docs(gap): correct CodeQL dispatch evidence

Author: seonghobae

docs/product-technical-gap-live-refresh-2026-09-07.md

@@ -43,8 +43,8 @@ latest immutable release have not moved since the 2026-09-05 supplement.
 | Gap / bounded context | Exact evidence | Action | Status |
 | --- | --- | --- | --- |
 | Central scheduler REST workflow identity | `ContextualWisdomLab/.github#1986` exact head `4604909a9b68cb29cda431d71bc0ed3d37f11af3`, protected base `c9052e607e5f3cc76e73207e7786b21500721b79`, two changed files | Preserve per-workflow parallelism while coalescing concurrent reads for one `(repository, workflow_id)`; treat a deleted workflow's HTTP 404 as an absent static identity while propagating other failures | **Ready, auto-merge armed behind protection.** RED reproduced 11 duplicate reads and 404 propagation. GREEN: 21 focused tests; scheduler aggregate 349 passed; repository 2,990 passed / 1 skipped / 21 subtests; coverage and public-doc checks 100%. Hosted exact-head security/review checks remain non-terminal and no current-head approval exists. |
-| Review and CodeQL dispatch identity | `ContextualWisdomLab/.github#1929`; `#1986@4604909a9b68cb29cda431d71bc0ed3d37f11af3` successfully created dispatch runs `34066603914` and `34066634411` | Preserve actor=sender validation; prove both runs reach terminal same-repository status publication, then prove the cross-repository credential path independently | **Identity admission has advanced; issue remains open.** The new dispatches passed request creation but remain queued. This supersedes the earlier “blocked at the actor allowlist” status. Cross-repository commit-status publication previously received HTTP 403 and remains unproven. |
-| CodeQL rerun recovery | `ContextualWisdomLab/.github#1902` exact head `3549de595c9d7615b253e03fc18ee06f34d3d294`, tree `08661ee1e65295e07a69620292a764e0f9cb15e9`, five CodeQL-owned paths | Use complete paginated status history and trusted creator/context identity; if no terminal verdict exists, perform one bounded redispatch instead of treating `run_attempt` as a receipt | **Ready, ordinary auto-merge armed.** Focused 12 passed; repository 2,979 passed / 1 skipped / 21 subtests; coverage and public-doc checks 100%. Hosted exact-head checks and independent review remain non-terminal. |
+| Review and CodeQL dispatch identity | `ContextualWisdomLab/.github#1929`; terminal validation jobs from dispatch runs `34066603914` and `34066634411` reported `actor=sender=opencode-agent[bot]` but `allowed=github-actions[bot]` | Preserve actor=sender=one reviewed identity; configuration owner adds `opencode-agent[bot]` to `OPENCODE_REPOSITORY_DISPATCH_ACTOR`, then reruns an unchanged consumer and separately repairs the cross-repository status credential | **Configuration repair required; issue remains open.** Both dispatches were created but then failed authorization before scan, so receipt creation was not identity admission. Their scan jobs were skipped. A prior brief allowlist-open window reached the SARIF gate but cross-repository status publication failed HTTP 403. This corrects the earlier queued-run inference in this same snapshot. |
+| CodeQL rerun recovery and SARIF evidence boundary | `ContextualWisdomLab/.github#1902` exact head `82ca0b8fe67177a98ca01f8dc12441c782f1760f`, tree `596d8eaecbdee367192ebd7a62d3cc47c0140492`, eight CodeQL-owned paths | Use complete paginated status history and trusted creator/context identity; redispatch once when no terminal verdict exists; require the same shard's SARIF upload outcome to be `success` before terminal status publication or exact-job wake | **Ready, ordinary auto-merge armed.** RED reproduced false success publication for upload failure/skipped/cancelled/empty. GREEN: 36 focused CodeQL contracts; repository 2,984 passed / 1 skipped / 21 subtests; statement/branch coverage and public-doc checks 100%. These are local exact-tree checks; hosted scan/upload/callback checks and independent review remain non-terminal. |
 | Scheduler live-PR and Strix rerun identity | `ContextualWisdomLab/.github#1999` exact head `ed8ab26b53792386e4578fcfbd3bdf1632cff54c`, tree `9619c391252b95b1118f2d81ed60c445e307bdbf`, seven scheduler-owned paths | Require an explicitly open live PR and bind reruns to the verified failed Strix job identity | **Ready, ordinary auto-merge armed.** This is the complete successor carryover of valid scheduler/Strix commits formerly mixed into #1902. Focused 394 passed; repository 3,039 passed / 1 skipped / 21 subtests; coverage and public-doc checks 100%. |
 | Immutable release SBOM and provenance | `fast-mlsirm#1692` exact head `a6ac0f49d5123244fe89f26748a65f551ad9d514`, protected base `493326f2de49ea1704da0ded19868ed05d2fe00f`, 12 changed files | Restore an authenticated current-head CodeQL dispatch verdict at the central owner, obtain a qualifying approval on the unchanged current head, then ordinary merge and release verification | **Source-ready, control-plane blocked.** Repository CI, native CodeQL, Security Scan, Semgrep, mergeability, and all review threads are GREEN/resolved. `CodeQL PR` run `34020936743` fails closed because a rerun has no authenticated terminal verdict; predecessor approval does not transfer. |
 | Rust-owned local-dependence public API | `fast-mlsirm#1748` exact head `ef2dd4baa11027c43fccc448a8eb07e4dca6e104`, protected base `493326f2de49ea1704da0ded19868ed05d2fe00f`, 14 changed files | Re-fetch current-head scientific recovery, public-contract, coverage, security, and independent-review evidence before merge | **Ready and mergeable; not yet revalidated in this supplement.** The prior supplement's older head and checks are historical only. |
@@ -65,10 +65,10 @@ by the consuming product.
 
 ## Next safe sequence
 
-1. Let the two `.github#1986` dispatch runs reach terminal state and prove
-   same-repository status publication; then prove the cross-repository path
-   tracked by `.github#1929`.
-2. Let `.github#1902` and `.github#1999` acquire exact-head hosted checks
+1. Repair the exact dispatcher identity setting tracked by `.github#1929`
+   without weakening actor=sender validation, rerun an unchanged consumer, and
+   then repair and prove the separate cross-repository HTTP 403 status path.
+2. Let `.github#1902@82ca0b8f` and `.github#1999` acquire exact-head hosted checks
    and independent review; ordinary auto-merge is armed behind protection.
 3. Revalidate `fast-mlsirm#1692` on its unchanged head after the owner repair,
    merge ordinarily, and