Skip to content

Add maintenance App controls and validated follow-up repairs - #41

Draft
omry wants to merge 1 commit into
mainfrom
node-maintenance-app-repairs
Draft

Add maintenance App controls and validated follow-up repairs#41
omry wants to merge 1 commit into
mainfrom
node-maintenance-app-repairs

Conversation

@omry

@omry omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Maintainers can now select exact follow-up fixes in a security PR and start one validated batch from a native Run selected fixes button in Checks. The first supported repairs update retained, unqualified pnpm pins to compatible patches within the same minor version.

A shared GitHub App and Cloudflare Worker authenticate requests, verify the maintainer's access, capture the selected versions and PR revisions, and dispatch work to the repository's Actions. D1 prevents repeated webhook deliveries from dispatching the same request twice. Validation and publication use separate jobs: publication requires fresh compatibility and release-age evidence, frozen installation, configured project checks, confirmed advisory fixes, a bounded dependency diff, and an unchanged PR. Normal audits preserve a selected repair batch while its PR awaits review.

The shared renderer shows yellow review decisions, red hard blockers, and folded compatibility evidence beneath eligible rows. The main maintenance guide includes App installation as part of the overall setup; hosting instructions live in a separate operator guide. App registration, service deployment, and a live GitHub pilot remain pending. Existing audit execution is unchanged when the App is absent.

Validation:

  • Full Python suite: 1,318 tests passed; Ruff lint/format, Pyrefly, and shell syntax checks passed.
  • Worker: 14 tests passed; Cloudflare's local runtime verified signatures, native crypto, D1 deduplication, and exactly one mocked dispatch. Deployment dry-run passed.
  • Isolated Hydra trial: launch-editor 2.14.1 → 2.14.2 passed frozen installation and the production build; all three launch-editor advisories were confirmed fixed, with four unrelated advisories retained.
  • Real Git tests cover publication, stale consent, unrelated lockfile changes, concurrent branch updates, and preservation of selected repair batches.

Historical pin-rationale collection remains separate work tracked in #40. This change does not deploy the service, modify Hydra, or merge dependency proposals.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-22T17:08:50.097292Z 3c21189 Manual request
🔒 Security Review ⚠️ Failed 2026-10-22T15:29:54.137095Z
We couldn’t complete this review. Comment @codex security review to try again.		 59eae3e PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026

Copy link
Copy Markdown

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.

@omry

omry commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 119948105609,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948105609"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 119948106061,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106061"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 119948106121,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106121"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 119948106306,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106306"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 119948106066,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106066"
        },
        {
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 119948106273,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106273"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 119948106210,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106210"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 119948106111,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106111"
        }
      ],
      "head_sha": "3978f30596be0fd6950604271ec436035ae3ee77",
      "id": "sha256:427b517bda9b5c9ef8d7b2f0f2aaba9822bc1f9511130a2a1965edc7b7509225",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "pending"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 119956525493,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525493"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 119956525646,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525646"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 119956525692,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525692"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 119956525044,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525044"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 119956525630,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525630"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 119956526157,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956526157"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 119956525788,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525788"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 119956525856,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39816573073/job/119956525856"
        }
      ],
      "head_sha": "2d6df33e01c321799470df4c1e6c62680fbc80f8",
      "id": "sha256:a782aa4ae2f007e601251843cae2a4505b2ec7cb98c8e00b7e8a6457bb8c37cf",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 119941103968,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941103968"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 119941104479,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104479"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 119941104943,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104943"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 119941104536,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104536"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 119941104762,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104762"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 119941104804,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104804"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 119941104444,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104444"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 119941104547,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39812181235/job/119941104547"
        }
      ],
      "head_sha": "58d3411efe577e4e4d7d215b12fd4ff3dcc599e2",
      "id": "sha256:c659997e3681b6e613001cc372693464f2d4601e858b0f56f78de4c4e7231d94",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 119917091439,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917091439"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 119917091858,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917091858"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 119917092081,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917092081"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 119917092059,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917092059"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 119917091775,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917091775"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 119917092332,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917092332"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 119917092333,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917092333"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 119917092200,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39805373701/job/119917092200"
        }
      ],
      "head_sha": "59eae3e4ae6f75b088bafd67c2a8536ce2c95c6f",
      "id": "sha256:d4e593036b29631ecc3267ff1cb8b78bfb64e85b54e3af1f7dd836416707df73",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 119965792413,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792413"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 119965791567,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965791567"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 119965792363,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792363"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 119965792439,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792439"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 119965792500,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792500"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 119965792486,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792486"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 119965793131,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965793131"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 119965792217,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39819233686/job/119965792217"
        }
      ],
      "head_sha": "3c21189c7a9b369932496168ac70b84205450a63",
      "id": "sha256:dc688a3635145f60ce585483c2baccbef91d687329c89bd6c79d80e2393f3d03",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferrals": [],
  "findings": [
    {
      "disposition": "superseded-by-correction",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/actions/runs/39814162609/job/119948106273"
      ],
      "id": "ci:round3:node24-npm-pending",
      "rationale": "Seven hosted checks pass; the remaining npm toolchain check is still in progress. It does not authorize approval. The security correction requires a new head and fresh checks.",
      "status": "non-actionable"
    },
    {
      "disposition": "corrected",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4350415015",
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4350741754"
      ],
      "id": 4350415015,
      "invariant": "Approved exact patch repairs must support pnpm direct dependency importer records without allowing unrelated metadata changes.",
