release: verify sealed SBOM evidence before attestation - #54
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
I will treat queued CI and the open dependency on
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
I will verify the evidence contract, symlink boundaries, manifest determinism, credential-free scope, documentation, and the Ruff correction. I will treat in-progress CI/SAST and the open dependency on PR
|
|
@coderabbitai review Please perform a full review of exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Checkout identity =='
git rev-parse HEAD
git status --short
git diff --name-status 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..HEAD
echo '== Verifier outline =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
echo '== Test outlines =='
ast-grep outline tests/test_sealed_release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_symlink_boundary.py --items all --view expanded
echo '== Workflow changes in PR range =='
git diff --name-only 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..HEAD -- .github
echo '== GitHub PR and checks =='
gh pr view 54 --repo ContextualWisdomLab/EgressWeave \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,urlLength of output: 15466 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== release_evidence.py =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,430p'
echo '== Evidence contract tests, part 1 =='
nl -ba tests/test_sealed_release_evidence.py | sed -n '1,245p'
echo '== Evidence contract tests, part 2 =='
nl -ba tests/test_sealed_release_evidence.py | sed -n '246,450p'
echo '== Symlink regression =='
nl -ba tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Operator document =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,500p'
echo '== Changelog change =='
git diff --unified=80 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..HEAD -- CHANGELOG.md
echo '== Current exact-head check states =='
gh pr view 54 --repo ContextualWisdomLab/EgressWeave \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid, isDraft, mergeStateStatus, checks: [.statusCheckRollup[] | select(.status != "COMPLETED" or (.conclusion != "SUCCESS" and .conclusion != "SKIPPED")) | {name,workflowName,status,conclusion,detailsUrl}]}'Length of output: 1406 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered() {
awk '{ printf "%6d\t%s\n", NR, $0 }' "$1"
}
echo '== release_evidence.py =='
numbered src/egressweave/release_evidence.py
echo '== Evidence contract tests =='
numbered tests/test_sealed_release_evidence.py
echo '== Symlink regression =='
numbered tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Operator document =='
numbered docs/sealed-release-evidence.md
echo '== Changelog change =='
git diff --unified=80 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..HEAD -- CHANGELOG.md
echo '== Current exact-head non-success checks =='
gh pr view 54 --repo ContextualWisdomLab/EgressWeave \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid, isDraft, mergeStateStatus, checks: [.statusCheckRollup[] | select(.status != "COMPLETED" or (.conclusion != "SUCCESS" and .conclusion != "SKIPPED")) | {name,workflowName,status,conclusion,detailsUrl}]}'Length of output: 53843
I found no actionable code or documentation defect. The changed-path scope matches the stated five files. No GitHub Actions workflow changed. The verifier enforces the requested evidence boundary. It rejects unsafe directories and entries. It requires the exact five-file set. It bounds distribution, SBOM, and checksum sizes. It enforces canonical The test suite statically covers the public and CLI paths, deterministic manifest output, cardinality, checksum ambiguity, JSON ambiguity, SBOM identity and artifact bindings, and the public evidence-directory symlink boundary. The operator document accurately describes the credential-free scope, required later credentialed checks, explicit non-claims, bounds, and references. The changelog entry matches the implementation. The current GitHub status prevents approval. The Python 3.10–3.13 matrix, package build, Semgrep, and Security Scan checks succeeded on this exact head. However, No approval is appropriate until
