[Lopu] Complete single-entry listeners and all-target CodeQL

[lopugit]

Outcome

Completes the post-merge activation audit for #397.

• Removes the last product rebase, promotion, and main/develop sync workflow entries; Lopu PR manager is the one public repository-management entry.
• Routes CI Control rebase, promotion, and sync operations into typed Lopu inputs.
• Keeps normal pull_request CodeQL checks associated with the PR while sending arbitrary-target metadata through the separate protected handoff.
• Preserves seven deterministic thin product listeners and no product-branch Actions scripts.

Dependency

Merge #403 into github-actions first. It publishes the new protected CodeQL handoff and fixes the durable Lopu queue. This PR then activates those references on main; its main push will let the corrected controller synchronize main into develop.

Validation

• node remix/scripts/workflow-caller-contract.mjs — 7 listeners
• corepack pnpm --dir remix run test:ci-control — 20/20 passing
• all product workflow YAML parsed successfully
• Graphify semantic refresh: 28,315 nodes / 71,088 edges, 1,218 communities

Do not enable advanced CodeQL yet. After #403 and this PR merge, verify the listener runs, set CODEQL_CENTRAL_PR_ENABLED=true, disable default setup, then set CODEQL_ADVANCED_ENABLED=true.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview	Aug 25, 2026 11:08am
thingtime (develop)	Ready	Preview	Aug 25, 2026 11:08am

[github-actions]

✅ Develop S3 preview ready

• Commit: b5a7a275
• Environment: Vercel Custom Environment develop
• Preview: https://pr-404.previews.dev.thingtime.com
• Immutable deployment: https://thingtime-8dayex03j-lopugits-projects.vercel.app
• Vercel status: open deployment

The alias passed the develop bucket CORS preflight and a final live PR/SHA fence.

Generic Vercel Preview deployments use the shared development runtime; this controller adds the stable exact-SHA alias and marker-scoped cleanup.

[github-actions]

🤝 Merged main into promote/pr-394-codeql-all-branches--to-main to bring this PR up to date via Lopu's PR manager.

No AI resolution was needed by merge time; the branch was updated with a plain merge commit.

Rebuilt and committed the merged code graph with graphify update .. LLM semantic extraction was attempted afterward but failed; the valid structural result was preserved (see the workflow log).

Please review the merge commit before relying on it.

[github-actions]

Lopu repository review

Lopu reviewed this PR against main as Thingtime's principal PR and repository manager. Backend: Claude Code default.

Lopu found no justified local change to publish from this review pass.

Lopu also opened a controller/workflow repair PR for the failed check root cause.

Lopu review — PR #404 · [Lopu] Complete single-entry listeners and all-target CodeQL

Compared: b5a7a275 (head) against 3f58b43f (main) — 27 files, of which
7 carry the change and 20 are regenerated graphify-out/.

Authorized promotion PR. Head promote/pr-394-codeql-all-branches--to-main,
target main — the per-feature promotion train's own output, so targeting
main is correct here and I left the base alone (unlike #180 and #410 in this
batch, which I retargeted to develop).

Checks: no red marks. The only non-pass is
control-plane / Lopu builds and repairs the all branch, pending (run
32840527741). MERGEABLE / BLOCKED is that pending required check, not a
failure.

CodeQL: 0 open alerts on this head. Nothing to fix or disposition.

Verdict

No changes needed. The consolidation is correct and — unusually — it is
pinned rather than merely intended: workflow-caller-contract.mjs grows
assertions for every structural claim the change makes.

What I verified

The repository_dispatch handoff stays unbroken across the deletion. This
PR deletes .github/workflows/rebase-pr-stacks.yml (the
repository_dispatch: [rebase-pr-stack-ai] listener) from main, and in the
same commit adds rebase-pr-stack-ai to resolve-pr-conflicts.yml's
repository_dispatch.types. That matters more than it looks: repository_dispatch
only ever runs workflows on the default branch, and I confirmed the default
branch is main. So the delete and the re-route land atomically on the exact
ref that receives the event — no window where a rebase-pr-stack-ai dispatch
falls on the floor.

The CodeQL listener split is sound. pull_request_target now routes to
codeql-pr-handoff.yml@github-actions (metadata-only), while control-plane
is gated to github.event_name != 'pull_request_target' so read-capped PR
events reach only the unprivileged analyzer. The two if: guards are exact
complements, so every event still has exactly one handler — no double-analysis,
no gap. codeql-pr-handoff.yml exists on github-actions, so the pin
resolves.

The contract file earns its keep. Beyond the mapping assertions, it now
pins that the CodeQL listener is executable-code-free
(assert.doesNotMatch(/^\s+runs-on:|^\s+steps:|^\s+run:/m)), that it
references no .github/actions|scripts behavior file, and that it has
exactly two uses: — one analysis call, one handoff call. That is the
right way to keep a thin listener thin: a future edit that smuggles a step into
a privileged listener fails CI instead of shipping. I ran
node scripts/workflow-caller-contract.mjs against this head — passes,
7 thin listeners pinned to github-actions.

The CI Control re-route is consistent. workflowFileByKey now maps
rebase-stack, promote-features, promote-develop and sync-main all onto
resolve-pr-conflicts.yml, with resolveCiWorkflowDispatch() translating each
into a maintenance_operation plus that operation's own allowlisted inputs
(and discarding anything not on the allowlist — the unexpected: 'discarded'
case is pinned by the new test). I checked the one asymmetry that could bite:
workflowEntryRef sends sync-main through main while the others go through
develop, so the same file is now entered at two different refs. That is
already anticipated downstream — resolve_promotion's if: explicitly accepts
resolve-pr-conflicts.yml@refs/heads/develop, @refs/heads/main, or
ref_name == 'github-actions'.

rebase_cascade defaults safely.
github.event_name != 'workflow_dispatch' || inputs.rebase_cascade means every
automatic Lopu event cascades (previous behaviour) and only an explicit CI
Control retry can opt out — the safe direction, and pinned by a contract
assertion.

Cross-PR finding — this PR and #395 fix the same symptom at different layers, and both are needed

While reviewing #395 (which repairs rebase-pr-stacks.yml's concurrency group
so two callers stop cancelling each other) I traced where its second
push-triggered caller actually comes from, and it lands squarely on this PR's
subject matter:

• main and develop already carry rebase-pr-stacks.yml as a
  repository_dispatch-only listener — no push trigger. This PR removes it
  from main entirely.
• The cancelled run fix(actions): Lopu repairs failed PR checks #395 cites (32807601456, path=.github/workflows/rebase-pr-stacks.yml,
  event=push, name="Rebase PR history") ran on the feature branch
  claude/action-thing-permissions-336bc0. I fetched that branch's copy of the
  file: it is the pre-consolidation listener, with
  on: push: branches: ["**"].

Push events run workflows from the pushed branch, so every open feature
branch cut before this consolidation still carries a second push-triggered
caller, and keeps colliding with resolve-pr-conflicts.yml's push listener
until it merges or rebases.

The practical consequence for sequencing:

• This PR removes the duplicate caller going forward, and is the durable
  fix.
• fix(actions): Lopu repairs failed PR checks #395 fixes the engine's concurrency group on github-actions, so it
  repairs every caller at once — including the stale feature branches that this
  PR cannot reach. It is the one that clears today's permanently-red checks
  without requiring every open PR to update first.

They are complementary, not redundant, and #395 is worth landing first because
its benefit is immediate and retroactive. Neither PR needs changing on account
of the other.

Note on the diff size

The +229220/−254863 headline is graphify-out/ regeneration, not review
surface. As on #412 and #289, graphify-out/graph.json (40.9 MB, ~1.03M lines)
is large enough that GitHub's own diff machinery struggles with it — see the
repository-health item in 289.md.

Changes made in the worktree

None. The change is correct, atomic across the default-branch dispatch
boundary, and self-pinning.

Validation

• node scripts/workflow-caller-contract.mjs at this head → passes.
• gh api repos/lopugit/thingtime --jq .default_branch → main, establishing
  that the repository_dispatch re-route lands on the right ref.
• git show <develop>:.github/workflows/rebase-pr-stacks.yml and the same at
  main → both repository_dispatch-only, confirming no push listener remains
  on the product branches.
• gh api repos/…/contents/.github/workflows/rebase-pr-stacks.yml?ref=claude/action-thing-permissions-336bc0
  → the pre-consolidation on: push: branches: ["**"] listener, which is what
  established the cross-PR finding above.
• gh api repos/…/actions/runs/{32807601456,32807601898} → both event=push
  on the same branch, one second apart, one cancelled.
• gh pr checks 404 → no failures; one pending fleet job.

— Lopu

View Lopu workflow run

[github-actions]

🦉 Lopu — coherent on main, and it closes a 422 I diagnosed elsewhere this round

Since this is an authorized promotion of already-reviewed #394, I focused on whether the result is coherent on main and whether the dispatch graph survives deleting a listener.

It does. repository_dispatch is delivered to workflows on the default branch, and after this PR resolve-pr-conflicts.yml on main declares the rebase-pr-stack-ai type. The control plane already matches: rebase-pr-stacks.yml:872 emits event_type: "rebase-pr-stack-ai", and resolve-pr-conflicts.yml declares it at :502 and routes on github.event.action == 'rebase-pr-stack-ai' at :625, :637, :672. So the receiving half is already deployed and this completes the main side. develop has no rebase-pr-stacks.yml at all, so this propagates an existing decision rather than making a new one.

The cascade default is right too: for repository_dispatch, github.event_name != 'workflow_dispatch' is true so rebase_cascade passes true, matching the deleted listener's hard-coded cascade: true.

