[echoomegaprime]

Why this change is needed

CertForge already runs full deterministic verification, but its workflow does not expose the expected CI check name or execute a CodeQL scan. Current-source CI and security-analysis evidence are therefore incomplete for the intake candidate.

What changes

• Keep all six existing verification commands, including full pytest branch coverage with the unchanged 80% threshold and the P1, P6, and P7 acceptance gates. Name that real verification job CI.
• Add a separate Python CodeQL initialization, analysis, and upload job with narrowly scoped permissions.
• Pin every action to an upstream-verified immutable commit. Both jobs check out and verify the exact requested source SHA; the CodeQL analysis supplies its paired source SHA and scan ref.
• Keep the existing safe pull-request/push/manual triggers and artifact retention. Checkout credentials are not persisted, and artifacts are named for the verified source.

The explicit CodeQL ref/SHA binding applies to this same-owner branch. The pinned action documents that these overrides are ignored for fork pull requests; this change does not claim generic fork-head certification.

Validation

• Fresh isolated Linux environment installed the declared .[dev] dependencies.
• Full pytest: 702 passed, 1 skipped, branch coverage 80.11%, required 80%.
• Compilation and all existing P1, P6, and P7 verification commands passed.
• Independent source review approved the exact workflow bytes, original command/trigger preservation, unchanged coverage threshold, and exact pinned CodeQL action metadata.
• Fresh native build preflight passed before implementation; final exact-commit preflight is retained with the publication receipt.
• Only .github/workflows/ci.yml changes. pyproject.toml and the production evidence verifier remain byte-for-byte unchanged.

This draft is stacked on #45 at 6122143c4f0ebf8f9e135956e835c0ecdc0bea4a. Hosted verification has now completed as recorded below. This source verification does not grant production admission or signing custody.

Hosted verification readback — November 8, 2026

Authenticated GitHub readback verified all four completed checks against the exact PR head b36ac97788f14b0d7fb3935f29f0208d82ad18c1:

• CI: success — job 128771829500, completed 2026-11-08T15:20:13Z: https://github.com/echoomegaprime/echo-certification-forge/actions/runs/42493875408/job/128771829500
• CodeQL workflow: success — job 128771829245, completed 2026-11-08T15:16:39Z: https://github.com/echoomegaprime/echo-certification-forge/actions/runs/42493875408/job/128771829245
• GitHub Advanced Security CodeQL: success — check 128772104135, completed 2026-11-08T15:16:32Z; its result reports no new alerts in code changed by this pull request: https://github.com/echoomegaprime/echo-certification-forge/runs/128772104135
• ECHO Release Sentinel: success — check 128787471795, completed 2026-11-08T16:16:07Z; its summary confirms that required authentic CI and CodeQL checks passed: https://github.com/echoomegaprime/echo-certification-forge/runs/128787471795

The source head, base, and draft state were re-read before this metadata update. No code, security finding disposition, trust root, signing custody, production attestation, deployment, or merge was changed. These successful source/security checks do not substitute for the still-required exact-target production E2E evidence and release admission.