[zrk222]

Django signing-key diagnostics stayed unresolved even when captured startup selected the configuration and authentication/session consumers were configured. This change joins that existing source evidence into native session-authority admission while preserving every original diagnostic.

Admission requires current source hashes, exact consumer settings and stable framework providers. Missing, overwritten, aliased or mutated settings, placeholder material, local framework shadows and unresolved distribution scope remain NEEDS_CONTEXT. Existing provider validators are reused; duplicated parent traversal and three single-use projections are removed. No module, dependency or architecture budget is added to the scanner.

Measured TP admission gain

The committed source-bound evidence at docs/evidence/native-session-admission-20261031.json records the unchanged 90-label Study430 exposed panel across 67 repositories:

Admission result	Retained original report	Current candidate replay
Supported TP	0	5
Admitted FP	0	0
Admitted UNCLEAR	0	1
Known TP retention	0/15	5/15

This is an admission gain on exposed data, not five newly discovered/labeled TPs or a fresh held-out precision percentage. Raw labels remain 15 TP / 53 FP / 22 UNCLEAR; ten known TPs remain outside the supported tier. Baseline tiers came from retained reports rather than a freshly rerun baseline commit. The replay completed in 82.3 seconds; source, label and measurement hashes are recorded. The >=30-decided fresh acceptance and >=80% target remain unmet. Labels are AI-only; disagreements remain UNCLEAR. No release/publication claim is made.

CI repairs in this candidate

• Patch the editor build dependency to minimatch 11.0.1 for GHSA-g3hv-75wg-m249. Full OSV audit and editor tests/compile passed locally. Exact manifest/lock expectations now require the patched version, including nested copies. No audit suppression or version bump.
• Fix signing-only retry provenance: verify retained check receipts against their actual successful producer job/attempt while preserving exact source/workflow/run/ref/command/hash identity. Bounded retries cover delayed provider metadata. Aggregate receipts retain individual producer identities. The actual repaired validator passed against all four real artifacts and provider metadata from main a34deb92; hosted OIDC verification remains a post-merge check.
• Replace thousands of disk-backed capacity-fixture seed calls with one transaction, then test real final-slot admission, overflow rejection and existing-key updates at full production capacity. Paired local Windows CPython 3.11 command time: 11.886s → 1.812s. Full hosted Windows timing remains unverified. No timeout was raised or test skipped.

Validation

220 affected session-family controls, 12 additional inventory/cache controls, repaired metadata/capacity checks and 51 final receipt/capacity controls passed. Native CLI output, persisted receipt readback, independent resealing and tampered-source rejection were exercised. Ruff, format, C901, strict architecture (133 core modules), immutable action pins and the final hash-bound workflow audit passed.

Independent Backend Architect AI review found no P0/P1 issues in the receipt retry and capacity optimization and reproduced provider-metadata controls. No external human review is claimed. Source/workflow, tests and measurement evidence are in separate commits. PR #265 is superseded by the consolidated CI repairs here. Current hosted required checks must pass before a regular merge; main-tip CI and signing must be verified afterward.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 733422f2-3ed2-4675-aad8-947fd075d83d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

FactoryLine Proof Review

Commit: 35221f123f195ca56a9be0a6da2757264a52012f
Diff-to-Proof Review SHA-256: 3da2ea10b2ada0906592d05a800ae4be6bac7708fc0419862e249bd5e84d1529
Proof Review SHA-256: 88065a9e6bbb197fc1048291f20cf0fbc0bcd678e6d1fc1d3c2104d5e7a3901d

Changed-scope walkthrough

• Delivery — .github/workflows/signed-receipts.yml
• Docs — docs/evidence/native-session-admission-20261031.json
• Implementation — editors/vscode/package-lock.json, editors/vscode/package.json, factoryline/credential_endpoint_admission.py, factoryline/primitive_observation_binding.py, factoryline/semantic_credential_sensor.py
• Other — plans/shared-security-evidence.md
• Tests — tests/test_context_efficiency.py, tests/test_publication_metadata.py, tests/test_semantic_credential_sensor.py, tests/test_signed_receipts.py

Fact-derived next action

• bind_changed_path_to_proof — This changed path has no explicit Graph Ops proof-input edge.

Findings

• blocking unmatched_changed_path — This changed path has no explicit Graph Ops proof-input edge.

Unproven claims

• No explicit proof-input edge is declared for .github/workflows/signed-receipts.yml.
• No explicit proof-input edge is declared for docs/evidence/native-session-admission-20261031.json.
• No explicit proof-input edge is declared for editors/vscode/package-lock.json.
• No explicit proof-input edge is declared for editors/vscode/package.json.
• No explicit proof-input edge is declared for factoryline/credential_endpoint_admission.py.
• No explicit proof-input edge is declared for factoryline/primitive_observation_binding.py.
• No explicit proof-input edge is declared for factoryline/semantic_credential_sensor.py.
• No explicit proof-input edge is declared for plans/shared-security-evidence.md.
• No explicit proof-input edge is declared for tests/test_context_efficiency.py.
• No explicit proof-input edge is declared for tests/test_publication_metadata.py.
• No explicit proof-input edge is declared for tests/test_semantic_credential_sensor.py.
• No explicit proof-input edge is declared for tests/test_signed_receipts.py.
• Pattern and guard-path audit state: not_configured; no runtime correctness or release approval is implied.

Authority boundary

Advisory only. This payload has no execution, approval, publication, deployment, signing, messaging, credential, connector, source write, test execution, repair authority. It does not use CodeRabbit credentials, interpret AI comments as proof, approve, merge, or modify source.

Existing Diff-to-Proof map

flowchart LR
  REVIEW["Diff-to-Proof Review"]
  C1["Changed: .github/workflows/signed-receipts.yml"]
  C1 --> REVIEW
  C2["Changed: docs/evidence/native-session-admission-20261031.json"]
  C2 --> REVIEW
  C3["Changed: editors/vscode/package-lock.json"]
  C3 --> REVIEW
  C4["Changed: editors/vscode/package.json"]
  C4 --> REVIEW
  C5["Changed: factoryline/credential_endpoint_admission.py"]
  C5 --> REVIEW
  C6["Changed: factoryline/primitive_observation_binding.py"]
  C6 --> REVIEW
  C7["Changed: factoryline/semantic_credential_sensor.py"]
  C7 --> REVIEW
  C8["Changed: plans/shared-security-evidence.md"]
  C8 --> REVIEW
  C9["Changed: tests/test_context_efficiency.py"]
  C9 --> REVIEW
  C10["Changed: tests/test_publication_metadata.py"]
  C10 --> REVIEW
  C11["Changed: tests/test_semantic_credential_sensor.py"]
  C11 --> REVIEW
  C12["Changed: tests/test_signed_receipts.py"]
  C12 --> REVIEW
  U1["Unmatched: .github/workflows/signed-receipts.yml"]
  REVIEW --> U1
  U2["Unmatched: docs/evidence/native-session-admission-20261031.json"]
  REVIEW --> U2
  U3["Unmatched: editors/vscode/package-lock.json"]
  REVIEW --> U3
  U4["Unmatched: editors/vscode/package.json"]
  REVIEW --> U4
  U5["Unmatched: factoryline/credential_endpoint_admission.py"]
  REVIEW --> U5
  U6["Unmatched: factoryline/primitive_observation_binding.py"]
  REVIEW --> U6
  U7["Unmatched: factoryline/semantic_credential_sensor.py"]
  REVIEW --> U7
  U8["Unmatched: plans/shared-security-evidence.md"]
  REVIEW --> U8
  U9["Unmatched: tests/test_context_efficiency.py"]
  REVIEW --> U9
  U10["Unmatched: tests/test_publication_metadata.py"]
  REVIEW --> U10
  U11["Unmatched: tests/test_semantic_credential_sensor.py"]
  REVIEW --> U11
  U12["Unmatched: tests/test_signed_receipts.py"]
  REVIEW --> U12
  F1["unmatched_changed_path"]
  REVIEW --> F1

Loading