fix(codeql): collect complete fail-closed GHAS analysis history

.Jules/palette.md

@@ -1,3 +1,5 @@
-## 2024-05-20 - Repository without UI Codebase
-**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
-**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.
+## 2026-09-29 - Product UI boundary confirmed
+
+**Learning:** This repository owns the ContextualWisdomLab GitHub Actions control plane, including production CI scripts, tests, workflows, and documentation. It does not own an interactive product UI or frontend application.
+
+**Action:** Do not invent product UI work in this repository. Improve the control-plane artifacts here and route reusable product UI work to its canonical product owner.

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+# Source validation only; labels do not attest runtime isolation.
+self-hosted-runner:
+  labels:
+    - cwlab-ci-isolated
+    - cwlab-control

.github/actions/noema-review/two_phase.py

@@ -156,6 +156,7 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
         return 0
     expected_base = _canonical_base(pull_request)
     actor = _reviewer_actor()
+    author = gate.require_distinct_pr_author(pull_request, actor)
     if pull_request.get("isDraft"):
         print("PR is draft; Noema verdict preparation skipped.")
         return 0
@@ -190,6 +191,8 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number": number,
             "expected_head": expected,
             "expected_base": expected_base,
+            "reviewer_actor": actor,
+            "pull_request_author": author,
             "verdict": verdict,
         },
     )
@@ -250,6 +253,8 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number",
             "expected_head",
             "expected_base",
+            "reviewer_actor",
+            "pull_request_author",
             "verdict",
         }
         if set(payload) != required_keys:
@@ -277,6 +282,14 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             print("Pull request base advanced after model review; stale prepared verdict was not published.")
             return 0
         actor = _reviewer_actor(allow_refreshed_app=True)
+        author = gate.require_distinct_pr_author(current_pull_request, actor)
+        if payload["pull_request_author"] != author:
+            raise RuntimeError("Noema pull request author changed after verdict preparation")
+        reviewer_actor = payload["reviewer_actor"]
+        if not isinstance(reviewer_actor, str) or not reviewer_actor.strip():
+            raise RuntimeError("Noema prepared reviewer actor is invalid")
+        if reviewer_actor.strip().casefold() != actor.strip().casefold():
+            raise RuntimeError("Noema refreshed reviewer actor differs from verdict preparation")
         if current_pull_request.get("isDraft"):
             print("PR became draft after model review; prepared verdict was not published.")
             return 0

.github/runner-images/law-ai-agent/Dockerfile

@@ -0,0 +1,8 @@
+FROM ghcr.io/actions/actions-runner@sha256:e5496277be5d09bc968b3d64911b74e219ac4a3f2edce956a3ecf9271bea1ef4
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-16 postgresql-client-16 libpq-dev python3-venv ca-certificates git curl \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+USER runner
+WORKDIR /home/runner

.github/workflows/actions-queue-health.yml

@@ -15,7 +15,9 @@ permissions:
 jobs:
   collect:
     name: Collect exact-head queue evidence
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/agent-mention-noema-dispatch.yml

@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -28,7 +28,9 @@ permissions:
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -13,7 +13,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
   push:
     branches: [main]
     paths:
@@ -26,7 +29,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 concurrency:
   group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
@@ -40,7 +46,9 @@ env:
 
 jobs:
   quality:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     steps:
       - name: Harden runner

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
     paths:
       - ".github/workflows/agent-review-runtime-quality-ci.yml"
+      - "scripts/ci/codeql_ghas_configuration_identity.py"
+      - "tests/test_codeql_ghas_configuration_identity.py"
+      - "tests/test_codeql_ghas_analyses_pagination.py"
+      - "tests/test_github_api_url_boundary.py"
       - ".github/workflows/noema-review.yml"
       - ".github/actions/noema-review/two_phase.py"
       - "tests/test_noema_reviewer_token_lifetime.py"
@@ -60,9 +64,17 @@ on:
       - "scripts/ci/zdr_policy.py"
       - "scripts/ci/contextual_orchestrator_review_policy.py"
       - "scripts/ci/contextual_orchestrator_review_launcher.py"
+      - "scripts/ci/personal_review_route.py"
       - "scripts/ci/contextual_orchestrator_review_sidecar.sh"
       - "tests/test_zdr_policy.py"
       - "tests/test_contextual_orchestrator_review_policy.py"
+      - "tests/test_contextual_orchestrator_review_launcher.py"
+      - "tests/test_review_auto_route.py"
+      - "tests/test_personal_review_route.py"
+      - "tests/test_tokyo_review_consumer.py"
+      - "tests/test_review_auto_cost_admission.py"
+      - "tests/test_review_ai_app_independence.py"
+      - "tests/test_review_preflight_concurrency.py"
       - "tests/test_contextual_orchestrator_review_sidecar_contract.py"
       - "tests/test_sidecar_disk_free_guard.py"
       - "tests/test_hourly_review_repair_callers.py"
@@ -116,9 +128,11 @@ on:
       - "docs/doctoring/exact-artifact-sbom-attestation.md"
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
+      - "requirements-opencode-review-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
       - "requirements-noema-document-ci.txt"
       - "requirements-noema-document-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -132,7 +146,9 @@ permissions:
 jobs:
   agent_review_runtime_quality:
     name: agent-review-runtime-quality
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 25
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -173,6 +189,7 @@ jobs:
           review_repair_suite=false
           commercial_readiness_suite=false
           exact_artifact_suite=false
+          ghas_suite=false
 
           while IFS= read -r changed_path; do
             case "$changed_path" in
@@ -184,6 +201,14 @@ jobs:
                 review_repair_suite=true
                 commercial_readiness_suite=true
                 exact_artifact_suite=true
+                ghas_suite=true
+                ;;
+              scripts/ci/codeql_ghas_configuration_identity.py|\
+              tests/test_codeql_ghas_configuration_identity.py|\
+              tests/test_codeql_ghas_analyses_pagination.py|\
+              tests/test_github_api_url_boundary.py|\
+              tests/test_agent_review_runtime_quality_consolidation.py)
+                ghas_suite=true
                 ;;
               tests/test_pr_review_autofix_nvidia_nim_contract.py)
                 opencode_suite=true
@@ -237,11 +262,13 @@ jobs:
               tests/test_strix_quality_timeout_fixture_budget.py)
                 strix_suite=true
                 ;;
-              requirements-opencode-review-ci-hashes.txt)
+              requirements-opencode-review-ci.txt|\
+              requirements-opencode-review-ci-hashes.txt|\
+              requirements-noema-document-ci.txt|\
+              scripts/ci/compile_opencode_review_lock.sh)
                 noema_suite=true
                 opencode_suite=true
                 ;;
-              requirements-noema-document-ci.txt|\
               requirements-noema-document-ci-hashes.txt)
                 noema_suite=true
                 ;;
@@ -264,9 +291,17 @@ jobs:
               scripts/ci/zdr_policy.py|\
               scripts/ci/contextual_orchestrator_review_policy.py|\
               scripts/ci/contextual_orchestrator_review_launcher.py|\
+              scripts/ci/personal_review_route.py|\
               scripts/ci/contextual_orchestrator_review_sidecar.sh|\
               tests/test_zdr_policy.py|\
               tests/test_contextual_orchestrator_review_policy.py|\
+              tests/test_contextual_orchestrator_review_launcher.py|\
+              tests/test_review_auto_route.py|\
+              tests/test_personal_review_route.py|\
+              tests/test_tokyo_review_consumer.py|\
+              tests/test_review_auto_cost_admission.py|\
+              tests/test_review_ai_app_independence.py|\
+              tests/test_review_preflight_concurrency.py|\
               tests/test_contextual_orchestrator_review_sidecar_contract.py|\
               tests/test_sidecar_disk_free_guard.py|\
               tests/test_hourly_review_repair_callers.py|\
@@ -336,6 +371,7 @@ jobs:
             echo "review_repair=$review_repair_suite"
             echo "commercial_readiness=$commercial_readiness_suite"
             echo "exact_artifact=$exact_artifact_suite"
+            echo "ghas=$ghas_suite"
           } >>"$GITHUB_OUTPUT"
 
       - name: Install exact hash-verified base dependencies
@@ -444,11 +480,19 @@ jobs:
             --cov=scripts.ci.pr_review_autofix_context \
             --cov=scripts.ci.zdr_policy \
             --cov=scripts.ci.contextual_orchestrator_review_policy \
+            --cov=scripts.ci.contextual_orchestrator_review_launcher \
             --cov-branch \
             --cov-fail-under=100 \
             tests/test_pr_review_conflict_scope.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \
@@ -488,6 +532,13 @@ jobs:
             scripts/ci/contextual_orchestrator_review_launcher.py \
             tests/test_zdr_policy.py \
             tests/test_contextual_orchestrator_review_policy.py \
+            tests/test_contextual_orchestrator_review_launcher.py \
+            tests/test_review_auto_route.py \
+            tests/test_personal_review_route.py \
+            tests/test_tokyo_review_consumer.py \
+            tests/test_review_auto_cost_admission.py \
+            tests/test_review_ai_app_independence.py \
+            tests/test_review_preflight_concurrency.py \
             tests/test_contextual_orchestrator_review_sidecar_contract.py \
             tests/test_sidecar_disk_free_guard.py \
             tests/test_hourly_review_repair_callers.py \
@@ -568,6 +619,21 @@ jobs:
             tests/test_verify_exact_artifact_sbom_handoff.py \
             tests/test_exact_artifact_quality_single_runner.py
 
+      - name: Verify GHAS identity, pagination, and API boundary contracts
+        if: steps.affected_suites.outputs.ghas == 'true'
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          set -euo pipefail
+          python -m pytest -q \
+            tests/test_codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_analyses_pagination.py \
+            tests/test_github_api_url_boundary.py
+          python -m compileall -q \
+            scripts/ci/codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_configuration_identity.py \
+            tests/test_codeql_ghas_analyses_pagination.py \
+            tests/test_github_api_url_boundary.py
+
       - name: Verify consolidated workflow contract
         run: |
           set -euo pipefail

.github/workflows/audit-central-ruleset.yml

@@ -25,7 +25,9 @@ permissions:
 jobs:
   audit:
     name: Audit organization ruleset 18156473
-    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     env:
       GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
     steps:

.github/workflows/cloudflare-dns.yml

@@ -44,7 +44,9 @@ permissions:
 jobs:
   reconcile:
     name: Reconcile zones (${{ github.event.client_payload.mode || 'dry-run' }})
-    runs-on: ubuntu-latest
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0