chore(security): track remaining CodeQL findings

## Summary

Successor tracker to #3654 for the CodeQL findings that remain open on `main`. Use this issue to prioritize production risk first, record fixes or explicit dismissal rationale, and reconcile the inventory after each cleanup merge.

> This is a maintainer prioritization tracker. Keep exploit or reproducer details out of the public issue; individual code-scanning alerts require repository access.

## Source

- Follow-up commitment: https://github.com/NVIDIA/NemoClaw/issues/3654#issuecomment-4880408071
- Previous tracker: #3654
- July 4 baseline: 96 open CodeQL alerts at [`3f89cd0`](https://github.com/NVIDIA/NemoClaw/commit/3f89cd031da53718ea3120caa820e694d53b5b1d)
- Prior cleanup baseline: #4878, #4880, #4884, and #4885

## Current snapshot — July 9, 2026 UTC

- `main` at [`2b2c9f6`](https://github.com/NVIDIA/NemoClaw/commit/2b2c9f6f8c3c3b4cc9e7a3f4ff863d38a38f8bed)
- Latest completed [`Security / Code Scanning` run 28996569204](https://github.com/NVIDIA/NemoClaw/actions/runs/28996569204): success; JavaScript/TypeScript CodeQL, Python CodeQL, and ShellCheck SARIF all passed
- Authenticated code-scanning API inventory: **116 open CodeQL alerts**
- Separate inventory: **3 open ShellCheck alerts**, intentionally out of scope for this CodeQL tracker

Counts are a point-in-time snapshot, not a fixed cap. Add or link newly introduced CodeQL findings when they are in scope.

## What changed since the July 4 baseline

- CodeQL moved from **96 to 116 open alerts**. At the alert-ID level, 25 IDs entered the current inventory and 5 baseline IDs closed. One pair is a renumbering (`1086` → `1295`) of the same unused variable, leaving **24 genuinely new underlying findings and 4 genuinely resolved findings**.
- No baseline alert was dismissed. Two transient post-baseline alerts (`1210` from #6251 and `1354` from #6446) were dismissed with explicit rationale; neither is part of the baseline-to-current open-count delta.
- The 56 security-severity findings are unchanged: the production transition-lock race plus 55 test, tooling, and docs-source security-pattern findings remain open.
- Static/correctness inventory grew from 40 to 60. The net rule deltas are:
- `js/unused-local-variable`: 21 → 32 (net +11, including the `1086` → `1295` renumbering)
- `js/template-syntax-in-string-literal`: 2 → 6
- `js/trivial-conditional`: 3 → 4
- `py/catch-base-exception`: 0 → 3
- `py/uninitialized-local-variable`: 0 → 2
- `js/useless-assignment-to-local`: 1 → 0
- Baseline resolutions: #6280 fixed `1143`; #6358 fixed `964` and `1146`; #6388 fixed `1160`. #6359 closed `1086`, but the same finding reopened as `1295`.
- #6526 repaired and guarded the mixed CodeQL Action versions; the current `main` scan is healthy again.

## Current CodeQL inventory

| Rule | Count | Security / diagnostic severity | Primary scope | Alert IDs |
|---|---:|---|---|---|
| `js/file-system-race` | 50 | high / warning | 49 test-path findings plus `src/lib/shields/transition-lock.ts` | `205`, `1094–1142` |
| `js/unused-local-variable` | 32 | — / note | 8 CLI source findings plus 24 test/live-E2E findings | `812–815`, `822`, `831`, `934`, `949–950`, `1063`, `1144–1145`, `1174–1175`, `1177–1178`, `1182`, `1214`, `1295–1296`, `1298–1306`, `1345–1346`, `1358` |
| `py/unsafe-cyclic-import` | 9 | — / error | type-only import graph in `docs/_ext/json_output/core/*` | `107–115` |
| `js/template-syntax-in-string-literal` | 6 | — / warning | messaging and live-E2E tests | `948`, `1189`, `1196–1199` |
| `js/trivial-conditional` | 4 | — / warning | blueprint sandbox safety-net helper plus lifecycle test | `308–310`, `1286` |
| `js/bad-code-sanitization` | 3 | medium / error | boundary and messaging E2E tests | `947`, `1092–1093` |
| `py/catch-base-exception` | 3 | — / note | intentional cancellation/base-exception observability test fixture | `1318–1319`, `1328` |
| `py/uninitialized-local-variable` | 2 | — / error | Hermes runtime config guard | `1218–1219` |
| `js/duplicate-property` | 1 | — / warning | plugin migration-state test | `312` |
| `js/file-access-to-http` | 1 | medium / warning | advisor tooling | `596` |
| `js/shell-command-injection-from-environment` | 1 | medium / warning | live-E2E gateway-auth helper | `1083` |
| `js/tainted-format-string` | 1 | high / warning | checked-in docs search source asset, bundled at build | `154` |
| `py/empty-except` | 1 | — / note | Hermes runtime config guard | `1066` |
| `py/unreachable-statement` | 1 | — / warning | OpenClaw config guard | `1065` |
| `py/unused-global-variable` | 1 | — / note | Hermes runtime config guard | `1067` |
| **Total** | **116** | | | |

## Prioritized work

| Priority | Bucket | Count | Next action |
|---|---|---:|---|
| P0 | Production runtime boundary | 1 | Disposition `js/file-system-race` in `src/lib/shields/transition-lock.ts`. The implementation already uses no-follow descriptor open plus inode verification and has focused replacement-race coverage; confirm that mitigation, then refactor if needed or dismiss narrowly with rationale and regression evidence. |
| P1 | Production runtime-guard initialization | 2 | Validate Hermes `py/uninitialized-local-variable` alerts `1218–1219`. The transition branches appear to assign the value before both writes; make the proof explicit in code or dismiss with documented control-flow rationale. |
| P2 | Test, tooling, and docs security-pattern findings | 55 | Reconcile the 49 test-path races and the remaining medium/high patterns. Forty-eight races are adversarial guard-integrity tests; separate them from ordinary dev-shim alert `205`, and preserve intentional test behavior. |
| P3 | Remaining correctness and static-quality findings | 58 | Batch by rule and subsystem. Distinguish intentional type-only imports and exception-propagation fixtures from actionable dead or unused code. |

## Proposed PR sequence

1. Confirm the existing transition-lock mitigation and close or explicitly dismiss the production race finding.
2. Validate and resolve the Hermes runtime-config-guard initialization diagnostics `1218–1219`.
3. Reconcile the 49 test-path race findings, grouping intentional adversarial patterns separately from actionable helper races.
4. Address the remaining security-pattern findings in tests, advisor tooling, and docs search source.
5. Batch correctness/static-quality findings by rule and subsystem, starting with production source and blueprint helpers before test/docs cleanup.
6. After each merge, wait for the next successful `main` scan and record the rule and count deltas here.

## Out of scope

ShellCheck remains a separate inventory. The current open alerts are:

- `SC2119`: alerts `929` and `952` in `scripts/nemoclaw-start.sh` and `agents/hermes/start.sh`
- `SC2317`: alert `971` in `test/e2e/lib/redact-openclaw-gateway-log.sh`

Expanding scanner configuration or enabling additional query suites is separate work unless a change is required to validate a fix here.

## Definition of done

- Every current CodeQL finding is fixed, dismissed with explicit rationale, or moved to a linked targeted follow-up with an ownerable scope.
- No production security finding or runtime-guard error remains without a documented disposition.
- Security-sensitive production fixes include focused regression coverage.
- Intentional test patterns retain their adversarial behavior; suppressions or dismissals are narrow and justified.
- A successful final `main` code-scanning run and authenticated API refresh confirm the expected closures and remaining intentional inventory.
- The closing update records the delta from both the 96-alert July 4 baseline and this 116-alert refresh.

Start with the P0 finding in src/lib/shields/transition-lock.ts, then inspect the Hermes runtime-config-guard alerts 1218–1219 and their focused coverage. Work through the prioritized buckets and wait for a successful main code-scanning run after each merge. Done means every finding has a fix, narrow dismissal, or owned follow-up, with the final inventory delta recorded.

Written by the indexing model from the issue text.