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='e637b3c147ffbbd27a8757ee3118f3b47d7acc96'
repo='ContextualWisdomLab/EgressWeave'
echo '== Local identity and PR scope =='
printf 'HEAD: '; git rev-parse HEAD
git status --short
git diff --name-status "${base}..${head}"
echo '-- workflow paths changed --'
git diff --name-only "${base}..${head}" -- .github
echo '== GitHub PR identity and checks =='
gh pr view 54 --repo "${repo}" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
echo '== Production module structure =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
echo '== Production module: bounded reads, descriptor identity, parsing, validation, manifest =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,520p'
echo '== Evidence contract regression tests =='
ast-grep outline tests/test_sealed_release_evidence.py --items all --view expanded
nl -ba tests/test_sealed_release_evidence.py | sed -n '1,520p'
echo '== Snapshot and symlink boundary regression tests =='
nl -ba tests/test_sealed_release_evidence_snapshot_boundary.py
nl -ba tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Operator documentation =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,520p'
echo '== Changelog diff at requested head =='
git diff --unified=100 "${base}..${head}" -- CHANGELOG.mdLength of output: 11443 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== release_evidence.py =='
numbered src/egressweave/release_evidence.py
echo '== test_sealed_release_evidence.py =='
numbered tests/test_sealed_release_evidence.py
echo '== test_sealed_release_evidence_snapshot_boundary.py =='
numbered tests/test_sealed_release_evidence_snapshot_boundary.py
echo '== test_sealed_release_evidence_symlink_boundary.py =='
numbered tests/test_sealed_release_evidence_symlink_boundary.py
echo '== docs/sealed-release-evidence.md =='
numbered docs/sealed-release-evidence.md
echo '== CHANGELOG.md range diff =='
git diff --unified=100 \
7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..e637b3c147ffbbd27a8757ee3118f3b47d7acc96 \
-- CHANGELOG.md
echo '== Completed CI log: tests, package acceptance, coverage =='
gh run view 31015751478 --repo ContextualWisdomLab/EgressWeave --log 2>&1 \
| grep -Ei -C 2 '681 passed|passed.*test|coverage|TOTAL|100%|wheel|sdist|Ruff|compileall' \
|| true
echo '== Completed required-review log: coverage evidence =='
gh run view 31015741601 --repo ContextualWisdomLab/EgressWeave --log 2>&1 \
| grep -Ei -C 2 'coverage|1496|516|100%|release.evidence' \
|| trueLength of output: 210041
I found no actionable implementation or documentation defect. The changed range contains exactly the six stated paths. It contains no
The verifier binds each hash read to a current regular-file descriptor. It compares device and inode identity. It brackets checksum and SBOM byte snapshots with bounded pre-read and post-read digests. It rehashes the four distribution and SBOM payloads after semantic verification. The checksum parser enforces ASCII, LF termination, canonical syntax, filename ordering, uniqueness, completeness, and exact digest parity. The SBOM parser rejects duplicate JSON names and non-finite numeric tokens. The verifier enforces the exact CycloneDX 1.7 envelope. It independently recomputes the canonical UUIDv5 identity. It verifies the paired artifact filename, SHA-256, PyPI purl, and The regression tests cover public evidence-directory symlinks, descriptor metadata failures, stale pre-read and post-read digests, and mutation after initial digest capture. The manifest is deterministic and binds the fixed repository and a lowercase 40-character source SHA. The operator document states the credential-free trust boundary and explicit non-claims. It includes finite limits, operator procedure, and APA-style primary-source references. Exact-head CI evidence shows:
At inspection time, the separate
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='e637b3c147ffbbd27a8757ee3118f3b47d7acc96'
repo='ContextualWisdomLab/EgressWeave'
echo '== Checkout identity and scope =='
git rev-parse HEAD
