Skip to content

[node-maintenance-repair/8.1.1] Prepare and seal initial normal-audit evidence on a script-free producer with complete policy enrollment and exact preserved-code reuse - #51

Open
omry wants to merge 1 commit into
pr50from
pr51
Open

[node-maintenance-repair/8.1.1] Prepare and seal initial normal-audit evidence on a script-free producer with complete policy enrollment and exact preserved-code reuse#51
omry wants to merge 1 commit into
pr50from
pr51

Conversation

@omry

@omry omry commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Prepare normal Node audit evidence on a fresh runner and seal it before project scripts run. Validate the exact prepared dependency and Node declaration files on a separate runner, with the producer's concrete Node and package-manager versions.

Keep original advisory evidence in the existing report artifact. Bind it to the trusted producer's native job Check notice and immutable artifact ID/digests, verify those bindings before publication, and retain exact locators in commit metadata. Preserve the existing renderer and reject missing, ambiguous, expired or mismatched evidence.

Supported caller templates and fleet setup checks include the required Actions/Checks read permissions. Provider run, job, Check and artifact heads bind the triggering revision; the sealed checkout and dependency state bind the separately planned audit revision.

Reject security candidates that bypass a retained exact direct override and restore the original dependency files. Prepared validation fails closed when either audit is unavailable, retaining full diagnostics and the separate install/build outcomes. Ordinary audit/project-check semantics remain unchanged.

Cumulative repair consumption, repaired-candidate publication and installation rollout remain later slices. The isolated demo must prove distinct-run readback and sibling-job forgery rejection before dependent work starts.

Validation: 1,527 Python tests, Ruff lint/format, Pyrefly and Bash syntax pass. Complete authored production growth is 626 lines under the recorded limit of 650. Hosted provider acceptance passed at this exact head: initial producer and separate validation preserved the exact pin and Node 24.22.1 plan; a distinct read-only run accepted the genuine report and rejected an identical sibling-job copy. The complete original demo file tree and existing PR are restored.

@omry
omry changed the base branch from main to pr50 October 28, 2026 12:17
@omry omry changed the title [node-maintenance-repair/8.1.1] Prepare and seal initial normal-audit evidence on a script-free producer with complete p [node-maintenance-repair/8.1.1] Prepare and seal initial normal-audit evidence on a script-free producer with complete policy enrollment and exact preserved-code reuse Oct 28, 2026
@omry
omry added this pull request to stack #44 October 28, 2026 12:20
@omry

