Repository navigation
feat: Add a bounded GET-only console version comparator - #1084
Conversation
|
@codex review Please review exact head |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3c0c8593d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Pigbibi
added
the
agent-approved
AI assistance
OpenAI Codex (GPT-6 family; the exact host variant is not exposed).
What changed
Add a separate manual-only, single-job console version comparator. Inputs are SHA-256 commitments with saved/derived/none baseline modes. A fixed provider/Worker read sequence uses at most six GET requests, no retry or redirect, 512 KiB per response and a 120-second deadline. Closed output projection emits configuration and etag equality separately, fixed group booleans and safe categories. Drift, identity, schema and transport failures exit nonzero. Candidate-only evidence remains partial.
The release canonical/resources/comparable/configHash functions are copied exactly and bound to the original source by offline assertions. The existing deploy workflow and frontend asset pin are unchanged. The workflow references a dedicated read-only token, the existing Secret-only account binding, the protected Worker-name Secret binding, and an exact executor-SHA Environment variable; availability, protection policy and SG runner route are not established here.
How verified
Why
The prior release failure conflates normalized configuration inequality with etag equality. There is no reviewed separate executor that can compare the held candidate under the release semantics without entering a write-capable workflow. This change supplies that engineering prerequisite only. Repository history contains the prior comparator and beta-path implementation, but no inspected authentic production success receipt or recorded comparator result; those historical questions remain NOT_PROVEN.
Risk
R1, workflow/control-plane evidence paths. No provider GET, workflow dispatch, Environment approval, Secret/IAM mutation, activation/deploy/rollback/delete, Secret/profile sync, candidate mutation or trading operation was performed. The Draft grants no runtime authority. Dedicated credential, executor pin and SG egress prerequisites remain unknown; future use requires a separate exact-scope read-only card. Secret values and historical root cause cannot be proved by metadata equality.
After CLEAN and merge, the coordinator can open RO-M07-qrs1074-cmp-1 bound to the merged executor SHA, candidate commitment, baseline-mode choice and six-GET budget. No merge/ready/clearing-label action is requested here.
Exact candidate head:
9f3d2d1ae8d344ccf152c8332d148b79b546ce52.Findings repair verification
Read the Worker name exclusively from
CLOUDFLARE_WORKER_NAMEthrough the protected Environment Secret reference. Validate it before URL construction; missing or invalid names stop before any GET. Floor and clamp the remaining timeout budget to nonnegative integer milliseconds so fractional monotonic-clock remainders do not triggerERR_OUT_OF_RANGE.All five regression tests fail against the original implementation and pass after the repair. Coverage includes configured URL selection, missing/unsafe names, protected workflow binding, fractional remaining time and budget crossing between clock reads. The 37 existing provider cases, full current-scope Web checks, isolated Python suite (1140 tests, 10 skipped), generated projections, package build, actionlint, whitespace and documentation checks pass. No dependency, fixture, gate or protected operation changed. This remains an unexecuted Draft; binding availability and runtime results remain unproved.
Publication scan
Central checker publication-check/2.0-advisory build 83d9d1130377: 4029 findings / 4026 matching lines on the complete tracked candidate tree, advisory. No credential was introduced. The assigned resource identity has zero residual occurrences in the four modified files. This bounded repair does not claim a repository-wide identifier cleanup. First 20 masked matches:
[ { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 4, "text": "/.github/CODEOWNERS @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 5, "text": "/.github/workflows/ @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 6, "text": "/actions/publish-runtime-execution-evidence/ @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 7, "text": "/python/scripts/check_credential_maintenance_read.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 8, "text": "/python/scripts/credential_maintenance_notify.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 9, "text": "/python/scripts/deployment_bundle_contract.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 10, "text": "/python/scripts/deterministic_risk_gate.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 11, "text": "/python/scripts/execution_evidence_projection.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 12, "text": "/python/scripts/forward_observation_risk_control.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 13, "text": "/python/scripts/long_horizon_risk_composer.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 14, "text": "/python/scripts/long_horizon_risk_composer_v2.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 15, "text": "/python/scripts/long_horizon_risk_observation_ingress.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 16, "text": "/python/scripts/long_horizon_risk_observation_ingress_v2.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 17, "text": "/python/scripts/paper_risk_admission_receipt.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 18, "text": "/schemas/qsl-deployment-bundle.v1.schema.json @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 19, "text": "/schemas/qsl-forward-observation-risk-control.v1.schema.json @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 20, "text": "/schemas/qsl-reconcile-only-risk-control.v1.schema.json @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 21, "text": "/scripts/provision_binance_recovery_credentials.sh @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 22, "text": "/scripts/provision_soxl_v7_review_credential.py @<PROJECT_ID>" }, { "file": ".<PROJECT_ID>/CODEOWNERS", "line": 23, "text": "/web/strategy-switch-console/application/console_api/strategy_execution.js @<PROJECT_ID>" } ]