      "proposed_fix": [
        "node/runtime/repair.py: normalize selected importer version values, preserve peer suffix and specifier",
        "node/tests/test_selected_repairs.py: direct dependency regression and unrelated metadata rejection"
      ],
      "rationale": "The normalizer only handles direct string edges; importer version objects survive and reject an otherwise valid selected patch.",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vQ8nP"
    },
    {
      "disposition": "corrected",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4350803543",
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4350865927"
      ],
      "id": 4350803543,
      "invariant": "The published repair artifact must contain the exact validated dependency bytes and must not execute repository-configured diff helpers.",
      "proposed_fix": [
        "node/runtime/repair.py: disable external diff and text conversion during artifact export",
        "node/tests/test_selected_repairs.py: real Git malicious helper regression"
      ],
      "rationale": "The artifact export honors diff.external, so project validation can replace the tested patch with forged selected-package metadata.",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vR3A4"
    },
    {
      "disposition": "corrected",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4350911875",
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351031468"
      ],
      "id": 4350911875,
      "invariant": "Publication consumes the immutable candidate artifact sealed before any dependency or project validation scripts run.",
      "proposed_fix": [
        ".github/workflows/node-repair.yml: separate candidate sealing and validation jobs; publish by trusted candidate artifact ID",
        "node/runtime/repair.py: split candidate preparation from validation; isolate candidate and evidence directories",
        "node/repair/action.yml: support separate validation operation",
        "node/tests/test_selected_repairs.py: sealed candidate and workflow trust-boundary regressions",
        "docs/node-maintenance-operator.md: document immutable candidate handoff"
      ],
      "rationale": "A detached validation process can rewrite a patch on the same runner before upload; in-memory capture does not seal the uploaded artifact.",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vSHVk"
    },
    {
      "disposition": "corrected",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351084571",
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351197070"
      ],
      "id": 4351084571,
      "invariant": "No repository hook executes before candidate sealing.",
      "proposed_fix": [
        "node/runtime/repair.py: disable pnpmfile hooks in candidate resolution",
        "node/tests/test_selected_repairs.py: real pnpm hook execution regression"
      ],
      "rationale": "pnpm lifecycle suppression does not disable pnpmfile hooks.",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vShD5"
    },
    {
      "disposition": "corrected",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351084579",
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351197505"
      ],
      "id": 4351084579,
      "invariant": "A pushed repair remains protected even when its PR report update fails.",
      "proposed_fix": [
        "node/runtime/repair.py: record repair state in the commit",
        "node/publish/publish.sh: retain branches based on repair commit history",
        "node/tests/test_selected_repairs.py: failed report publication and branch retention regressions"
      ],
      "rationale": "PR-body-only repair retention is absent after a successful push followed by a failed description update.",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vShD_"
    },
    {
      "disposition": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/41#discussion_r4351246324"
      ],
      "id": 4351246324,
      "invariant": "Bot-authored repair reports use only pre-validation sealed audit evidence and the platform validation-job outcome.",
      "proposed_fix": [
        "node/runtime/repair.py: seal audit report with candidate before validation; publish only that report",
        " .github/workflows/node-repair.yml: stop downloading validation evidence in publisher",
        "node/tests/test_selected_repairs.py: forged report cannot replace the sealed report",
        "docs/node-maintenance-operator.md: explain trusted audit report and linked validation logs"
      ],
      "rationale": "The validation runner can replace result.md before upload, so raw validation output must not become privileged PR report content.",
      "status": "accepted",
      "thread_id": "PRRT_kwDOVJzQB86vS5Sp"
    }
  ],
  "pr": {
    "base_ref": "main",
    "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
    "body_digest": "sha256:d5f22384092b8f45bb28a8aa20b4c74d3816d8e26ba996cb18b7d78319ad58fc",
    "diff_digest": "sha256:98dd51ca12ae2fa92824ba9160fcd744cc1119646f1ca1dd76e9dd87f8d2573f",
    "head_ref": "node-maintenance-app-repairs",
    "head_sha": "3c21189c7a9b369932496168ac70b84205450a63",
    "pr": 41,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:bd00742b901d1b7f39c88b388878745ffe4de5d46dfb2f02fdfa4f32dc7c26c8"
  },
  "record_version": 10,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-22T15:29:49Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:d16b26ae9fd62bb99eed497d46cc4699dfbd36d877a4df08bb8651c92bf664a5",
      "created_at": "2026-10-22T15:37:38Z",
      "head_sha": "59eae3e4ae6f75b088bafd67c2a8536ce2c95c6f",
      "id": 6344747898,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T15:29:49Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bb68f9605ed945983c41205e6f64f21a66d14d78731fbd1eea8f662f1d986e47",
      "created_at": "2026-10-22T16:16:20Z",
      "head_sha": "58d3411efe577e4e4d7d215b12fd4ff3dcc599e2",
      "id": 6345578626,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T15:29:49Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:e210a3a0636294e8c518e4b0373d170f5819cf4e808c9a4eb2be52eaf3af6cfc",
      "created_at": "2026-10-22T16:29:08Z",
      "head_sha": "3978f30596be0fd6950604271ec436035ae3ee77",
      "id": 6345837927,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T15:29:49Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:edae8bd5a3555b1579833006c8be7897db803f09a357ec18c5d0038cf4c06562",
      "created_at": "2026-10-22T16:47:01Z",
      "head_sha": "2d6df33e01c321799470df4c1e6c62680fbc80f8",
      "id": 6346171733,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T15:29:49Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:0c57de5fb86822c671ebc38ca65c1ce8e963d623135b32c45e760a8979699e7c",
      "created_at": "2026-10-22T17:05:14Z",
      "head_sha": "3c21189c7a9b369932496168ac70b84205450a63",