omry commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:5f94cba99cbf4e7eab2415dad47c9431b1801a9fa2e42814aa8ae4c842cbb021",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:5f94cba99cbf4e7eab2415dad47c9431b1801a9fa2e42814aa8ae4c842cbb021",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 122926287141
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 122926286367
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 122926286914
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 122926286750
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 122926286693
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 122926287104
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 122926286738
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 122926286958
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:738a9938cf6aaac1f4693a79744a9007efdbd92c3293851fcc1332dc603bbc0f",
      "operation_identity": "sha256:8c9373354d267d9377b096c001ef55f9784c4b8c7e8ff5732fc6106af32dfb2b",
      "review_request": {
        "body_digest": "sha256:4e5f50ffe80442b9ceea7680f48384838ac387a6fcce37d9fa696b537c3f0340",
        "id": 6473906241
      },
      "review_result": {
        "body_digest": "sha256:62c649f4d52bbc7260e8ba946b58d51eb553a58a9c6da2d96ed55d0934e1e430",
        "id": 6474021459
      }
    },
    "evidence_fingerprint": "sha256:8f8947102c8bd86d2ad55cb9bb061693a4d8adc118c6cda400a86abb79b30b16",
    "head_sha": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
    "operation_identity": "sha256:8c9373354d267d9377b096c001ef55f9784c4b8c7e8ff5732fc6106af32dfb2b",
    "review_request_id": 6473906241,
    "review_result_id": 6474021459,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:5f94cba99cbf4e7eab2415dad47c9431b1801a9fa2e42814aa8ae4c842cbb021",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "repair-app",
      "run_id": 122926287141
    },
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 122926286367
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 122926286914
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 122926286750
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 122926286693
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 122926287104
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 122926286738
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 122926286958
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 122843242838,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843242838"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 122843196626,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843196626"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 122843197411,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843197411"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 122843195119,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843195119"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 122843255353,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843255353"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 122843198067,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843198067"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 122843197446,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843197446"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 122843197228,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122843197228"
        }
      ],
      "head_sha": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "id": "sha256:c6dccc5fe765d061ec4ec2adf149828969058a5963fcda64e94793264e23b81d",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 122926287141,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926287141"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 122926286367,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286367"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 122926286914,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286914"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 122926286750,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286750"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 122926286693,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286693"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 122926287104,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926287104"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 122926286738,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286738"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 122926286958,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40719522881/job/122926286958"
        }
      ],
      "head_sha": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
      "id": "sha256:e5323fc63d22d80cf3ad55ae991babfad97fb7deabdc01f15b8ffe4050bda8df",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 122810384551,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384551"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 122810384216,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384216"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 122810384672,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384672"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 122810384931,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384931"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 122810384564,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384564"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 122810384890,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384890"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 122810384694,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384694"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 122810384810,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/40686586295/job/122810384810"
        }
      ],
      "head_sha": "250c1f224a4da5e1a65d0a61dae0e80aa1e5ef7e",
      "id": "sha256:f5d5242223b8f1080de7eda19b66a6e8cb4f4bd042e559c80ae05016355e35c8",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "verified-non-actionable",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/actions/runs/40693698535/job/122834755616",
        "/home/omry/dev/github-actions/.awd/reports/node-security-previews/slice8-1-1-manual/pr51-ci-transient-classification.json",
        "/home/omry/dev/github-actions/.awd/reports/node-security-previews/slice8-1-1-manual/pr51-required-checks-round2-final.json"
      ],
      "id": "ci-job:122834755616",
      "invariant": "Runtime security metadata must remain verified; an external read timeout must fail closed and may be retried without bypassing the check.",
      "rationale": "Node official release-index HTTPS read timed out. One failed-job-only rerun passed and all eight current exact-head checks are now stably successful; no source correction or review exception was needed.",
      "source_surface": "required-check",
      "status": "resolved"
    },
    {
      "classification": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/51#discussion_r4400649408",
        ".github/workflows/node-publish.yml:45",
        "https://github.com/hydra-ecosystem/github-actions/commit/e366188340ea599c61bf78207af7a3af12b5de8a",
        "https://github.com/hydra-ecosystem/github-actions/pull/51#discussion_r4400932712",
        "/home/omry/dev/github-actions/.awd/reports/node-security-previews/slice8-1-1-manual/pr51-correction-local-review.json"
      ],
      "fix_revision": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "id": 4400649408,
      "invariant": "Supported callers must grant the read permissions required by their reusable workflow chain.",
      "proposed_paths": [
        "node/caller.yml",
        "node/coordinated-caller.yml",
        "node/runtime/fleet.py",
        "node/tests/test_fleet_setup.py"
      ],
      "rationale": "Concrete existing integration failure; correct the existing contract without adding permissions beyond the already agreed read-only Actions/Checks needs or any new trust mechanism.",
      "severity": "high",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86xHxhj"
    },
    {
      "classification": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/51#discussion_r4400649418",
        "node/runtime/templates/dependency_audit.py:4143",
