Repository navigation
Audit main daily for knowledge changes that landed without a record - #216
Conversation
The gate constrains every merge path the service knows about. The design also requires a daily audit for the paths it does not (an admin bypass, a direct push, a merge the ledger missed): any unrecorded knowledge merge pauses auto-merge and alerts. - audit.audit_main walks main's first-parent history from the last audited commit (a ledger cursor; the first run only records the baseline). Every commit whose change against its first parent touches knowledge/ must be a recorded merge. The proof is structural, never a commit message: the commit's SHA is a change set's merge SHA, or it is a two-parent merge whose second parent is the exact head a merged change set recorded (what the merge queue lands) and that changed knowledge only as that head did (every knowledge path it changed was changed by the PR and holds exactly the head's content and file mode). A direct push titled "(#42)", or a merge of a recorded head that smuggles extra edits, is still caught. Anything else pauses the repositories it touched (everything, for knowledge outside a repository scope), dequeues their open knowledge PRs and goes to people. Repositories not in auto_merge only get an unrecorded_merge trace record. - Commits younger than a 2-hour grace period wait for the next run, so the audit never races the scheduler recording a merge. - The scheduler runs it every 24 hours. The pause logic is now Scheduler._pause, shared with the overturn breaker. - KnowledgeRepo gains first_parent_commits and changed_names. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e94b2a5d33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if rt.clock() - committed_at < GRACE: | ||
| break # too recent to judge: the next run starts here |
There was a problem hiding this comment.
A direct-pushed commit can carry an arbitrarily future committer timestamp, so rt.clock() - committed_at < GRACE remains true and this break leaves the cursor before that commit. Because every later audit encounters the same commit first, it also prevents all subsequent first-parent commits from being audited until that timestamp ages past the grace period, defeating the control this code is intended to provide. Persist a first-observed time or use a trusted remote timestamp rather than %ct.
Useful? React with 👍 / 👎.
| if sha in merge_shas or (len(parents) == 2 and parents[1] in merged_heads | ||
| and _merge_carries_only_the_head(rt, parents, sha, paths)): |
There was a problem hiding this comment.
For a squash-merged change set, the recorded head_sha is not an ancestor of main and remains in merged_heads indefinitely. A later bypass commit can therefore merge that stale head as its second parent and restore any subset of its knowledge files to the stale head's blobs; the subset and blob checks pass, so this new unrecorded revert is treated as authorized even though the ledger record belongs to the earlier squash merge. The fallback proof must be tied to the specific merge occurrence rather than accepting any future two-parent commit carrying a previously recorded head.
Useful? React with 👍 / 👎.
Knowledge-service redesign follow-up: the daily post-merge audit from the design. Every knowledge change that landed on main must have a ledger record; if one doesn't, auto-merge is paused and people are alerted.
audit.audit_mainwalks main's first-parent history from a ledger cursor (the first run records a baseline). Every commit that touchesknowledge/must be a recorded merge.auto_mergeare paused (everything, for knowledge outside a repository scope), their open knowledge PRs dequeued, and people alerted;unrecorded_mergetrace.Scheduler._pause, shared with the overturn breaker.Commit hook approved; full suite and SPEC freshness pass locally.
🤖 Generated with Claude Code