Repository navigation
fix(organization): prevent hierarchy review packet reissuance #281
Description
Finding
OrganizationHierarchyChangeReviewPacket.__post_init__() is callable after construction. On predecessor exact 8243383ef33e9c75ce6232c0d06209186e4c08ca, an already-issued packet could be low-level mutated, retargeted to a fresh valid hierarchy-change reference, and have __post_init__() invoked again, installing new creation evidence for the same Python object.
#281 owns same-live-object reissuance prevention. #279 owns post-issuance export integrity, #280 issuance one-snapshot integrity, #282/#119 authoritative clock provenance, and #283 ordinary module-level mutation capability over the process-local registry.
Test-first repair
03fd2cb2c9268b7eee8cb9e2c4976c9cd116b6f6: manual reissuance fail-closed regression; no hosted RED claimed for the short-lived test-only head.4fcf0c71040bb8d35f274899d4ee22188e004188: identity-scoped issuance reservation under the issuance-state lock.6a8d5d88f7e1846d1e958963160b1036a24b69a4: deterministic concurrent re-entry coverage.- fix(organization): hide hierarchy-review issuance registry mutation capability #283 later moves creation digest, in-progress reservation, live-reference binding, packet retention and their lock out of ordinary module-level mutable handles into closure-private process-local state. It preserves fix(organization): prevent hierarchy review packet reissuance #281 single-use behavior while removing the product's importable mutation capability.
The accepted boundary is deliberately process-local defense in depth. It is not durable uniqueness, distributed authorization, restart-stable identity, or immutable database/audit authority.
Root release-truth contract preserved
The current #96 descendant also carries the deterministic root CHANGELOG contract for the active Organization hierarchy-review package. This must survive normal integration but does not make a mutable PR head a published release.
Current exact-head acceptance — 2026-09-10
PR #96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2, directly based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable.
Exact-head leaf/source evidence is GREEN: Foundation 34369393258 / job 102526382630, SAST 34369393198, Required OpenCode job 102527871752, and Required Noema job 102527471651 are SUCCESS. Fresh reviews remain COMMENTED-only with no qualifying independent APPROVED; every visible inline thread is resolved.
Required shared/runtime lanes remain non-passing or nonterminal:
- Security
34369393189: dependency-review job102526931585fails closed before the pinned action. Canonical owner.github#810, exact-head canary5604514013. - CodeQL
34369393184: Actions consumer102526616445and Python consumer102526617050terminal-fail before authoritative dispatch102528422966starts and succeeds. Canonical proposed repair.github#2040, exact-head canary5604510396. - Strix
34369390074/ job102527232339: genuinely IN PROGRESS inRun Strix (quick)after exact-head admission/materialization, CO-sidecar provisioning, Strix install andorchestrator/freeinput preparation. Report collection/upload and same-head publication are pending, so no elapsed-time/provider/vulnerability verdict is inferred.
No predecessor verdict transfer, local required-workflow fork, self-approval, routine administrator bypass, force push or destructive rebase.
Acceptance
Keep this issue open until #96 or a verified successor preserves the regression, causal single-use guard, #283 non-importable state boundary and root release-truth contract, then satisfies exact-head owned coverage plus all then-live central workflow/review governance and integrates normally to protected develop. Do not make __post_init__() silently idempotent or promote process-local state to durable authority.
Activity
seonghobae commentedon Sep 9, 2026
Current descendant evidence after terminal central-workflow settlement: #96 exact head remains
85ba782d70f2d3800a8a13abb04a48326277feeaon direct protected basedevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.Exact-head GREEN is now established for Foundation
34317810390(including the installedorganization-hierarchy-change-reviewartifact contract and the package pytest 100% statement/branch threshold), SAST34317810268, Required OpenCode34317806884, Required PR Review Merge Scheduler34317806945, Required Noema34317806898, and Dynamic Code Quality34317803528.Three required lanes remain non-authorizing, each with a canonical owner rather than Orgmetra source churn:
34317809307is terminal FAILURE because dependency-review job102358110384fails at support establishment before the pinned action. The exact consumer evidence remains with.github#810in comment5596829480.34317809718is terminal FAILURE from producer/consumer settlement ordering: Python102358190322and Actions102358190367failed current-head verdict enforcement around 06:20Z, while authoritative dispatch102360038609did not start until 06:26:23Z and then succeeded. Fresh unchanged-head canary was handed to.github#2040in comment5597675104; no local rerun/sleep/synthetic status is used.34317806875/ job102358111936is terminal FAILURE with exact artifact10091168700(sha256:ec8995a8cd57980660ee04dae984bfece68eb8f98fc05c7dfa5df3434cc93c73). The artifact proves contextual-orchestrator preflight/gateway readiness and zero LLM requests; both bounded attempts fail earlier at the sandbox Caido bootstrap because127.0.0.1:48080is unreachable throughloginAsGuest. This exact consumer fixture was handed to canonical application-service readiness ownerquarantine-sandbox-runtime#103in comment5597707607. Zero-result SARIF is not treated as a zero-vulnerability verdict.All visible #96 review threads are resolved, but there is still no qualifying independent
APPROVED. Live organization ruleset18156473continues to require one approval; the structurally impossible solo-maintainer approval requirement is tracked centrally by.github#772, so no fictional reviewer, bot-as-human approval, self-approval, or administrator bypass is used here. #96 remains Draft in any case because Security, CodeQL, and Strix are currently RED.Keep #281 open until #96 or a verified full successor integrates normally to protected
developwith the reissuance regression/guard intact. This is current evidence progress, not closure.seonghobae commentedon Sep 9, 2026
Current-descendant authority update: canonical #96 is exact
0262d70eaac37e2ab4096c67894a0bae71a4b1d2. #281 still owns same-live-object single-use issuance/re-entry semantics. Fresh #283 repairs a distinct prerequisite capability boundary: the same enforcement state must not be mutable through ordinary module-global registry handles. Hosted RED4105ff...(34368435932/102523127294) was repaired by closure-private shared packet runtime1e999..., with hosted Foundation GREEN34368952870/102524889637;0262d70...carries code-current ADR/TRACEABILITY/README/CHANGELOG. Final-head required checks remain partly nonterminal, so keep #281 open and do not transfer predecessor verdicts.seonghobae commentedon Sep 9, 2026
Current exact-head authority update — 2026-09-10
#281's same-live-object single-use issuance invariant remains preserved on canonical #96 exact
ff16a08dc035faf05dc1b921e947b1cf82cfb36eover protecteddevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; the older0262d70...workflow snapshot is historical. Current exact-head Foundation34396350836/102616940695, SAST34396351089/102617040740, OpenCode34396347572/102617074947, merge scheduler34396347450/102616910003, and Noema34396347445/102617027671are SUCCESS. Security34396350675/102617027944is fail-closed on.github#810; CodeQL34396350863is non-passing on.github#2040; Strix34396347513/102617064104is mechanically SUCCESS but non-authorizing because artifact10122149854is empty-SARIF + 307-byte template-only report with no exact target/base/head/scope/finding-set receipt (.github#891, canary5607965106; implementation.github#1563@20913979589d86ad1e2d26705ffb2c4a675409bdremains unintegrated).Fresh #96 reviews remain COMMENTED-only with no qualifying independent
APPROVED; all visible inline threads are resolved. Closure-private process-local reservation remains defense in depth only, not durable uniqueness/authorization. Keep #281 open through normal protected integration or a verified successor; no predecessor verdict transfer, bypass, self-approval, force push, destructive rebase, or gate-name-only success.seonghobae commentedon Sep 9, 2026
Current-authority correction after #287: #96 is exact
6e5784b77e4dc00f15fd6e072dc61babd85d5910, direct protected basedevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. #281's same-live-object single-use issuance and concurrent re-entry rejection remain preserved. #287 additionally binds the live-reference guard constructor selected by the packet runtime so later ordinary module reassignment cannot replace digest-conflict comparison behavior; this does not turn process-local state into durable uniqueness. Fresh exact-head workflows are queued and prior GREEN/RED does not transfer. No qualifying independentAPPROVED; keep #281 open through normal #96 integration.