[Pigbibi]

AI assistance

Claude Code, model Opus 5.5 (native box job, single writer).

What changed

Registers the merged #1168 Desk gap-fill commit 2fa23318 as a dedicated, fail-closed reviewed-main release source in deploy-strategy-switch-console.yml. The block is structurally identical to the S2 c0ac5848 block (#1167); only the pins differ. Every prior source definition is unchanged.

• Selector: exact source, with these pins:

  • sole parent 9ba46c2d, tree 55da6c63;
  • v2 map blob 05155b33 and Worker blob bbe906c5;
  • the reviewed fix(digest): show scoped Binance wallet valuation #1126 reader test f590e43d, which must already be in the source tree, so nothing is composed.

  The run must also use the main ref and frontend mode, with no secret or profile sync and receiver checks retained. CONTROL must equal the run SHA and differ from SOURCE, and SOURCE must be an ancestor of CONTROL.

• Overlay: the selected head must match its tree, and the rebuilt map must match the pinned map blob. The run must be bound to this source input, with no staged, unstaged or untracked delta.

• Publisher: added to the current reviewed-main allowlist, which uses the separate concurrency witness.

• Tests (tests/console_deploy_safety_validation.mjs):

  • real-Git identity of the five pins;
  • map generation, a new build that differs from c0ac584, and the stored-sparkline overview read in the source tree;
  • accepted-source call order;
  • rejection of a wrong mode, ref, input, parent, tree, map, Worker, reader test, object, ancestry or CONTROL;
  • no cross-acceptance with c0ac584;
  • overlay tampering;
  • publisher witness, drift, module and configuration cases.

How verified

Node 22.23.4, isolated checkout.

• Fail-before: the extended test against the unmodified workflow fails with AssertionError: invalid_frontend_release_mode. It passes with this change.
• PASS: all six Node tests that read this workflow (console_deploy_safety, console_catalog_release, console_946_backend_workflow, binance_receiver_deploy_acceptance, console_version_comparator, website_release_combination).
• PASS: the Python workflow tests (211 passed, 1 skipped, 299 subtests).
• publication-check/2.0-advisory (build 53bfc794) on the two changed files: 147 advisory matches, all on pre-existing lines. A separate scan of only the 143 added lines finds 0 matches, and none is a credential.

Why

The console deploy workflow only publishes explicitly registered sources. #1168 produced a new immutable frontend bundle (v2_asset_map.js blob 05155b33), so registration is required before the already-authorized S2 console publish.

Risk

• Tier: CI release-source registration. No runtime code changes.
• Only the exact pinned source is accepted. Secret/profile sync stays forced off.
• Merging is not a deployment. Publishing is a separate, single, explicitly bound dispatch.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T08:42:45.820745Z	e0ecd90	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-14T08:45:20.512999Z	e0ecd90	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.