From 12c18e251f5b7a865b1b95a9702a64d293a7994c Mon Sep 17 00:00:00 2001
From: Heewon Oh <intrect@proton.me>
Date: Thu, 10 Sep 2026 03:39:39 +0900
Subject: [PATCH] =?UTF-8?q?feat(AGT-4160):=20fix(security-audit):=20remove?=
 =?UTF-8?q?=20CodeQL=20from=20the=20autonomous=20pipeline=20=E2=80=94=20it?=
 =?UTF-8?q?=20is?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package-lock.json          | 48 --------------------------------------
 src/agents/pairPipeline.ts | 12 ++++++----
 2 files changed, 7 insertions(+), 53 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fe7eebb8..abf42e03 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1300,9 +1300,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1319,9 +1316,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1338,9 +1332,6 @@
       "cpu": [
         "ppc64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1357,9 +1348,6 @@
       "cpu": [
         "riscv64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1376,9 +1364,6 @@
       "cpu": [
         "s390x"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1395,9 +1380,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1414,9 +1396,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1433,9 +1412,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -1452,9 +1428,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1477,9 +1450,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1502,9 +1472,6 @@
       "cpu": [
         "ppc64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1527,9 +1494,6 @@
       "cpu": [
         "riscv64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1552,9 +1516,6 @@
       "cpu": [
         "s390x"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1577,9 +1538,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1602,9 +1560,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -1627,9 +1582,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
diff --git a/src/agents/pairPipeline.ts b/src/agents/pairPipeline.ts
index 983500aa..c77162c1 100644
--- a/src/agents/pairPipeline.ts
+++ b/src/agents/pairPipeline.ts
@@ -935,11 +935,13 @@ export class PairPipeline extends EventEmitter {
         }
       }
 
-      // CodeQL is a post-edit gate, not a tester-stage feature. Run it after a
-      // successful worker pass so every pipeline shape — including
-      // worker/reviewer-only configurations — must clear the same baseline-diff
-      // check before an approval is possible.
-      const introducedSecurityFindings = await collectIntroducedSecurityFindings(context);
+      // CodeQL is a post-edit gate, not a tester-stage feature. It is opt-in
+      // (securityAudit.enabled, default OFF) because it is too slow to gate PRs
+      // (AGT-4160). When disabled we do not even invoke the gate, so the default
+      // autonomous path never runs CodeQL.
+      const introducedSecurityFindings = this.config.securityAudit?.enabled
+        ? await collectIntroducedSecurityFindings(context)
+        : [];
       if (introducedSecurityFindings.length > 0) {
         const failures = introducedSecurityFindings.map(formatSecurityFinding);
         safeConsole.log(