Skip to content

Fix unowned Neural package contact domains - #21

Merged
hudsonaikins merged 3 commits into
mainfrom
codex/neural-contact-security
Jul 28, 2026
Merged

Fix unowned Neural package contact domains#21
hudsonaikins merged 3 commits into
mainfrom
codex/neural-contact-security

Conversation

@hudsonaikins

@hudsonaikins hudsonaikins commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Problem

PyPI neural-sdk 0.4.1 publishes contributors@neural-sdk.dev as an author and maintainer contact. Authoritative RDAP and DNS checks showed neural-sdk.dev unregistered. Public docs also used support@neural-sdk.com, whose domain was unregistered. Either domain could be registered by another party and used to impersonate a trusted project contact.

Outcome

  • Keep contributor attribution without an unowned email address.
  • Keep one accountable maintainer: Advanced Intellectual Labs LLC at hudson@intelip.co.
  • Replace unowned-domain contacts in contributor guidance, conduct reporting, Mintlify, generated OpenAPI sources, and committed OpenAPI documents.
  • Add regression coverage for every public contact surface.

Acceptance Criteria

  • Built package metadata contains no neural-sdk.dev or neural-sdk.com contact.
  • Author email is Hudson Aikins <hudson@intelip.co>.
  • Maintainer email is Advanced Intellectual Labs LLC <hudson@intelip.co>.
  • Public contact surfaces use no unowned Neural domain.
  • Existing SDK behavior remains unchanged.

Validation

Exact candidate: 6ffb8dce65554ad08114854035dba72be1022167

  • uv run ruff check . — passed
  • uv run black --check . — passed
  • uv run mypy neural — passed, 67 source files
  • uv run pytest -q — passed, 101 passed and 6 skipped
  • uv run --with setuptools --with wheel python -m build --no-isolation — passed
  • wheel METADATA assertions — passed
  • uv run python -m twine check dist/* — passed
  • release-candidate artifact validator on wheel and sdist — passed; blocked-domain fixtures absent from artifact contents
  • uv run python scripts/validate_docs.py — passed with 35 existing documentation-coverage warnings
  • repository scan for retired contact addresses outside the regression fixture — clean
  • Cost and external effects — $0; no publication, deploy, production access, or secrets

Residual Risk

PyPI metadata is immutable for an existing release. Public remediation still requires a separately approved package release after lineage reconciliation. This PR does not publish, deploy, merge, or change infrastructure.

@github-actions

Copy link
Copy Markdown

📚 Documentation Status

✅ Documentation changes detected

  • Documentation structure validated
  • Links checked for broken references

This comment is automatically generated by the documentation workflow.

@hudsonaikins
hudsonaikins marked this pull request as ready for review July 28, 2026 04:31

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8db0b0d48a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread tests/test_contact_security.py Outdated

Copy link
Copy Markdown
Contributor Author

@codex review

Please review exact head 6ffb8dce65554ad08114854035dba72be1022167. The prior finding was fixed, answered, and resolved; exact-head CI and artifact validation are green.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 6ffb8dce65

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@hudsonaikins
hudsonaikins merged commit fd782ca into main Jul 28, 2026
20 checks passed
@hudsonaikins
hudsonaikins deleted the codex/neural-contact-security branch July 28, 2026 05:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant