fix(security): scope CodeQL to authored code instead of the captured upstream evidence trees (#240)

The promotion PR (#236) is blocked by a CodeQL failure — "1 new alert including 1
high severity security vulnerability":

  js/incomplete-sanitization (high)
  specs/_vendor/mcp-spec-docs/snapshot.html:61
  "This does not escape backslash characters in the input."

That file is not our code. It is a verbatim captured copy of a
modelcontextprotocol.io page, fetched by scripts/fetch-capture.py and committed as
the EVIDENCE that the spec said what we claim it said on a given date. The alert
is about bundled JavaScript inside someone else's documentation site.

WHY THIS IS UNACTIONABLE BY CONSTRUCTION, NOT MERELY INCONVENIENT

The only way to "fix" the alert is to edit a capture — which corrupts the
provenance every drift comparison and every re-vendor decision depends on. It
would also fail the gate added one commit ago
(scripts/check-vendor-meta-integrity.py), which exists precisely to make an edited
capture fail loudly against its recorded sha256.

So the choices were: leave a permanent red on every promotion PR, edit evidence,
or scope the scanner to code we actually author. The first is the failure mode
this whole track keeps being repaired from — a red lane people learn to ignore —
and the second is worse than the alert.

WHAT CHANGED

New .github/codeql-config.yml with paths-ignore for the capture tiers
(specs/_vendor/**, archive/**, _vendor/**), wired via the init action's
config-file. Nothing under those paths is imported, executed, packaged or served;
the extractors read them as text.

Chose a path-scoped config over dismissing the individual alert because the next
captured page carrying bundled JS re-raises it, and over disabling
security-extended because that would weaken the scanner on code we DO write. This
narrows WHAT is scanned, not HOW strictly.

Deliberately NOT excluded: scripts/, research/, and every workflow. Verified the
exclusion hides no authored code — of 66 tracked .py/.js/.ts/.sh files, the only
one now out of scope is specs/_vendor/mcp-schema-ts/snapshot.ts, itself a captured
upstream schema.

ALSO

Corrected the workflow header, which still described CodeRabbit as the
complementary reviewer. CodeRabbit is retired and, as of 2026-07-22, NO AI
reviewer runs on this repo (Gemini sunset, Greptile dark). CodeQL owns security;
correctness and design are the repo's own CI plus human review. Leaving that
comment in place would keep implying a review layer that does not exist.

Verified: both YAML files parse; the open-alert inventory is exactly one alert and
it is in a captured file; audit-harness verify OK after init (1 hash line changed,
the one workflow edited). The config's effect is confirmed by this PR's own CodeQL
run.

Co-authored-by: jeremylongshore <jeremylongshore@users.noreply.github.com>

Author: jeremylongshore

.github/codeql-config.yml

@@ -0,0 +1,29 @@
+# CodeQL configuration for intent-eval-lab.
+#
+# WHY THIS FILE EXISTS
+#
+# This repo deliberately commits THIRD-PARTY BYTES it did not write and must not
+# edit: the spec-drift capture tiers. `specs/_vendor/<surface>/snapshot.*` and
+# `archive/raw/**` are verbatim upstream pages fetched by scripts/fetch-capture.py
+# — HTML with bundled/minified JS, atom feeds, JSON schemas — retained as the
+# EVIDENCE that a spec said what we claim it said on a given date.
+#
+# CodeQL analysing them produces high-severity alerts about other people's
+# bundled JavaScript (e.g. js/incomplete-sanitization in
+# specs/_vendor/mcp-spec-docs/snapshot.html, a captured modelcontextprotocol.io
+# page). Those alerts are unactionable by construction, and worse than
+# unactionable: the only way to "fix" one is to edit a capture, which corrupts the
+# provenance record every drift comparison and every re-vendor decision depends on
+# — and scripts/check-vendor-meta-integrity.py exists precisely to make such an
+# edit fail loudly.
+#
+# So this is not weakening the scanner. It is scoping it to code this repo
+# AUTHORS and EXECUTES. Nothing under these paths is imported, executed, packaged
+# or served; the extractors read them as text.
+#
+# Deliberately NOT excluded: scripts/, research/, and every workflow — the code we
+# actually write stays fully in scope, on the security-extended suite.
+paths-ignore:
+  - specs/_vendor/**
+  - archive/**
+  - _vendor/**

.github/workflows/codeql.yml

@@ -1,8 +1,13 @@
 name: CodeQL
 
 # Security scanning ONLY (security-extended query suite — no quality/maintainability
-# queries). Code-quality, design, and correctness review is CodeRabbit's job (see
-# .coderabbit.yaml); the two are intentionally non-overlapping. Free on public repos.
+# queries). Free on public repos.
+#
+# The counterpart this comment used to name (CodeRabbit) is retired, and as of
+# 2026-07-22 NO AI reviewer runs on this repo — Gemini Code Assist is sunset and
+# Greptile is dark. CodeQL owns security; correctness and design review is the
+# repo's own CI (partner-name guard, spec-drift gates, projection freshness,
+# vendor-meta provenance, scripts/tests) plus human review.
 
 on:
   push:
@@ -39,6 +44,10 @@ jobs:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-extended
+          # Scopes analysis to code this repo authors and executes. The captured
+          # upstream trees are third-party bytes retained as evidence and must
+          # never be edited — see .github/codeql-config.yml for the full reasoning.
+          config-file: ./.github/codeql-config.yml
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
         with:

.harness-hash

@@ -6,7 +6,7 @@ add245f35fb0dbd63d5ab475020bb367b53be4c611eb509d614c8a1f5ca8ea32  .audit-harness
 d29a2e9b94f7fd94f4f8953314323f96ca424cbaa6a985f6783b48ee2feae0f8  .audit-harness/scripts/gherkin-lint.sh
 9c588a980e89dbc9ea2bcf0992daff51ec72b926ecb1644e21838b9fc5c2883d  .audit-harness/scripts/harness-hash.sh
 5b912f59eeef3c9b5f7de98d8ae27a0d8b2eeb03411f34d9fa0e205d061b7f7f  .github/workflows/ci.yml
-7342d70d8e4a3531262c71127b6c285406807b677cc8f404c580fed9ed5349f7  .github/workflows/codeql.yml
+a349d30f7da0d4f6d2b6c7b6011115b8c0e474a30f820bc1354a7efaa10b2c37  .github/workflows/codeql.yml
 a47735f905b1463c148d0b71f5db852beec873782be18b6d1e7a55ec54a1baf4  .github/workflows/doc-quality.yml
 592a86e79d00a0bbbaed2e20d2fba91aba6744baa4cfb8222ea41fe422543fce  .github/workflows/e2e-integration.yml
 43194d2f4ce1c37f70b4db099262149a4cd28f541eaa363f73adf05801b89935  .github/workflows/harness-hash-verify.yml