test: re-run the CodeQL suppression experiment with documented placement

[sumitake]

Experiment, not a conclusion

PR #80 concluded that inline CodeQL suppressions are not honoured in this repository. That conclusion is unsupported. The run at 0017b3f placed the annotation as a trailing same-line comment:

os.chmod(path, 0o620)  # codeql[py/overly-permissive-file] -- deliberate fixture

CodeQL Python suppression syntax requires a standalone comment line before the alert. One placement was tested and the result was generalised to all placements — the same error shape as concluding a gate is unsatisfiable after missing three of its surfaces (#78).

Caught by an independent cross-family review of the learning-ledger entry that recorded the bad conclusion.

What this tests

# codeql[py/overly-permissive-file]
os.chmod(path, 0o620)

The CodeQL check on this PR is the entire result.

• Green → the mechanism works. tests: document why the insecure fixtures use Path.chmod (CodeQL negative result) #80's call-site documentation and changelog fragment are wrong and need correcting, the Path.chmod call-shape dependency can be dropped for honest os.chmod plus a stated suppression, and the answer given to the operator ("suppression is not beneficial, it does not work") was wrong.
• Red → the negative result finally has the evidence tests: document why the insecure fixtures use Path.chmod (CodeQL negative result) #80 claimed for it, and this branch reverts.

Do not merge on the test suite. 46 tests pass either way; they are not what is being measured.

Verification

• python3 -m unittest tests.test_claude_transcript_model — 46 tests, OK
• check_release_consistency.py — OK at 4.6.0 (pre-commit hook)
• Behaviour unchanged: both fixtures still apply the permissive mode and still assert refusal/skip.

Boundary declaration

• No provider executor source, raw provider command, credential, private path, downloader, or post-install hook.
• No native-runtime change.
• No host-specific preset or provider-specific plugin.

Generated and release surfaces

• Skill specs and generated SKILL.md unchanged.
• Marketplaces/manifests unchanged.
• changelog.d fragment — deliberately absent until the result is known; the user-visible statement depends on the outcome.
• Version metadata unchanged; test-only.

Review and post-condition

Tier 2. Test-only, no production code, no behaviour change.

Post-condition: the CodeQL check conclusion on this PR, which decides whether #80 needs a correcting follow-up.

author: claude
standing_directives: verify a specification before concluding a mechanism is unavailable; test one variable at a time; do not generalise from a single placement; no production scanning coverage reduced
tier: 2
cross_check: PROCEED-WITH-MODIFICATIONS (codex, openai family, direct route, operator-authorized broker bypass, no broker attestation) - round 2 of the ledger review established that the original experiment tested trailing placement while the documented Python syntax requires a standalone line before the alert; this PR is the corrected counterfactual it asked for
post_condition: CodeQL check conclusion on this PR is the load-bearing result; green means #80 needs a correcting follow-up, red means #80 stands with evidence it previously lacked
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27b697aa1d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".