      "id": 6346541182,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:00e95fb7c902278d1264cc6dba4287656d91fb120884857879155541e40a3639",
      "commit_id": "59eae3e4ae6f75b088bafd67c2a8536ce2c95c6f",
      "id": 5616890174,
      "inline_message_ids": [
        4350415015
      ],
      "request_comment_id": 6344747898,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-22T15:42:42Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vQ8nP"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:910a60c80767886e2785b041b57a06132d4f9f47c6986d99664663cf5034fbdb",
      "commit_id": "58d3411efe577e4e4d7d215b12fd4ff3dcc599e2",
      "id": 5617443539,
      "inline_message_ids": [
        4350803543
      ],
      "request_comment_id": 6345578626,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-22T16:21:02Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vR3A4"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:fdfac4172302cc664ba29dd4a0f3689b2fc84b078eda3d7b2fa5206078a1daa9",
      "commit_id": "3978f30596be0fd6950604271ec436035ae3ee77",
      "id": 5617584368,
      "inline_message_ids": [
        4350911875
      ],
      "request_comment_id": 6345837927,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-22T16:32:12Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vSHVk"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:31e7a26dbc8c50a8bfd74f4b4c5e348ac5f5dfc4cdb0bad155cf182756738a78",
      "commit_id": "2d6df33e01c321799470df4c1e6c62680fbc80f8",
      "id": 5617796699,
      "inline_message_ids": [
        4351084571,
        4351084579
      ],
      "request_comment_id": 6346171733,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-22T16:51:29Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vShD5",
        "PRRT_kwDOVJzQB86vShD_"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:0c77a1769644579233b6a3b08f50eb642c415dec0f71b5c6f7a436e95bb24208",
      "commit_id": "3c21189c7a9b369932496168ac70b84205450a63",
      "id": 5618001022,
      "inline_message_ids": [
        4351246324
      ],
      "request_comment_id": 6346541182,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-22T17:08:47Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vS5Sp"
      ]
    }
  ],
  "revision_fingerprint": "sha256:6ed6f7cc688409b383157e6639765ddcd6474a28201b44f994fd4047967bd040",
  "rounds": [
    {
      "applied_fix_paths": [
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py"
      ],
      "disposition_changes": [
        4350415015
      ],
      "effective_diff_digest": "sha256:946fd9b821aa57bd506a049237b732ff3b567cece42b773ab2cc97b6e7bcc2d3",
      "finding_ids": [
        4350415015
      ],
      "invariants": [
        "Approved exact patch repairs support direct dependency importer records while retaining unrelated metadata and peer edges."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py"
      ],
      "resulting_head": "58d3411efe577e4e4d7d215b12fd4ff3dcc599e2",
      "review_observation_id": null,
      "review_request_id": 6344747898,
      "review_result_id": 5616890174,
      "reviewed_head": "59eae3e4ae6f75b088bafd67c2a8536ce2c95c6f",
      "root_cause": "The scope normalizer handled dependency string edges but not pnpm importer specifier/version objects.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py"
      ],
      "disposition_changes": [
        4350803543
      ],
      "effective_diff_digest": "sha256:9d51550806f547a5823afecca453264dc3833106ad1c813fdb0ce380b8cbbb15",
      "finding_ids": [
        4350803543
      ],
      "invariants": [
        "The published repair artifact must retain the validated candidate and must not execute repository-configured diff helpers."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py"
      ],
      "resulting_head": "3978f30596be0fd6950604271ec436035ae3ee77",
      "review_observation_id": null,
      "review_request_id": 6345578626,
      "review_result_id": 5617443539,
      "reviewed_head": "58d3411efe577e4e4d7d215b12fd4ff3dcc599e2",
      "root_cause": "Artifact export ran after project scripts and honored repository-configured external diff helpers.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        ".github/workflows/node-repair.yml",
        "node/runtime/repair.py",
        "node/repair/action.yml",
        "node/tests/test_selected_repairs.py",
        "docs/node-maintenance-operator.md"
      ],
      "disposition_changes": [
        4350911875,
        "ci:round3:node24-npm-pending"
      ],
      "effective_diff_digest": "sha256:428898a01c5b30ced051d475a0b73b37d7dcce1a4d0278fce13ff398b750f488",
      "finding_ids": [
        4350911875,
        "ci:round3:node24-npm-pending"
      ],
      "invariants": [
        "Publication consumes the immutable candidate artifact sealed before dependency/project validation scripts run."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        ".github/workflows/node-repair.yml",
        "node/runtime/repair.py",
        "node/repair/action.yml",
        "node/tests/test_selected_repairs.py",
        "docs/node-maintenance-operator.md"
      ],
      "resulting_head": "2d6df33e01c321799470df4c1e6c62680fbc80f8",
      "review_observation_id": null,
      "review_request_id": 6345837927,
      "review_result_id": 5617584368,
      "reviewed_head": "3978f30596be0fd6950604271ec436035ae3ee77",
      "root_cause": "Validation and artifact upload shared a runner, so a detached validation process could replace the captured patch before upload.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        ".github/workflows/node-repair.yml",
        "docs/node-maintenance-operator.md",
        "node/publish/publish.sh",
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py",
        "node/tests/verify_node_project.py"
      ],
      "disposition_changes": [
        4351084571,
        4351084579
      ],
      "effective_diff_digest": "sha256:98dd51ca12ae2fa92824ba9160fcd744cc1119646f1ca1dd76e9dd87f8d2573f",
      "finding_ids": [
        4351084571,
        4351084579
      ],
      "invariants": [
        "No repository hook executes before candidate sealing.",
        "Pushed repairs remain protected if updating the PR description fails."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        ".github/workflows/node-repair.yml",
        "docs/node-maintenance-operator.md",
        "node/publish/publish.sh",
        "node/runtime/repair.py",
        "node/tests/test_selected_repairs.py",
        "node/tests/verify_node_project.py"
      ],
      "resulting_head": "3c21189c7a9b369932496168ac70b84205450a63",
      "review_observation_id": null,
      "review_request_id": 6346171733,
      "review_result_id": 5617796699,
      "reviewed_head": "2d6df33e01c321799470df4c1e6c62680fbc80f8",
      "root_cause": "pnpmfile hooks are separate from lifecycle scripts and pnpm 11 uses its own environment namespace; repair retention depended on mutable PR-body state written after the push.",
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 59eae3e

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59eae3e4ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/repair.py Outdated
@omry
omry force-pushed the node-maintenance-app-repairs branch from 59eae3e to 58d3411 Compare October 22, 2026 16:13
@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 58d3411

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58d3411efe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/repair.py Outdated
@omry
omry force-pushed the node-maintenance-app-repairs branch from 58d3411 to 3978f30 Compare October 22, 2026 16:26
@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 3978f30

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3978f30596

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/repair.py Outdated
@omry
omry force-pushed the node-maintenance-app-repairs branch from 3978f30 to 2d6df33 Compare October 22, 2026 16:45
@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 2d6df33

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d6df33e01

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/repair.py Outdated
Comment thread node/publish/publish.sh Outdated
@omry
omry force-pushed the node-maintenance-app-repairs branch from 2d6df33 to 3c21189 Compare October 22, 2026 17:02
@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 3c21189

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c21189c7a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/repair.py Outdated
@omry
Add maintenance App controls and validated follow-up repairs
fe2645d 
Add shared GitHub App controls, a Cloudflare webhook receiver, and validated follow-up repairs for approved pnpm override patches. Document repository installation and service operation. Normalize direct dependency importer records while preserving unrelated lockfile data.
@omry
omry force-pushed the node-maintenance-app-repairs branch from 3c21189 to fe2645d Compare October 22, 2026 17:21
@omry
omry marked this pull request as draft October 22, 2026 17:27
@omry omry mentioned this pull request Oct 22, 2026
Open
omry added a commit that referenced this pull request Oct 23, 2026
@omry
[node-maintenance-repair/1] Receive a signed webhook and read the ins…
b815261 
…talled repository

Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository.

Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions.

Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly.

Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof.

Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.
omry added a commit that referenced this pull request Oct 23, 2026
@omry
[node-maintenance-repair/1] Receive a signed webhook and read the ins…
0155e8b 
…talled repository

Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository.

Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions.

Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly.

Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof.

Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.
omry added a commit that referenced this pull request Oct 23, 2026
@omry
[node-maintenance-repair/1] Receive a signed webhook and read the ins…
6009198 
…talled repository

Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository.

Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions.

Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly.

Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof.

Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry