Repository navigation
Strengthen source-bound admission and proof validation - #270
Merged
Merged
Conversation
Paired development retest: 27 TP, 1 FP, 6 UNCLEAR; known-TP retention 27/35. All 76 labelled cases across 58 repositories completed end-to-end verification, with no previously admitted TP lost. This exposed-cohort retest is not a new held-out claim.
Assemble policy and tenant metadata before ordinary source-closed sealing, reducing public CLI seals from four to two. Keep conditional/runtime reseals, receipt binding and independent validation. Reject malformed metadata before scanning. Validation: focused CLI, configuration, conditional, runtime and overflow controls; lint, formatting, C901 <= 10; six hash-bound workflow checks. Large-repository timing remains under measurement.
Use the shared source-bound payload projection for local request-provider checks so structural provider evidence survives admission. Preserve real mutation, escape and helper-epoch barriers. Validation:36 targeted controls, lint/format and5 hash-bound workflow checks; actual pickle and command targets pass public CLI, persisted receipt and independent regeneration. No fresh held-out claim.
Record92.31% decided precision(24/26) alongside68.57% known-TP retention(24/35), AI label provenance, frame/freeze, repository concentration and13 admission errors. Mark the small admitted sample underpowered and distinguish the unreleased candidate from0.49.5 binaries. Gzip preserves exact scorer bytes while removing428995 bytes of expanded JSON. Validation:12 source/metric/archive assertions and6 hash-bound workflow checks. Local record only; no publication or gate-readiness claim.
Transport finite import/provider bindings through canonical callbacks and preserve scalar interpolation/default origins. Consolidate equivalent rejection guards to bring all four affected modules to C901<=10. Validation:836 related checks,284 affected controls and byte-bound authority proofs. Combined final candidate:58 repositories/76 fixed AI-labelled alerts through publicCLI, persisted receipt and independent validation;32TP,1FP,6 admittedUNCLEAR;5 recoveredTPs andzero priorTP/raw-identity losses. Development retest; no new held-out claim.
Share fresh complete verifier-owned rows within eligible seals while retaining source/tenant/profile/epoch checks and independent later regeneration. Remove unused configuration-byte plumbing, an unreachable return and repeated identity projections; check cheap role eligibility before rescanning. Validation:27 focused controls,6 workflow gates, scoped-v2 equivalence and combined58-repository end-to-end run. All121 prior raw records and all previously admitted labelledTPs retained. No module/dependency/cap increase.
Record the fixed76-alert/58-repository development retest:32TP1FP6 admittedUNCLEAR,96.97% decided precision and91.43% known-TP retention. Five additionalTPs recovered withzero previousTP/raw-record losses. All58 nativeCLI/receipt/independent paths completed in287.86seconds; median repository6.72seconds, slowest286.80seconds. Preserve AI-only/exposed/underpowered qualification and remaining3 missedTPs/1FP. Source snapshots and runtime assets pass both hash-bound QA scopes; no publication or gate-readiness claim.
zrk222
enabled auto-merge
November 1, 2026 02:34
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
FactoryLine Proof ReviewCommit: Changed-scope walkthrough
Fact-derived next action
Findings
Unproven claims
Authority boundaryAdvisory only. This payload has no execution, approval, publication, deployment, signing, messaging, credential, connector, source write, test execution, repair authority. It does not use CodeRabbit credentials, interpret AI comments as proof, approve, merge, or modify source. Existing Diff-to-Proof mapflowchart LR
REVIEW["Diff-to-Proof Review"]
C1["Changed: docs/evidence/study434-artifacts.sha256"]
C1 --> REVIEW
C2["Changed: docs/evidence/study434-development-results.md"]
C2 --> REVIEW
C3["Changed: docs/evidence/study434-development-score.json.gz"]
C3 --> REVIEW
C4["Changed: docs/evidence/study434-held-out-results.md"]
C4 --> REVIEW
C5["Changed: docs/evidence/study434-held-out-score.json.gz"]
C5 --> REVIEW
C6["Changed: docs/evidence/study434-sampling-and-errors.json.gz"]
C6 --> REVIEW
C7["Changed: docs/evidence/study435-record/README.md"]
C7 --> REVIEW
C8["Changed: docs/evidence/study435-record/artifact-sha256.json"]
C8 --> REVIEW
C9["Changed: docs/evidence/study435-record/original-blind-score.json.gz"]
C9 --> REVIEW
C10["Changed: docs/evidence/study435-record/post-study-rubric-score.json.gz"]
C10 --> REVIEW
C11["Changed: docs/evidence/study435-record/sampling-provenance-error-ledger.json"]
C11 --> REVIEW
C12["Changed: factoryline/atomic_proof_adapter.py"]
C12 --> REVIEW
C13["Changed: factoryline/audit_action_refs.py"]
C13 --> REVIEW
C14["Changed: factoryline/captured_security_audit.py"]
C14 --> REVIEW
C15["Changed: factoryline/cli_audit.py"]
C15 --> REVIEW
C16["Changed: factoryline/cli_enterprise.py"]
C16 --> REVIEW
C17["Changed: factoryline/credential_endpoint_admission.py"]
C17 --> REVIEW
C18["Changed: factoryline/credential_role_identity_effects.py"]
C18 --> REVIEW
C19["Changed: factoryline/credential_role_method_use_getter_audit.py"]
C19 --> REVIEW
C20["Changed: factoryline/credential_role_paths.py"]
C20 --> REVIEW
C21["Changed: factoryline/enterprise_receipts.py"]
C21 --> REVIEW
C22["Changed: factoryline/finite_capture.py"]
C22 --> REVIEW
C23["Changed: factoryline/import_context.py"]
C23 --> REVIEW
C24["Changed: factoryline/primitive_observation_binding.py"]
C24 --> REVIEW
C25["Changed: factoryline/review_audits.py"]
C25 --> REVIEW
C26["Changed: factoryline/review_integrity.py"]
C26 --> REVIEW
C27["Changed: factoryline/semantic_credential_sensor.py"]
C27 --> REVIEW
C28["Changed: specs/enterprise-revocation-freshness-v1.md"]
C28 --> REVIEW
C29["Changed: tests/test_atomic_proof_adapter.py"]
C29 --> REVIEW
C30["Changed: tests/test_credential_authority_recovery.py"]
C30 --> REVIEW
C31["Changed: tests/test_enterprise_receipts.py"]
C31 --> REVIEW
C32["Changed: tests/test_import_context_profiles.py"]
C32 --> REVIEW
C33["Changed: tests/test_review_audits.py"]
C33 --> REVIEW
C34["Changed: tests/test_review_integrity.py"]
C34 --> REVIEW
C35["Changed: tests/test_runtime_audit_integrity.py"]
C35 --> REVIEW
C36["Changed: tests/test_semantic_credential_sensor.py"]
C36 --> REVIEW
U1["Unmatched: docs/evidence/study434-artifacts.sha256"]
REVIEW --> U1
U2["Unmatched: docs/evidence/study434-development-results.md"]
REVIEW --> U2
U3["Unmatched: docs/evidence/study434-development-score.json.gz"]
REVIEW --> U3
U4["Unmatched: docs/evidence/study434-held-out-results.md"]
REVIEW --> U4
U5["Unmatched: docs/evidence/study434-held-out-score.json.gz"]
REVIEW --> U5
U6["Unmatched: docs/evidence/study434-sampling-and-errors.json.gz"]
REVIEW --> U6
U7["Unmatched: docs/evidence/study435-record/README.md"]
REVIEW --> U7
U8["Unmatched: docs/evidence/study435-record/artifact-sha256.json"]
REVIEW --> U8
U9["Unmatched: docs/evidence/study435-record/original-blind-score.json.gz"]
REVIEW --> U9
U10["Unmatched: docs/evidence/study435-record/post-study-rubric-score.json.gz"]
REVIEW --> U10
U11["Unmatched: docs/evidence/study435-record/sampling-provenance-error-ledger.json"]
REVIEW --> U11
U12["Unmatched: factoryline/atomic_proof_adapter.py"]
REVIEW --> U12
U13["Unmatched: factoryline/audit_action_refs.py"]
REVIEW --> U13
U14["Unmatched: factoryline/captured_security_audit.py"]
REVIEW --> U14
U15["Unmatched: factoryline/cli_audit.py"]
REVIEW --> U15
U16["Unmatched: factoryline/cli_enterprise.py"]
REVIEW --> U16
U17["Unmatched: factoryline/credential_endpoint_admission.py"]
REVIEW --> U17
U18["Unmatched: factoryline/credential_role_identity_effects.py"]
REVIEW --> U18
U19["Unmatched: factoryline/credential_role_method_use_getter_audit.py"]
REVIEW --> U19
U20["Unmatched: factoryline/credential_role_paths.py"]
REVIEW --> U20
U21["Unmatched: factoryline/enterprise_receipts.py"]
REVIEW --> U21
U22["Unmatched: factoryline/finite_capture.py"]
REVIEW --> U22
U23["Unmatched: factoryline/import_context.py"]
REVIEW --> U23
U24["Unmatched: factoryline/primitive_observation_binding.py"]
REVIEW --> U24
U25["Unmatched: factoryline/review_audits.py"]
REVIEW --> U25
U26["Unmatched: factoryline/review_integrity.py"]
REVIEW --> U26
U27["Unmatched: factoryline/semantic_credential_sensor.py"]
REVIEW --> U27
U28["Unmatched: specs/enterprise-revocation-freshness-v1.md"]
REVIEW --> U28
U29["Unmatched: tests/test_atomic_proof_adapter.py"]
REVIEW --> U29
U30["Unmatched: tests/test_credential_authority_recovery.py"]
REVIEW --> U30
U31["Unmatched: tests/test_enterprise_receipts.py"]
REVIEW --> U31
U32["Unmatched: tests/test_import_context_profiles.py"]
REVIEW --> U32
U33["Unmatched: tests/test_review_audits.py"]
REVIEW --> U33
U34["Unmatched: tests/test_review_integrity.py"]
REVIEW --> U34
U35["Unmatched: tests/test_runtime_audit_integrity.py"]
REVIEW --> U35
U36["Unmatched: tests/test_semantic_credential_sensor.py"]
REVIEW --> U36
F1["unmatched_changed_path"]
REVIEW --> F1
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Share captured-source checks across credential admission and preserve verified findings through report and remediation paths. Tighten DSSE/Atomic parsing and revocation handling, and remove repeated source analysis.
Includes the sealed Study434/435 records with original blind labels, post-study corrections and qualification limits kept separate. Validation: targeted unit controls, CF workflow receipts, native scan receipts and independent-process verification. The unfinished authority prototype is excluded.