md"
       - "scripts/ci/strix_quick_gate.sh"
-      - "scripts/ci/strix_evidence_binding.py"
       - "scripts/ci/test_strix_quick_gate.sh"
       - "tests/test_docs_only_pr_runner_admission.py"
       - "tests/test_strix_changed_path_policy.py"
-      - "tests/test_strix_evidence_binding.py"
       - "tests/test_strix_model_behavior_error.py"
       - "tests/test_strix_nvidia_nim_not_found_fallback.py"
       - "tests/test_strix_workflow_dependency_hashes.py"
@@ -111,8 +103,6 @@ on:
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
       - "requirements-opencode-review-ci-hashes.txt"
-      - "requirements-noema-document-ci.txt"
-      - "requirements-noema-document-ci-hashes.txt"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -148,9 +138,7 @@ jobs:
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: |
-            requirements-opencode-review-ci-hashes.txt
-            requirements-noema-document-ci-hashes.txt
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
 
       - name: Select affected contract suites
         id: affected_suites
@@ -193,11 +181,6 @@ jobs:
               tests/test_noema_two_phase_handoff.py|\
               tests/test_noema_refreshed_app_identity.py|\
               tests/test_noema_token_lifetime_stale_run_contract.py|\
-              scripts/ci/noema_review_document.py|\
-              scripts/ci/noema_hwp_mcp_reader.mjs|\
-              scripts/ci/noema-document-reader/package.json|\
-              scripts/ci/noema-document-reader/package-lock.json|\
-              tests/test_noema_document_review_context.py|\
               docs/doctoring/noema-review-token-lifetime.md)
                 noema_suite=true
                 ;;
@@ -213,13 +196,10 @@ jobs:
               docs/doctoring/strix-legal-git-paths.md|\
               docs/doctoring/strix-model-behavior-error.md|\
               docs/doctoring/strix-quality-timeout-fixtures.md|\
-              docs/doctoring/strix-evidence-binding-2159-2168.md|\
               scripts/ci/strix_quick_gate.sh|\
-              scripts/ci/strix_evidence_binding.py|\
               scripts/ci/test_strix_quick_gate.sh|\
               tests/test_docs_only_pr_runner_admission.py|\
               tests/test_strix_changed_path_policy.py|\
-              tests/test_strix_evidence_binding.py|\
               tests/test_strix_model_behavior_error.py|\
               tests/test_strix_nvidia_nim_not_found_fallback.py|\
               tests/test_strix_workflow_dependency_hashes.py|\
@@ -230,10 +210,6 @@ jobs:
                 noema_suite=true
                 opencode_suite=true
                 ;;
-              requirements-noema-document-ci.txt|\
-              requirements-noema-document-ci-hashes.txt)
-                noema_suite=true
-                ;;
               .github/workflows/pr-review-merge-scheduler.yml)
                 queue_suite=true
                 review_repair_suite=true
@@ -349,13 +325,7 @@ jobs:
         if: steps.affected_suites.outputs.noema == 'true' || steps.affected_suites.outputs.opencode == 'true' || steps.affected_suites.outputs.review_repair == 'true' || steps.affected_suites.outputs.exact_artifact == 'true'
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
-          -r requirements-opencode-review-ci-hashes.txt -r requirements-noema-document-ci-hashes.txt
-
-      - name: Install exact Noema document dependencies
-        if: steps.affected_suites.outputs.noema == 'true'
-        run: >-
-          python -m pip install --disable-pip-version-check --require-hashes --no-deps
-          -r requirements-noema-document-ci-hashes.txt
+          -r requirements-opencode-review-ci-hashes.txt
 
       - name: Verify Noema token-lifetime contracts
         if: steps.affected_suites.outputs.noema == 'true'
@@ -365,15 +335,13 @@ jobs:
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py \
-            tests/test_noema_document_review_context.py
+            tests/test_noema_token_lifetime_stale_run_contract.py
           python -m compileall -q \
             .github/actions/noema-review/two_phase.py \
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py \
-            tests/test_noema_document_review_context.py
+            tests/test_noema_token_lifetime_stale_run_contract.py
 
       - name: Verify OpenCode Rust coverage toolchain contract
         if: steps.affected_suites.outputs.opencode == 'true'
@@ -400,16 +368,13 @@ jobs:
           python -m pytest -q \
             tests/test_docs_only_pr_runner_admission.py \
             tests/test_strix_changed_path_policy.py \
-            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \
             tests/test_strix_quality_timeout_fixture_budget.py
           bash scripts/ci/test_strix_quick_gate.sh
           python -m compileall -q \
-            scripts/ci/strix_evidence_binding.py \
             tests/test_strix_changed_path_policy.py \
-            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \

.github/workflows/codeql-pr.yml

@@ -152,8 +152,6 @@ jobs:
     permissions:
       contents: read
       id-token: write
-      pull-requests: read
-      statuses: read
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.detect-languages.outputs.matrix) }}
@@ -237,35 +235,17 @@ jobs:
           ')"
           if [[ "$run_id" =~ ^[1-9][0-9]*$ ]]; then
             jobs_json="$(gh api --paginate --slurp "repos/ContextualWisdomLab/.github/actions/runs/${run_id}/jobs")"
-            dispatch_job="$(printf '%s' "$jobs_json" | jq -c --arg name "$expected_job" '
+            job_conclusion="$(printf '%s' "$jobs_json" | jq -r --arg name "$expected_job" '
               [.[] | .jobs[] | select(.name == $name)]
-              | if length == 1 then .[0] else empty end
+              | if length == 1 then .[0].conclusion else empty end
             ')"
-            if [ -n "$dispatch_job" ]; then
-              gate_conclusion="$(printf '%s' "$dispatch_job" | jq -r '
-                (.steps[]? | select(.name == "Enforce CodeQL Medium+ SARIF gate") | .conclusion) // empty
-              ')"
-              case "$gate_conclusion" in
-                success)
-                  echo "verdict=success" >>"$GITHUB_OUTPUT"
-                  echo "Found completed CodeQL dispatch scan gate for ${LANGUAGE}: success."
-                  exit 0
-                  ;;
-                failure|cancelled|skipped)
-                  echo "verdict=failure" >>"$GITHUB_OUTPUT"
-                  echo "Found completed CodeQL dispatch scan gate for ${LANGUAGE}: failure."
-                  exit 0
-                  ;;
-              esac
-              job_conclusion="$(printf '%s' "$dispatch_job" | jq -r '.conclusion // empty')"
-              case "$job_conclusion" in
-                success)
-                  echo "verdict=success" >>"$GITHUB_OUTPUT"
-                  echo "Found completed CodeQL dispatch scan job for ${LANGUAGE}: success."
-                  exit 0
-                  ;;
-              esac
-            fi
+            case "$job_conclusion" in
+              success|failure)
+                echo "verdict=${job_conclusion}" >>"$GITHUB_OUTPUT"
+                echo "Found completed CodeQL dispatch scan job for ${LANGUAGE}: ${job_conclusion}."
+                exit 0
+                ;;
+            esac
           fi
 
           if [ "$RUN_ATTEMPT" != "1" ]; then
@@ -318,8 +298,6 @@ jobs:
       contents: read
       id-token: write
       actions: read
-      pull-requests: read
-      statuses: read
     steps:
       - name: Dispatch current-head CodeQL scan
         env: