Repository navigation
feat: enforce validation registry convergence - #71
raylee-hawkins wants to merge 40 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5840c517bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…utation-factory feat: execute canonical rules and measure controlled mutation quality
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 429e96f3de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3cffe9fd3e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ed97eb9bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 196013ae70
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0df744c7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8519ac949
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c37c355c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e30dda6528
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ee4b5af74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
Problem and behavior
This existing convergence PR enforces Validation-owned registry, package, report and claim-boundary checks. Required CI selects immutable sibling sources and rejects content drift, ambiguous identities, malformed data and unsupported promotion. Validation supplies controlled behavior/report parity truth.
Twelve scoped recovery commits repair:
Detection source pin f8bc0a0925113ca815bf5692081b5216162cc918 disagreed with the committed manifest in five rules. Reviewed 56cad4f726c0d3988c9464693ce7c127c8f63cad matches all 62 required blobs plus the matrix; the verifier/manifest remain unchanged.
Standalone source mode reached validators but not parity commands. Both receive the existing selected mode; required CI remains fail closed.
Registry headings bypassed authority checks and detection_id masked contradictory rule_id. Headings and every declared identity are now checked.
JSON sibling prose lost its record identity, YAML fields bypassed structured parsing and statuses leaked across records. The existing strict owner loader and one record-scoped walk now cover JSON/YAML claims and statuses.
New full-graph CI exposed legitimate negative-context regressions. Exact owning blocked-list syntax and phrase-local denial context now pass while repeated/nested/independent affirmative statements remain rejected.
Split nested authority names such as runtime.active escaped leaf-only matching. The same existing authority-name set now checks every composed ancestry suffix; assertive-value rules remain unchanged.
Production/customer/AI/public-safe aliases now reuse the existing registry's owning authority keys, including composed nested names. Prose identity detection is case-insensitive, preserving detection-local status attribution and negative contexts.
Predicate-free readiness labels in headings, ID labels and status/state cells now reject unless explicitly denied; paired Markdown emphasis retains the same meaning. Truthy string on and all nonzero numeric strings follow the numeric authority predicate; exact zero stays inert without float conversion. Existing denied-term list fields permit only exact owning terms, never nested affirmative summaries.
Compact heading delimiters (colon,ASCII/en/em dash,spacing/tabs) share the anchored label grammar; positive and negative regressions preserve context.
Structured claims now use the existing shared promotion vocabulary, including fleet-wide, autonomous SOC and backend proof flags, with claim/proof suffixes and parent context retained through maps/lists. Affirmative booleans, numbers and strings cannot hide behind negative wrapper names. Registry report validation enforces the same owning flags.
An intentionally rejected HO-PIPE contract input is allowed only at its registered Validation fixture path, unique controlled owner/detection, canonical registry/package authority metadata checked by shared existing helpers, passing owner-report negative case ID and consistent false/no-match expectations. The exception covers direct boolean values in the exact contract.blocked_promotion_fields mapping; foreign surfaces, aliases that contradict expectations, arrays, nested inputs and affirmative prose remain rejected. Actual source evaluation rejects that fixture; all fourteen owner reports validate.
The documented standalone registry command now explicitly uses --source-contract skip-if-missing. Default required mode and CI remain fail closed. Local registry/report checks always run; only an implicitly absent sibling can skip and is explicitly labeled. Explicit inputs, present/partial/dirty source and local report promotion reject. Actual Validation-only tracked clone with fourteen packages passes the documented route.
The default parity inventory now comes from the existing validated registry instead of a six-ID list. All fourteen governed identities flow through record attribution, headings and prose/status checks. Unknown affirmative authority strings fail closed; only exact owned bounded states and explicit false/zero values remain inert. Denial context belongs to a connected clause or an exact owning field/list role; another identity, fresh subject or independent affirmative clause cannot borrow it. Existing schema declarations and false UI values retain their literal role.
Scope and implementation
The existing convergence branch changes77 files relative to main; it remains a historical stack requiring its own review. Recovery commits:19f4642,429e96f,3cffe9f,8ed97eb,196013a,b0df744,a8519ac,6c37c35, fddaadf, e30dda6 8ee4b5a and b207c1f.
Eight recovery-owned paths:
No source manifest regeneration, detection-content edit or selected sibling pin changes beyond the corrected Detection pin.
Local and hostile validation
211 owner tests, 64 focused parity tests and 62 registry tests (126 combined) passed. Actual standalone CLI passes; required missing sources, partial handoffs and report drift reject. Thirty promotion headings and ten conflicting/type-invalid aliases reject. Strict JSON/YAML rejects duplicate/nonfinite values, unsafe tags, unsupported scalars and cyclic aliases. Object-local identities/statuses, malformed identities, schema declarations and actual records are tested separately.
Independent review found and corrected repeated-term negation, attached-prefix/suffix assertions, status leakage and newly introduced numeric0.5/independent-conjunction exception gaps. Bare owning blocked terms and legitimate denial clauses remain valid; nested summaries, '=1'/'is true' expressions and later affirmative claims reject. This enforces the existing owning terms and explicit predicates; it is not arbitrary natural-language inference.
The entire exact immutable graph reproduces0 failures/0 unknown sources/16 existing warnings across all fourteen governed IDs (5 stale Proof-card wording associations and11 mixed bounded-status observations). git diff --check passed. Windows8.3 TEMP alias test errors were resolved by process-local canonical TEMP/TMP; no source workaround.
Exact-head CI
At b207c1f, all ten applicable workflows succeeded:
All twenty technical conversations have evidence-backed resolutions. AI/operator-authored replies are not eligible HUMAN approval. Superseded failed revisions were repaired without disabling a check or changing owning source artifacts.
Dependencies and security
Reviewed historical selections: Detection56cad4f,Proofb42ba945,Website6252231b,command-centerbfe47d16,Platformff827f45. These are not current-main claims. Related authority-owning convergence PRs .github58,Detection47,Platform87,Proof87,Website80 and Hoxline26 need their own review. Successor73 incorporates the repaired base through normal history-preserving branch merges and exposes only its two facts/quality files. Focused current-main Website86 and Platform90 do not depend on this stack landing.
Read-only workflow permissions and disabled checkout credential persistence remain. No private output, ledger mutation, schedule activation, dependency modernization or public-safe promotion was introduced.
Rollback, ceiling and merge gate
Revert the scoped recovery commits if needed; reverting the source pin restores the demonstrated fail-closed drift. Historical convergence changes require their own scoped review.
Ceiling:CONTROLLED_REPO_CI_REPAIR_AND_PRIVATE_RUNTIME_REENTRY_ONLY. No production/customer/fleet/SOCaaS, public runtime/signal/public-safe/backend proof, autonomous disposition, closure, ledger append or schedule enablement.
Require green relevant CI, a clean proof-boundary packet, visible eligible HUMAN GitHub review and explicit MERGE_APPROVED. No PR was merged.