        "https://github.com/hydra-ecosystem/github-actions/commit/e366188340ea599c61bf78207af7a3af12b5de8a",
        "https://github.com/hydra-ecosystem/github-actions/pull/51#discussion_r4400934553",
        "/home/omry/dev/github-actions/.awd/reports/node-security-previews/slice8-1-1-manual/pr51-correction-local-review.json"
      ],
      "fix_revision": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "id": 4400649418,
      "invariant": "Bind provider metadata to the triggering run revision and the sealed checkout independently to the planned audit revision.",
      "proposed_paths": [
        "node/runtime/templates/dependency_audit.py",
        "node/tests/test_dependency_audit_publisher.py"
      ],
      "rationale": "Concrete existing integration failure; correct the existing contract without adding permissions beyond the already agreed read-only Actions/Checks needs or any new trust mechanism.",
      "severity": "medium",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86xHxho"
    }
  ],
  "pr": {
    "base_ref": "pr50",
    "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
    "body_digest": "sha256:1995e919307ddf53423d76d8c330231ed4358dfdcdf621785dd6593f55a34a27",
    "body_identity_version": 2,
    "diff_digest": "sha256:06200982726c83e12386a9733ba33bc04172905f067c5b794844882fbcbf73e4",
    "head_ref": "pr51",
    "head_sha": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
    "pr": 51,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:ea7f37794c85efed62e9aef71cb9f4c4417b592c901a31e34f060a59d3984085"
  },
  "record_version": 10,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-28T12:17:24Z",
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:fc79a38d283d5003c81f8825b024be87ff0bb3d24fffe03c9e51a7c0b2a4c1fc",
      "created_at": "2026-10-28T12:37:01Z",
      "head_sha": "250c1f224a4da5e1a65d0a61dae0e80aa1e5ef7e",
      "id": 6469157569,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-28T12:17:24Z",
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:b9b73dd512f185b19cecd4427efdca8801631b0d3c6c786626b75ca11317dac3",
      "created_at": "2026-10-28T13:19:11Z",
      "head_sha": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "id": 6470052059,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-28T12:17:24Z",
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:4e5f50ffe80442b9ceea7680f48384838ac387a6fcce37d9fa696b537c3f0340",
      "created_at": "2026-10-28T15:58:24Z",
      "head_sha": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
      "id": 6473906241,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:9c82952e689c9fe91a7d45bd3f31463a99c9db51ee6d728fe5d4b150670e7830",
      "commit_id": "250c1f224a4da5e1a65d0a61dae0e80aa1e5ef7e",
      "id": 5682718250,
      "inline_message_ids": [
        4400649408,
        4400649418
      ],
      "request_comment_id": 6469157569,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-28T12:41:02Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86xHxhj",
        "PRRT_kwDOVJzQB86xHxho"
      ]
    },
    {
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:4b2da9970560de3ad0c39895f4db75987d2aca55247a7fc9c0013e88ff70c1ac",
      "commit_id": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "id": 6470124981,
      "inline_message_ids": [],
      "request_comment_id": 6470052059,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-28T13:22:35Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr50",
      "base_sha": "0ef9690822c45923eede8a0ef769405b7492f4e9",
      "body_digest": "sha256:62c649f4d52bbc7260e8ba946b58d51eb553a58a9c6da2d96ed55d0934e1e430",
      "commit_id": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
      "id": 6474021459,
      "inline_message_ids": [],
      "request_comment_id": 6473906241,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-28T16:03:14Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:5f94cba99cbf4e7eab2415dad47c9431b1801a9fa2e42814aa8ae4c842cbb021",
  "rounds": [
    {
      "applied_fix_paths": [
        "docs/node-maintenance-operator.md",
        "docs/node-maintenance.md",
        "node/caller.yml",
        "node/coordinated-caller.yml",
        "node/runtime/fleet.py",
        "node/runtime/templates/dependency_audit.py",
        "node/tests/test_dependency_audit_publisher.py",
        "node/tests/test_fleet_setup.py",
        "node/tests/test_integration_contract.py"
      ],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:41dd744f32c6c6c49a63c68fa7481ea3d4f57793b03381c3da49ff5de0a84081",
      "finding_ids": [
        4400649408,
        4400649418
      ],
      "invariants": [
        "Supported caller and fleet permission contracts must match the reusable publisher evidence-read requirements.",
        "Provider metadata binds the triggering revision while sealed checkout and dependency state bind the planned audit revision."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "docs/node-maintenance-operator.md",
        "docs/node-maintenance.md",
        "node/caller.yml",
        "node/coordinated-caller.yml",
        "node/runtime/fleet.py",
        "node/runtime/templates/dependency_audit.py",
        "node/tests/test_dependency_audit_publisher.py",
        "node/tests/test_fleet_setup.py",
        "node/tests/test_integration_contract.py"
      ],
      "resulting_head": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "review_observation_id": null,
      "review_request_id": 6469157569,
      "review_result_id": 5682718250,
      "reviewed_head": "250c1f224a4da5e1a65d0a61dae0e80aa1e5ef7e",
      "root_cause": "New publisher permissions were not propagated through the supported caller chain; provenance verification conflated two distinct existing source revisions. Both corrected using existing fields and caller contracts.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        4400649408,
        4400649418,
        "ci-job:122834755616"
      ],
      "effective_diff_digest": "sha256:41dd744f32c6c6c49a63c68fa7481ea3d4f57793b03381c3da49ff5de0a84081",
      "finding_ids": [],
      "invariants": [
        "Supported caller permission contracts match the publisher evidence-read requirements.",
        "Native provider triggering revision and planned audit checkout are independently bound.",
        "Every selected exact-head CI job and complete local validation must pass before approval."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "review_observation_id": null,
      "review_request_id": 6470052059,
      "review_result_id": 6470124981,
      "reviewed_head": "e366188340ea599c61bf78207af7a3af12b5de8a",
      "root_cause": "Follow-up review is clean after the two source defects were corrected in round1. One external official release-index read timeout recovered through exactly one failed-job rerun, with no source edit or bypass.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:06200982726c83e12386a9733ba33bc04172905f067c5b794844882fbcbf73e4",
      "finding_ids": [],
      "invariants": [
        "Normal audits preserve retained exact direct pins.",
        "Prepared validation fails closed on unavailable audits while ordinary project-check semantics remain unchanged.",
        "Immutable original evidence, native job/Check/artifact bindings and exact Node/candidate transfer remain intact.",
        "Fresh independent review, all eight exact-head CI checks and complete current local validation pass before approval."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
      "review_observation_id": null,
      "review_request_id": 6473906241,
      "review_result_id": 6474021459,
      "reviewed_head": "b62701e7dc3ce24a283d10060ac07aba4d2b3d3b",
      "root_cause": "The earlier hosted pin mismatch and prepared-audit failure handling were corrected and independently verified before this round. Current attributable regular review is clean; no fixes, rejection dispositions or additional synchronization were needed in this round.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 28, 2026 12:33
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-28T16:03:15.867626Z b62701e Manual request
🔒 Security Review ✅ Completed 2026-10-28T12:38:19.853236Z 250c1f2 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 250c1f2

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 28, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 250c1f224a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/node-publish.yml
Comment thread node/runtime/templates/dependency_audit.py Outdated
@omry

omry commented Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: e366188

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: e366188340

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 28, 2026
@omry
[node-maintenance-repair/8.1.1] Prepare and seal initial normal-audit…
b62701e 
… evidence on a script-free producer with complete policy enrollment and exact preserved-code reuse

Prepare normal Node audit evidence on a fresh runner and seal it before project scripts run. Validate the exact prepared dependency and Node declaration files on a separate runner, with the producer's concrete Node and package-manager versions.

Keep original advisory evidence in the existing report artifact. Bind it to the trusted producer's native job Check notice and immutable artifact ID/digests, verify those bindings before publication, and retain exact locators in commit metadata. Preserve the existing renderer and reject missing, ambiguous, expired or mismatched evidence.

Cumulative repair consumption, repaired-candidate publication and installation rollout remain later slices. The isolated demo must prove distinct-run readback and sibling-job forgery rejection before dependent work starts.

Validation: 1,505 Python tests, Ruff lint/format and Pyrefly pass. Complete authored production growth is 594 lines against the 600-line boundary. Hosted provider acceptance is recorded separately.
@omry omry removed the approved label Oct 28, 2026
@omry

omry commented Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: b62701e

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: b62701e7dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry