Repository navigation
Allow exact recent protected-main rollback rewinds in validate-rulespec - #141
Merged
Merged
Conversation
Recompute a bounded whole-tree proof before candidate code and use its effective base only for freeze, waiver/companion ratchets, supervised audit comparison and generated guard. Keep selection, audit changed paths, configuration and dependency adoption on the real event base. An isolated proof job inherits optional PR-read permissions; candidate jobs retain contents-only tokens and recompute Git checks against its immutable outputs. API errors and all failed proofs preserve the ordinary base. Invariants: I1. Admit only an exact tree of a merged default-branch PR landing within 20 first-parent steps. Extra/missing bytes, modes or files fall back to B. I2. No authorization artifact exists. Every event recomputes the proof; only step/job outputs from candidate-free steps select effective_base. I3. Head-waiver expiry remains enforced against today. Restored modules still validate and receive the original B-to-head fingerprint audit. I4. Configuration, pins, CODEOWNERS and inventories remain byte-identical throughout the window, except the permitted waiver-ledger digest field. I5. Restored waiver growth requires I1; existing pending-approval paths remain unchanged. Exercise accepted suffixes/events, refusal cases, real extracted ratchets, frozen-date expiry through the encoder loader, and trusted-output wiring. Validation: 235 pytest tests passed (89 validation workflow, 124 pin-bump and encoder-guard, 22 other workflow tests). The full script entry point also passed, including 16 rollback groups and 13 lane-registry tests. actionlint, Python compilation and diff whitespace checks passed.
…ists Review round 1 nit: without an installed encoder or AXIOM_ENCODE_SOURCE the expiry test returned before either frozen-date assertion, and shared CI (which installs only PyYAML) counted it among "16 regression groups passed". It now raises unittest.SkipTest, which pytest reports as skipped, and the standalone runner prints passed and skipped counts separately. With a loader present (the encoder's validation_waivers.py and constants.py at 85845da38) it still runs both dates and passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review round 4: an 'if: ${{ !cancelled() }}' on validate passed the timeout
and wiring tests, although after a timed-out proof it would run validation on
the ordinary base and the aggregate would not fail. The test now requires
validate to carry no condition (the mutant fails it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Merged (merge commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
An exact revert of a waiver-retiring re-encode can fail the decrement-only waiver gates. This first step admits an exact whole-tree restoration of a recent merged PR landing on the default branch. It supports modification-only windows: real reverts touching companion
.test.yamlfiles, test files, or file additions still use the ordinary base today. Admitting those windows is the planned next step.Changes
The proof requires an exact first-parent tree match within 20 commits and verified merged-PR metadata. The window may modify RuleSpec modules, any
.jsonunder.axiom/encoding-manifests/, the waiver ledger, and its toolchain digest. Every added, removed, or changed waiver key must name a module changed both in its own transition and across the net X..B window. Toolchain bytes beyond the digest remain fixed; manifest signing-key equality is checked between X and B only.The authenticated metadata step uses only Python's standard library with site packages disabled. The separate PyYAML proof receives no token. Consumer jobs recompute the immutable checks using trusted proof outputs. Ledger parses are cached by blob ID within each proof run. The proof timeout is 15 minutes, over eight times the review's uncached 20-PR, 80-transition measurement; a job timeout skips dependent validation and makes the aggregate fail.
Dependency-input validation is pinned at step index 3, with all preceding steps checked. Every dependency checkout with a repository input must use validated shard outputs. Behavioral coverage also pins the waiver comparison base's lowercase 40-hex validation.
Only
pull_request,push,schedule, andworkflow_dispatchmay consume the rewound base; other events retain their previous comparison-base behavior. A rewind changes the freeze, waiver ratchets, supervised audit baseline, and generated guard comparisons. Selection and audit changed paths retain the ordinary base, so restored modules are revalidated. Callers' pinned supervised audit enforces expiry; shared CI skips the expiry regression without an encoder loader. Ordinary proof refusals retain the ordinary base.Callers must grant
contents: readandpull-requests: read, retaining independently required read scopes. Without PR lookup access, the proof keeps the ordinary base. Only the job running no candidate code inherits caller permissions; candidate jobs retain theircontents: readcap. The unused proof inshardsremains removed.Validation
validation_waivers.pyandconstants.pyexported from encoder commit85845da38; the restored-waiver expiry check passed.actionlint1.7.12 andgit diff --check: clean.🤖 Generated with Claude Code