fix(queue-health): enforce canonical repository identity

[seonghobae]

Current authority — 2026-09-20 KST

• Exact head: 7d8a2a823f8dff523d749eb56965b001f4be53b5; tree is byte-identical to the reviewed predecessor at 4c75b6fc733b20acc42f3082afbcb20aa089b7e8.
• Protected base: main@e6334e229581a918e2f22de18733b76fa65d7e71.
• Ordinary two-parent reconciliation preserves prior fix(queue-health): enforce canonical repository identity #2268 7822a7f077d2ebf07c579c855da9d6837a10b1ed and the protected fix(security): prove GitHub API URL authority #2279 merge commit e6334e229581a918e2f22de18733b76fa65d7e71.
• Verified compare: protected main is the merge base, ahead 6 / behind 0, with exactly the two queue-health-owned paths. Compare from the predecessor has no file changes.
• Fresh exact-head runs are queued/nonterminal: CodeQL PR 35453297707, Python Security 35453297725, SAST Semgrep 35453297864, and Security Scan 35453297869.
• Status remains Draft / Proposed. Terminal exact-head hosted evidence and a qualifying independent current-head approval remain mandatory; predecessor results do not transfer.

Superseded authority record

Problem

Queue-health repository admission was looser than the canonical component invariant. The protected-main parser accepted owner/repository components containing embedded .. or ending in . because REPOSITORY_PATTERN allowed those characters and _repository_name() rejected only components exactly equal to . or ...

Tracks #2263. This lane owns only queue-health admission; scheduler reconciliation remains owned by #2040.

RED contract

The production load_allowlist() regression requires rejection of:

• ContextualWisdomLab/repository.
• ContextualWisdomLab/repo..name
• ContextualWisdomLab./repository
• Contextual..WisdomLab/repository
• ContextualWisdomLab/..
• ContextualWisdomLab/.

while preserving .github, interior single dots, underscores, and hyphens.

Reviews 5245968191 and 5245980104 record the repository-side RED and symmetric owner-side gap.

Production repair

Current exact head: 7822a7f077d2ebf07c579c855da9d6837a10b1ed.
Exact tree: 4c75b6fc733b20acc42f3082afbcb20aa089b7e8.

The queue-health delta changes one production predicate in scripts/ci/actions_queue_health_core.py and adds tests/test_actions_queue_health_repository_identity.py. After the existing one-slash/allowed-character grammar succeeds, each owner/repository component is rejected when it contains .. or ends in .. Valid leading single-dot names such as .github remain admissible.

Canonical security-owner integration

The earlier exact SAST and Python Security failures were not caused by the queue-health delta. They identified two inherited dynamic urllib boundaries in:

• scripts/ci/codeql_ghas_configuration_identity.py
• scripts/ci/strix_evidence_binding.py

PR #2279 owns that repeated GitHub REST authority responsibility. Ordinary merge commit 7822a7f077d2ebf07c579c855da9d6837a10b1ed preserves both complete histories with parents:

1. queue-health head 142e5b2617778e79f665693be1e6f8c04d7533aa;
2. canonical owner head d1e4380c15e948aaf104d46aa134fa614058782a.

This PR is stacked on fix/github-api-url-boundary so its effective delta remains the two queue-health files. It does not copy or fork the owner implementation.

Exact-tree verification

• focused queue-health + CodeQL/Strix URL-authority suites: 174 passed
• same focused suite with GITHUB_ACTIONS=true: 174 passed
• full GITHUB_ACTIONS=true suite with warnings-as-errors: 3379 passed, 28 skipped, 40 subtests
• compileall: PASS
• git diff --check: PASS
• protected main comparison at verification: 37 ahead / 0 behind

Acceptance

• focused hostile/positive queue-health identity suite remains GREEN;
• fix(security): prove GitHub API URL authority #2279 owner security contract remains unchanged and GREEN;
• exact-head SAST, Python Security, CodeQL, Security Scan, and Runtime Quality must complete normally;
• qualifying independent current-head review remains required;
• keep Draft until hosted evidence and review requirements are satisfied.

No force-push, destructive rebase, unchanged-head rerun, source-neutral wake commit, scanner suppression, self-approval, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head RED authority for 385923f0818be44107322ac1c36ee2663c2c1468: the new regression exercises production load_allowlist() rather than a replacement regex. Protected-base actions_queue_health_core.py still uses ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ and _repository_name() rejects only components exactly . or .., so ContextualWisdomLab/repository. and ContextualWisdomLab/repo..name remain admitted. Keep this PR Draft until the minimum production parser fix and fresh exact-head checks turn that RED GREEN; do not weaken the test or queue-health coverage.

[seonghobae]

Exact-head review: this is a valid source-level RED. scripts/ci/actions_queue_health_core.py still admits ContextualWisdomLab/repository. and ContextualWisdomLab/repo..name because REPOSITORY_PATTERN allows dots anywhere inside the repository component and _repository_name() only rejects components exactly equal to . or ... The new production-path regression through load_allowlist() therefore exercises a real admission defect rather than a replacement-regex assertion. Minimum causal repair remains the repository-component predicate only; preserve the queue-health read-only boundary, allowlist semantics, pagination/identity fail-closed behavior, and existing security/quality gates. Current Security Scan, SAST, CodeQL PR, and Python Security runs are still queued, so no hosted GREEN is inferred from this review.

[seonghobae]

Follow-up finding: the new RED covers non-canonical repository-name components but not the owner component, while _repository_name() validates the generic owner/repository identifier and the same permissive character pattern applies on both sides of /. Current production therefore also admits ContextualWisdomLab./repository and Contextual..WisdomLab/repository. Add those hostile witnesses before the production repair so the fix cannot harden only the right-hand component. This remains test-scope RED; no gate weakening or production broadening is needed.

[seonghobae]

Cross-owner contract alignment: .github#2040 now carries the same embedded-dotdot hostile witnesses at exact c802a374220c6f454d70dea98c0ad4d676fe9cd8 (Contextual..WisdomLab/repository, ContextualWisdomLab/repo..name) in its scheduler identity RED. This does not merge the lanes: #2268 still owns queue-health _repository_name() / load_allowlist() production repair, while #2040 owns the scheduler regex and reconciliation. The shared invariant is now fixture-aligned on both sides without copying either production implementation.

[seonghobae]

Exact-head source review: 142e5b2617778e79f665693be1e6f8c04d7533aa is the minimum causal production repair for the established RED. The candidate was constructed against c754daf..., inspected before ref movement, and compares as ahead 1 / behind 0 with exactly one production file and one changed line (+1/-1). _repository_name() now applies the component invariant symmetrically after the existing full-name grammar: any owner/repository component containing .. or ending in . is rejected, while .github and ordinary interior single dots remain admissible. No queue-health collection, pagination, exact-head identity, or read-only behavior changed. This review does not transfer predecessor evidence or claim hosted GREEN: the naturally-created Security Scan, SAST, Python Security, and CodeQL PR runs for this exact head are still queued, and qualifying independent review remains required before merge.

[seonghobae]

Exact-head hosted RCA for 142e5b2617778e79f665693be1e6f8c04d7533aa: SAST Semgrep run 35352222809 is now terminal failure, but the job completed exact-head checkout/verification, the Semgrep scan, SARIF filtering/upload, and finding reporting successfully; it failed only at Enforce Semgrep gate (fail on Medium+ findings). This is not evidence that the queue-health one-line repository-identity repair is defective. The branch still carries the protected-base central SAST blockers owned by #2269/#2272, so treat this result as a cross-owner prerequisite rather than churn actions_queue_health_core.py, broaden suppressions, or rerun/wake the unchanged head. Keep #2268 Draft. Its queue-health source delta remains the canonical repaired slice for later #2040 adopt/adapt; fresh exact-head acceptance must be reacquired after the central SAST/authenticated-request successor converges.

[seonghobae]

Fresh RCA: SAST run 35352222809 is terminal FAILURE; Semgrep job 105622840267 reports exactly two repo-wide python.lang.security.audit.dynamic-urllib-use-detected findings at scripts/ci/codeql_ghas_configuration_identity.py:158 and scripts/ci/strix_evidence_binding.py:261. This is not evidence that #2268's repository-identity repair is wrong, and an unchanged-head rerun would be blind. Canonical shared-sink owner is already open Draft #2272 exact 5b9e8642361818769d58af6f4e17a6087c90f6ad, which changes both helpers and their contracts. Keep #2268 source-stable; its SAST lane is blocked on #2272's causal redirect/effective-destination repair reaching protected main, followed by a fresh compatible exact-head run. Do not duplicate the sink fix here or transfer #2272 evidence.

[seonghobae]

Fresh consumer-side prerequisite audit: this owner lane remains source-stable, but the PR body’s hosted-evidence paragraph is stale. Exact-head Security Scan 35352222783 is terminal success; Python Security 35352222876, SAST 35352222809, and CodeQL PR 35352222726 are terminal failures, not queued. Keep Draft and do not transfer Security Scan success across the failed gates or any future reconciliation. Shared #2279 foundation has also advanced ordinarily to a newer exact head and is still pending its own hosted acceptance. Any later adoption into scheduler owner #2040 must remain path-wise and preserve this repaired queue-health identity slice without copying mutable heads wholesale.

[seonghobae]

Fresh owner-lane evidence update on exact 142e5b2617778e79f665693be1e6f8c04d7533aa: the PR body still describes the hosted security lanes as queued, but they are terminal. Security Scan 35352222783 is SUCCESS; Python Security 35352222876, SAST Semgrep 35352222809, and CodeQL PR 35352222726 are FAILURE. Python Security reached real gates rather than failing at setup: pip-audit fails at Run pip-audit (hard gate on any known vulnerability), while Bandit successfully produces/uploads SARIF and then fails Enforce bandit gate (fail on MEDIUM+ findings). Treat these as RCA/fix inputs, not rerun noise; do not call #2268 accepted or transfer this source slice into #2040 as GREEN until the owner failures are causally repaired and exact-head evidence is reacquired.

[seonghobae]

P1 dependency/single-writer finding on exact head 142e5b2617778e79f665693be1e6f8c04d7533aa.

The terminal security failures are not caused by this PR's two queue-health files. SAST run 35352222809, job 105622840267 reports exactly two unsuppressed dynamic-urllib-use-detected findings at scripts/ci/codeql_ghas_configuration_identity.py:158 and scripts/ci/strix_evidence_binding.py:264. Python Security run 35352222876, Bandit job 105746160782 independently reports two MEDIUM/HIGH-confidence B310 findings at the same dynamic URL-open boundary.

Canonical owner #2279 exact d1e4380c15e948aaf104d46aa134fa614058782a changes those exact production files and adds the production-opener authority/redirect fixtures plus gap-baseline doctoring. This head and #2279 are currently diverged (ahead 4 / behind 32, merge-base 64aa08d7fa487deacd41c761c36277ca68cab6c9), so #2268 cannot inherit that repair or any hosted evidence yet.

Acceptance order: settle #2279 normally first; then non-force restack this unique queue-health identity delta onto the accepted foundation, preserving only scripts/ci/actions_queue_health_core.py and tests/test_actions_queue_health_repository_identity.py; update the PR/ADR-gap dependency record; and reacquire exact-head SAST/Bandit/CodeQL/quality evidence. Do not copy the shared URL clients, transfer #2279 receipts, or rerun this unchanged divergent head. The pip-audit failure is a separate terminal owner input and is not claimed repaired by this dependency finding.

[seonghobae]

Exact-head owner-integration review for 7822a7f077d2ebf07c579c855da9d6837a10b1ed (COMMENT, not approval).

The prior exact-head SAST/Python Security failures were independently reproduced as the two inherited dynamic urllib boundaries in the CodeQL GHAS identity and Strix evidence clients. Canonical owner PR #2279 repairs those boundaries with fail-closed HTTPS authority validation, no-redirect production openers, hostile fixtures, and published-lineage evidence. This branch now preserves the complete current owner head d1e4380c15e948aaf104d46aa134fa614058782a as the second parent of an ordinary merge; it is retargeted to fix/github-api-url-boundary, so the effective consumer delta remains only:

• scripts/ci/actions_queue_health_core.py
• tests/test_actions_queue_health_repository_identity.py

Exact tree 4c75b6fc733b20acc42f3082afbcb20aa089b7e8 verification:

• focused queue-health + CodeQL/Strix URL-authority suites: 174 passed
• same focused suite with GITHUB_ACTIONS=true: 174 passed
• full GITHUB_ACTIONS=true warnings-as-errors suite: 3379 passed, 28 skipped, 40 subtests
• compileall and diff check: PASS
• protected main comparison at verification: 37 ahead / 0 behind
• unresolved review threads: 0

The hosted exact-head CodeQL, Runtime Quality, Security Scan, SAST, and Python Security runs are newly queued. No qualifying current-head approval exists, so this evidence does not authorize Ready or merge.

[seonghobae]

Exact-head protected-base reconciliation review at 7d8a2a823f8dff523d749eb56965b001f4be53b5 (COMMENT, not approval).

The prior head 7822a7f... preserved canonical owner d1e4380c..., but after #2279 merged the live protected base became main@e6334e229581a918e2f22de18733b76fa65d7e71. Fresh compare showed the prior head was ahead 5 / behind 1 with merge base d1e4380c...; therefore its queued runs could not prove current protected-base ancestry.

This ordinary two-parent successor records the prior head and protected merge commit as parents while preserving tree 4c75b6fc733b20acc42f3082afbcb20aa089b7e8 byte-for-byte. Pre-ref checks established:

• predecessor → successor: no file changes;
• protected main → successor: ahead 6 / behind 0, merge base exactly protected main;
• effective diff remains exactly scripts/ci/actions_queue_health_core.py and tests/test_actions_queue_health_repository_identity.py.

Fresh CodeQL 35453297707, Python Security 35453297725, SAST 35453297864, and Security 35453297869 are queued/nonterminal. Keep Draft until terminal exact-head hosted evidence and a qualifying independent approval; no predecessor result transfers.