This closes a real failure. PR #413's one genuine red check was gh: Workflow does not have 'workflow_dispatch' trigger (HTTP 422) against rebase-pr-stacks.yml/dispatches — main's listener declared only repository_dispatch. Removing that listener and consolidating on the one workflow that does carry workflow_dispatch closes that class of 422 at the source.

Note on promotion faithfulness

The promoted files don't match develop byte-for-byte, and shouldn't be expected to — main and develop legitimately carry different .github/workflows contents (main holds the thin public listeners; develop doesn't carry the rebase listener at all). I compared against both develop HEAD and #394's merge commit e4958702 and confirmed the divergence sits in the listener layer, not in the promoted application code (ciControl/githubClient.ts, its test, workflow-caller-contract.mjs). That's the expected shape for a per-feature promotion.

This and #395 are complementary, not overlapping

Flagging because they look redundant. #404 removes main's rebase listener; #395 fixes the concurrency group inside the reusable implementation on github-actions. Both are needed — the push-triggered collision producing the permanent red Find stack members that need rebasing checks comes from each feature branch's copy of rebase-pr-stacks.yml, since push events resolve the workflow from the pushed branch. Branches cut before the develop-side deletion still carry it; I confirmed that on #135's head.

No changes needed. Your two remaining entries are null — still-queued all-branch jobs, not failures.

[github-actions]

🤖 Lopu — consolidation looks right; two cross-PR notes

No changes requested. The workflow-caller-contract.mjs additions are the best part of this: pinning that the CodeQL listener is executable-code-free (assert.doesNotMatch(/^\s+runs-on:|^\s+steps:|^\s+run:/m)), references no .github/actions|scripts behavior file, and has exactly two uses: is the right way to keep a thin listener thin — a future edit that smuggles a step into a privileged listener fails CI instead of shipping. I ran node scripts/workflow-caller-contract.mjs at this head: passes, 7 thin listeners pinned to github-actions.

The detail I checked hardest: the repository_dispatch handoff stays unbroken across the deletion. This PR removes rebase-pr-stacks.yml (the repository_dispatch: [rebase-pr-stack-ai] listener) from main and adds rebase-pr-stack-ai to resolve-pr-conflicts.yml's types in the same commit. That matters more than it looks — repository_dispatch only ever runs workflows on the default branch, and I confirmed the default branch is main. So delete and re-route land atomically on the exact ref that receives the event; no window where a dispatch falls on the floor. The two CodeQL if: guards are exact complements too, so every event keeps exactly one handler.

1. This PR and #395 fix the same symptom at different layers — both are needed

While reviewing #395 (which repairs rebase-pr-stacks.yml's concurrency group so two callers stop cancelling each other) I traced where its second push-triggered caller actually comes from, and it lands on your subject matter:

• main and develop already carry rebase-pr-stacks.yml as a repository_dispatch-only listener — no push trigger. This PR removes it from main.
• The cancelled run fix(actions): Lopu repairs failed PR checks #395 cites (32807601456, path=.github/workflows/rebase-pr-stacks.yml, event=push, name="Rebase PR history") ran on the feature branch claude/action-thing-permissions-336bc0. I fetched that branch's copy of the file: it is the pre-consolidation listener, with on: push: branches: ["**"].

Push events run workflows from the pushed branch, so every open feature branch cut before this consolidation still carries a second push-triggered caller and keeps colliding with resolve-pr-conflicts.yml's push listener until it merges or rebases.

So: this PR is the durable fix (removes the duplicate caller going forward); #395 fixes the engine's concurrency group on github-actions, repairing every caller at once — including the stale branches this PR cannot reach. #395 is worth landing first because its benefit is immediate and retroactive. Complementary, not redundant; neither needs changing on account of the other.

2. ⚠️ Merge-order hazard with #289

This PR and #289 (develop → main) both modify .github/workflows/codeql-analysis.yml and .github/workflows/resolve-pr-conflicts.yml on main, and neither is a superset of the other. develop has moved further on the triggers (7 PT types vs 2, an extra 53 * * * * cron, build-all and backfill-codeql maintenance options), while this PR uniquely carries rebase_cascade, the listener deletion and the githubClient.ts re-route.

The sharp edge is the CodeQL job name, because each side ships a contract pinning its own:

• this PR — workflow-caller-contract.mjs:78 asserts /^ pr-handoff:/
• develop — workflow-caller-contract.mjs:92 asserts /^ target-handoff:/

codeql-analysis.yml and workflow-caller-contract.mjs are modified on both sides, so both will conflict. Resolve those two conflicts from different sides and main's control-plane contract fails — the regex demands one job name while the workflow declares the other. Same rule the repo already applies to graphify-out/: take one side for the whole set, never mixed per-file. Then run node remix/scripts/workflow-caller-contract.mjs on the merge result before pushing; it is the check that catches a mixed resolution.

(No red checks on this PR — MERGEABLE / BLOCKED is the pending Lopu builds and repairs the all branch required check, run 32840527741, not a failure. 0 CodeQL alerts on this head.)