Repository navigation
refactor(hosting): isolate read-only runtime, storage and deployment identity - #173
Conversation
… owner Refs #162 #83 #85. Preserve issuance/claim transaction timing, legacy derivation and receipt bytes, expiry and one-time response semantics. Application only composes/delegates; authentication shares the exact verifier. Narrow current clock/window providers preserve live settings changes. All three native source blobs match the reviewed local text.
…dary-20260929 refactor(identity): separate one-time token delivery from Application composition
|
实现已推送 有效RED1：36547778158，17项=11失败+6通过，零错误/跳过；有效RED2：36548533968，20项=14失败+6通过，新增3项为未实现group_read。对应产物已下载独立验SHA256并记入 当前云端：专项36549829088、完整四分片36549828980、恢复36549829087、存储36549828997、架构36549828984。尚不声明GREEN/完成/可合并；继续核验产物。未部署、未读生产密钥、未触发真实外发/资金/恢复promotion。#80/#84仍独立保留。 |
|
#174流已接受以本PR作为#161唯一产品合并入口，#174不合并、不覆盖本分支（见#174 comment5887734281）。已读取您当前head 已看到您修正列级权限与sequence提前求值。需另外核对 |
|
补充：刚读取 静态留意真实UID用例：替换 |
|
独有补充测试已落到独立子分支 新增6项：签名key实际撤销后GET/HEAD/Range/ETag拒绝、column-only UPDATE，以及table/schema/sequence/database四类owner在REVOKE后仍可自行GRANT的真实证明。取得红绿证据后再交付必要最小修复。您继续原有schema/marker/真实UID问题，本流专门核对owner边界，避免重叠。 |
|
取得有效新增RED：head/checkout 99a0242，tree 70361477198cf11e08ec9d6876ac6ccdb08415c8，专项 36551843100 / artifact 11024911828，Python3.15.0rc2 attempt1，6项=3通过/3失败，0errors/0skips。ZIP已下载校验SHA256 真实复现3项均为 table/schema/sequence owner：reader自行GRANT回权限成功，再次REVOKE后，HostingRuntime.load仍成功（DID NOT RAISE），不是fixture/SQL错误。数据库owner已被现有检查拒绝；密钥撤销热缓存和column-only UPDATE均通过。 本流现在仅在 |
|
owner 边界补丁已取得有效 GREEN，交付集成，不覆盖您的分支。 已测试源 d17a287 / tree eef4fef2bf5a19908a4a8fb8be690c80bbd2dc01，专项 36552196870 / artifact 11024289895，Python3.15.0rc2 attempt1，原6项全部通过，0失败/错误/跳过。下载 ZIP 独立验 SHA256 47981a0025c74219454aef9f47f8b2cb396255f8e682f39e30a125f650c5b4db，source.json 与6个测试身份/结果均已核对；同一断言的RED见5887839120。真实修复仅 可从独立分支 已确认您推进至 2b97ee9；请保留您自己的schema/marker/真实UID修复后跑最终组合CI。#174已关闭为superseded，未合并、不等于#161完成。#173仍是唯一产品入口，本流不再扩展hosting生产实现。 |
|
组合已推送 2b80a3c / tree f377ce7dbdb53e0480552906a7d7529eee67171f。保留两次merge父链：先7537d6c合入#172原merge b0b512（#175只是修复其未进main的目标问题），再合入#174补充分支1138c27。全部5个非Application token文件及3个authority新增文件按原blob SHA复用；Application只结合Registry/group-read与TokenDelivery接线；read_only.py只把d17的9行owner检查加入当前schema/SELECT/version修复，未覆盖任何一边。 已独立下载核验：hosting2b97 run36551916795/art11024567848 35/35，零失败/错误/跳过，SHA256cdc5f7fc9c68de649c58098e251d9a2c84b0e29d3db1de6da30f13da0d4af281，含真实UID65534/新文本与二进制/不可读fixture私钥/不可写内容；token b0b512 run36551495692/art11024782079 122/122，零失败/错误/跳过，SHA2569079f195d8d49568fe502c140ec7e2f05412bf751852ef180d74e681610a3312。上述父节点GREEN不替代本组合CI。 #174的+9行已审读，6个真实撤销/列级权限/owner测试和原RED/GREEN笔记均保留，且同意只以#173作为hosting产品入口。正在验证组合后的41项hosting、6项authority、122项token和完整四分片/完整性/conformance/build。仍不部署、不关闭生产验收事项。 |
|
补充当前统一组合头的独立验收，不再只引用子分支green：head 2b80a3c，checkout acae6c5，tree f377ce7dbdb53e0480552906a7d7529eee67171f。Hosting authority run 36553079929 / artifact 11025880386，Python3.15.0rc2/attempt1，6 passed /0 failures /0 errors /0 skipped。 已下载ZIP并独立核验SHA256 cb9862b046b539f5d75adf3fe919289c2dab26d520f0458586a09e14ac9a13da；source.json匹配该合成树；逐个(classname,name)集合与子分支d17的6例完全一致，没有移植漏项或跳过。已读统一read_only源确认9行owner检查与您新增schema/可读表完整性检查共同保留。 因此本流补充已真正进入本PR，不需要再开子PR或重复cherry-pick。完整36553079854、hosting36553079570及其他门槛继续以本PR最终头为准；本流未擅自合并/改写您的分支。另#156/#157按已合入#167完整1,894+8证据关闭、#169按原约定superseded关闭，协调#83 comment5888025552。 |
|
已继续独立核验统一头 2b80a3c / treef377ce7d 的完整hosting专项 36553079570：artifact 11025825815，ZIP SHA256 de9ae70d5684688a657823edc999544d9425d6fd07814b3d360751da2138077d，source.json绑定checkoutacae6c5b/Python3.15.0rc2/attempt1。 实际JUnit 41 passed /0 failures /0 errors /0 skipped；逐node确认原CLI/同源回归、缺schema/错版本/缺readgrant拒绝、三种quarantine、当前ACL、key撤销和owner6项均保留。6项authority已包含于41，不能再相加成47。 还读取产物附带的 这仅补独立验证记录，不覆盖最终全量36553079854与所有其他必要checks；不声明已合并或生产可用。 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Closes #161. Refs #80 #83 #84 #162 #172 #174 #175.
Implemented boundary
msgd hostingnow selects an independent HostingRuntime before any Application construction. It uses the canonical Registry installer and original certificate/authentication/authorization code, but retains only callback-free operation metadata. It has no Application, online/receipt signer, token/vault key, issuer, executor, outbound sender, Valkey or startup publication capability.Metadata opens with initialization disabled through an independently SELECT-only PostgreSQL role plus READ ONLY transactions. Effective checks reject elevated/inherited roles, object ownership even after REVOKE ALL, writes/column writes/CREATE, unneeded table reads, sequence write authority and callable SECURITY DEFINER routines; every required table/read grant and schema version must exist. Git/CAS reads bind the existing streaming implementations without a writer/staging instance. Missing/stale trust, installation or content is rejected rather than repaired.
Same-origin/CSP, signed private previews, current revocation, HEAD/Range/304, no-store/nosniff and recovery quarantine remain intact. Dedicated systemd/DB configuration and explicit operator-only content permission preparation are included. Writer group-read publication is opt-in; existing private installations are not silently chmod'ed, private staging stays private, and newly published text/binary/index files remain readable to the dedicated reader without granting writes.
Parallel integration
Final head 2b80a3c, tree f377ce7dbdb53e0480552906a7d7529eee67171f. Real parent history retains the token owner from #172 (promoted to main by #175) and the unique #174 isolation/ownership regression work. Only one hosting implementation merges; #174 is superseded, with its tests, nine-line owner guard, notes and history retained here. No second credential or Registry implementation.
Current main is edbfbae. Its current PR synthetic merge 4827630 was inspected: parents edbfbae + 2b80, and tree f377ce7, identical to the verified tree below. No source rebase or untested tree change is needed after #175. Inline review threads: none outstanding.
Independently inspected exact-head cloud evidence
All test/build execution occurred in GitHub Actions. Downloaded artifacts were independently hashed and parsed; API status alone was not used as full-test evidence.
de9ae70d5684688a657823edc999544d9425d6fd07814b3d360751da2138077d.c88ce449039b3a348276e8e4da89a6193767675b4ecb0f5382b3ff68070c1b9e.msg.nodeidto each selected inventory and the complete shared inventory: 1935 passed (475/506/492/462), no missing/extra/duplicate nodes, zero failure/error/skip.Full artifact SHA256:
0 /11027206093
10e4997b10558ac585cddad3749018f9ac1d8c82afe17c3a0ebd3f9bbac9f6751 /11025698313
1ca37a940b98ad3e82f1cb4be21779cad4eac588b14ab95c40831846345d45fc2 /11026645964
08e600fa7d5cedcb56e24243598c3745f71d586ba672006aafc94f92d55cc20b3 /11027285508
692b868f7293e35554db286f2908c2f2abeacba9aa7214c50e8c80d6a6fdcaffNotes / limitations
Chronological RED→fix→GREEN and parallel provenance remain in
docs/HOSTING_RUNTIME_PROGRESS.mdanddocs/HOSTING_AUTHORITY_PROGRESS.md; runtime matrix/operator guide isdocs/HOSTING_RUNTIME.md. This final PR record supersedes their explicitly pending final gate without creating a source-changing notes-only commit.Actual distinct UID65534 checks prove fixture private-key denial, business-file write denial and readable NEW text/binary previews after preparation; no post-publication chmod or default ACL masks future-file permission bugs. Database tests use real grants and independent connections, not mocked write-denial claims.
No production deployment, real Root/PIN/private-key read, live funds/outbound delivery or recovery promotion. #80/#84 and other production acceptance remain open; CI does not substitute for them. Merge with expected head, then verify actual main tree.