git status --short
git diff --name-status "$base..$head"
echo
echo '== Verifier structure =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
echo
echo '== Regression-test structure =='
ast-grep outline tests/test_sealed_release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_snapshot_boundary.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_symlink_boundary.py --items all --view expanded
echo
echo '== Workflow changes in exact range =='
git diff --name-only "$base..$head" -- .github
echo
echo '== Exact-head PR metadata and checks =='
gh pr view 54 --repo "$repo" --json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url
echo
echo '== Check runs associated with requested head =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo
echo '== RED commit and test-only scope =='
git show --no-patch --format='commit=%H%nauthor=%an%ndate=%cI%nsubject=%s' adedffe3ff6195dfdc9db2601218a65a30bf4a87
git diff-tree --no-commit-id --name-status -r adedffe3ff6195dfdc9db2601218a65a30bf4a87Length of output: 21598 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Verifier implementation =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,460p'
echo
echo '== Primary evidence-contract tests =='
nl -ba tests/test_sealed_release_evidence.py | sed -n '1,470p'
echo
echo '== Snapshot-boundary regressions =='
nl -ba tests/test_sealed_release_evidence_snapshot_boundary.py | sed -n '1,260p'
echo
echo '== Symlink-boundary regression =='
nl -ba tests/test_sealed_release_evidence_symlink_boundary.py | sed -n '1,180p'
echo
echo '== Operator guidance and changelog diff =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,520p'
git diff --unified=80 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..e637b3c147ffbbd27a8757ee3118f3b47d7acc96 -- CHANGELOG.md
echo
echo '== RED commit test diff =='
git diff --unified=100 adedffe3ff6195dfdc9db2601218a65a30bf4a87^ adedffe3ff6195dfdc9db2601218a65a30bf4a87 -- tests/test_sealed_release_evidence_snapshot_boundary.py
echo
echo '== RED commit check runs =='
gh api 'repos/ContextualWisdomLab/EgressWeave/commits/adedffe3ff6195dfdc9db2601218a65a30bf4a87/check-runs?per_page=100' \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'Length of output: 1556 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Verifier implementation =='
numbered src/egressweave/release_evidence.py
echo
echo '== Primary evidence-contract tests =='
numbered tests/test_sealed_release_evidence.py
echo
echo '== Snapshot-boundary regressions =='
numbered tests/test_sealed_release_evidence_snapshot_boundary.py
echo
echo '== Symlink-boundary regression =='
numbered tests/test_sealed_release_evidence_symlink_boundary.py
echo
echo '== Operator guidance =='
numbered docs/sealed-release-evidence.md
echo
echo '== Changelog diff =='
git diff --unified=80 7c4792c06261bafddcfb1e083cb0f1f606f9d6a5..e637b3c147ffbbd27a8757ee3118f3b47d7acc96 -- CHANGELOG.md
echo
echo '== RED commit test diff =='
git diff --unified=100 adedffe3ff6195dfdc9db2601218a65a30bf4a87^ adedffe3ff6195dfdc9db2601218a65a30bf4a87 -- tests/test_sealed_release_evidence_snapshot_boundary.py
echo
echo '== RED commit check runs =='
gh api 'repos/ContextualWisdomLab/EgressWeave/commits/adedffe3ff6195dfdc9db2601218a65a30bf4a87/check-runs?per_page=100' \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'Length of output: 78520 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/EgressWeave'
head='e637b3c147ffbbd27a8757ee3118f3b47d7acc96'
echo '== Current exact-head check state =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix" or .name == "test (3.13)" or .name == "coverage-evidence" or .name == "Build and verify wheel and sdist" or .name == "Semgrep (multi-language SAST)" or .name == "osv-scan" or .name == "trivy-fs") | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo
echo '== Python 3.13 job evidence =='
gh run view 31015751478 --repo "$repo" --job 92339228122 --log 2>&1 \
| grep -E -i '([0-9]+ passed|[0-9]+ tests? passed|coverage|TOTAL|fail|error)' \
| tail -n 80 || true
echo
echo '== Coverage evidence job =='
gh run view 31015741601 --repo "$repo" --job 92339285274 --log 2>&1 \
| grep -E -i '(1496|516|100%|coverage|branch|statement|miss|partial|pass|fail|error)' \
| tail -n 120 || true
echo
echo '== Package, SAST, and Security job conclusions =='
gh run view 31015751478 --repo "$repo" --json conclusion,jobs \
--jq '.jobs[] | select(.databaseId == 92339228096) | [.name, .conclusion] | `@tsv`'
gh run view 31015749176 --repo "$repo" --json conclusion,jobs \
--jq '.jobs[] | select(.databaseId == 92339220526) | [.name, .conclusion] | `@tsv`'
gh run view 31015747347 --repo "$repo" --json conclusion,jobs \
--jq '.jobs[] | select(.databaseId == 92339215053 or .databaseId == 92339215088) | [.name, .conclusion] | `@tsv`'Length of output: 12003
I found no actionable code or documentation defect. The diff contains the stated six files. No GitHub Actions workflow changed. The verifier enforces the requested boundary:
The snapshot-boundary regression commit The exact-head Python 3.13 job passed An exact-head success verdict is not yet available. The You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='b2f797436cab8ccd1dfdf0cde5e3c3398cdfd763'
red='06f086696002a4c52d7451014edd4976efadd9ae'
repo='ContextualWisdomLab/EgressWeave'
echo '== Checkout and requested-head identity =='
printf 'checkout='; git rev-parse HEAD
git status --short
git cat-file -e "${head}^{commit}"
git show --no-patch --format='head=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$head"
echo '== Exact changed-path scope =='
git diff --name-status "${base}..${head}"
echo '-- workflow changes --'
git diff --name-only "${base}..${head}" -- .github
echo '== Changed-file outlines =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_snapshot_boundary.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_symlink_boundary.py --items all --view expanded
echo '== Resource-limit symbols and use sites =='
rg -n -C 5 -P 'read|chunk|limit|RecursionError|JSONDecodeError|OSError|SHA256SUMS|digest|snapshot|descriptor|st_size' \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Exact source module =='
nl -ba src/egressweave/release_evidence.py
echo '== Exact resource-limit test changes =='
git diff --unified=100 "${red}^..${head}" -- \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py \
src/egressweave/release_evidence.py
echo '== RED commit scope and checks =='
git show --no-patch --format='red=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$red"
git diff-tree --no-commit-id --name-status -r "$red"
gh api "repos/$repo/commits/$red/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo '== Exact-head PR and check state =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'Length of output: 63592 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b2f797436cab8ccd1dfdf0cde5e3c3398cdfd763'
red='06f086696002a4c52d7451014edd4976efadd9ae'
repo='ContextualWisdomLab/EgressWeave'
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Complete production module =='
numbered src/egressweave/release_evidence.py
echo '== New resource-limit regressions =='
numbered tests/test_sealed_release_evidence_resource_limits.py
echo '== Exact implementation and regression diff after RED =='
git diff --unified=120 "${red}^..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_resource_limits.py \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py
echo '== RED test-only commit patch and associated checks =='
git show --format=fuller --stat --find-renames "$red"
gh api "repos/$repo/commits/$red/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url:.details_url}'
echo '== Requested exact-head PR identity and complete check state =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url:.details_url}'
echo '== Exact-head workflow runs and selected test/coverage log evidence =='
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,name,status,conclusion,workflowName,url \
--jq '.[] | {databaseId,name,workflowName,status,conclusion,url}'Length of output: 82764
I found no actionable implementation or documentation defect. The exact range changes seven paths. It includes the new resource-limit regression file. It changes no The resource-limit hardening is correct.
The prior sealed-evidence controls remain present. These controls include exact five-file cardinality, regular-file descriptor and path identity, canonical checksums, strict RFC 8259 parsing, CycloneDX 1.7 envelope checks, recomputed UUIDv5 identity, root-artifact bindings, and deterministic repository/source-bound manifest output. The RED commit The exact-head Python 3.10–3.13 matrix, package acceptance, Semgrep, Security Scan, coverage checks, and CodeQL checks are successful. An all-gates-passed verdict is not available yet. The exact-head PR You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='975a16665236acb1d5583ff84ce36807cc24c1af'
red='c9bd8811f5c80288a802068c6d676fec6e5bcb37'
repo='ContextualWisdomLab/EgressWeave'
echo '== Exact checkout and scope =='
printf 'checkout='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='head=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$head"
git diff --name-status "${base}..${head}"
echo '-- .github changes --'
git diff --name-only "${base}..${head}" -- .github
echo '== Verifier and regression-test outlines =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_checksum_snapshot.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_resource_limits.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_snapshot_boundary.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_symlink_boundary.py --items all --view expanded
echo '== Final checksum-lifetime implementation and tests =='
rg -n -C 8 -P 'SHA256SUMS|checksum.*(?:digest|snapshot)|(?:digest|snapshot).*checksum|final.*(?:hash|digest)|rehash|manifest|_read|_digest|RecursionError|uuid5|bom-ref|purl' \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_resource_limits.py
echo '== Production source =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,560p'
echo '== Final-lifetime regression file =='
nl -ba tests/test_sealed_release_evidence_checksum_snapshot.py
echo '== Delta since final RED commit =='
git diff --unified=100 "${red}^..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py \
docs/sealed-release-evidence.md \
CHANGELOG.md
echo '== API and operator documentation =='
rg -n -C 4 -P 'release_evidence|verify|sealed|SHA256SUMS|credential|APA|References|UUID|manifest' \
src/egressweave docs/sealed-release-evidence.md
nl -ba docs/sealed-release-evidence.md | sed -n '1,520p'
echo '== Requested-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo '== PR metadata and status rollup =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'Length of output: 83285 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='975a16665236acb1d5583ff84ce36807cc24c1af'
red='c9bd8811f5c80288a802068c6d676fec6e5bcb37'
repo='ContextualWisdomLab/EgressWeave'
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Evidence selection and descriptor binding =='
sed -n '64,225p' src/egressweave/release_evidence.py
echo '== Final lifetime regression =='
numbered tests/test_sealed_release_evidence_checksum_snapshot.py
echo '== Relevant final implementation diff =='
git diff --unified=100 "${red}^..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py
echo '== Documentation =='
numbered docs/sealed-release-evidence.md
echo '== Changelog diff =='
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Public package exports and package metadata references =='
rg -n -C 3 -P 'release_evidence|build_evidence_manifest|write_evidence_manifest|python -m egressweave\.release_evidence' \
src README.md pyproject.toml 2>/dev/null || true
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo '== PR status rollup =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
echo '== Requested RED commit metadata and check results =='
git show --no-patch --format='red=%H%nparents=%P%nsubject=%s' "$red"
gh api "repos/$repo/commits/$red/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null")] | `@tsv`'Length of output: 71906
I found no actionable implementation or documentation defect. The exact range changes eight files. It changes no The final lifetime fix is correct.
The existing controls remain present:
The operator document accurately states the credential-free boundary, complete five-file lifetime boundary, operator procedure, explicit non-claims, and APA-style references. The The exact-head Python 3.10–3.13 jobs, package acceptance, Semgrep, Security Scan, coverage checks, and CodeQL checks succeeded. The all-gates-passed verdict remains incomplete. The exact-head You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='4b2f5b896d215f5f26849a586a176a6c52d220fd'
red='471c225c71f6b61bd1c17d484fbaf0c7b02bc98b'
repo='ContextualWisdomLab/EgressWeave'
echo '== Exact commit identity and changed scope =='
printf 'checkout='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='head=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$head"
git diff --name-status "${base}..${head}"
echo '-- .github paths in range --'
git diff --name-only "${base}..${head}" -- .github
echo '== Module and regression-test structure =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_checksum_snapshot.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_resource_limits.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_snapshot_boundary.py --items all --view expanded
ast-grep outline tests/test_sealed_release_evidence_symlink_boundary.py --items all --view expanded
fd -t f 'sealed.*evidence|release.*evidence' tests docs src
echo '== Output boundary, input snapshots, and manifest implementation =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,620p'
echo '== Final-output RED delta and current regression tests =='
git show --format=fuller --stat "$red"
git diff --unified=120 "${red}^..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py \
tests/test_sealed_release_evidence_resource_limits.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Relevant test files =='
for file in \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py \
tests/test_sealed_release_evidence_resource_limits.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py
do
if [ -f "$file" ]; then
echo "-- $file --"
nl -ba "$file"
fi
done
echo '== Documentation and changelog =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,560p'
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Exact-head PR metadata and checks =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo '== Requested RED commit checks =='
gh api "repos/$repo/commits/$red/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null")] | `@tsv`'Length of output: 8782 🏁 Script executed: #!/bin/bash
set -u
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='4b2f5b896d215f5f26849a586a176a6c52d220fd'
red='471c225c71f6b61bd1c17d484fbaf0c7b02bc98b'
repo='ContextualWisdomLab/EgressWeave'
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Exact module =='
numbered src/egressweave/release_evidence.py
echo '== Output-boundary regression =='
numbered tests/test_sealed_release_evidence_output_boundary.py
echo '== Remaining verifier regression tests =='
for file in \
tests/test_sealed_release_evidence.py \
tests/test_sealed_release_evidence_checksum_snapshot.py \
tests/test_sealed_release_evidence_resource_limits.py \
tests/test_sealed_release_evidence_snapshot_boundary.py \
tests/test_sealed_release_evidence_symlink_boundary.py
do
echo "-- $file --"
numbered "$file"
done
echo '== Delta from the final-output RED commit =='
git diff --unified=100 "${red}^..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_output_boundary.py \
docs/sealed-release-evidence.md \
CHANGELOG.md
echo '== Documentation =='
numbered docs/sealed-release-evidence.md
echo '== Changelog change =='
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Exact-head checks =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo '== Final-output RED checks =='
gh api "repos/$repo/commits/$red/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.html_url] | `@tsv`'Length of output: 119667
I found no actionable implementation or documentation defect. The final-path fix is correct. The output writer also:
The sealed-evidence verifier retains the required controls. It enforces the exact five-file set, bounded descriptor reads, stable checksum and SBOM snapshots, final distribution/SBOM rehashing, final The documentation describes the credential-free boundary, operator procedure, output boundary, failure behavior, and APA-style references. The changed range contains no I cannot give an all-gates-passed verdict for this commit. Its Python 3.10–3.13 jobs, package check, Semgrep, and listed Security Scan component checks succeeded. However, the commit-level Also, PR You are interacting with an AI system. |
|
Exact-head review requested for Please ignore predecessor-head conclusions and review the current nine-file diff, with particular attention to the exclusive owner-only manifest output, strict JSON detachment, final-path no-follow behavior, durable synchronization, descriptor/path rebinding, and CLI handling of dangling output symlinks. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='b17e8a044704bb98b59970510492c4915d374f5a'
repo='ContextualWisdomLab/EgressWeave'
echo '== Exact checkout and commit identity =='
printf 'checkout='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='head=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$head"
echo '== Exact changed-path scope =='
git diff --name-status "${base}..${head}"
echo '== Workflow paths in exact range =='
git diff --name-only "${base}..${head}" -- .github
echo '== Changed source and test structure =='
ast-grep outline src/egressweave/release_evidence.py --items all --view expanded
fd -t f '^test_sealed_release_evidence.*\.py$' tests -x ast-grep outline {} --items all --view expanded
echo '== Output writer and CLI implementation =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,680p'
echo '== Output-boundary regression tests =='
nl -ba tests/test_sealed_release_evidence_output_boundary.py
echo '== All sealed-evidence test files =='
for file in $(fd -t f '^test_sealed_release_evidence.*\.py$' tests | sort); do
echo "== ${file} =="
nl -ba "$file"
done
echo '== Exact diff for output writer, CLI, and output tests =='
git diff --unified=120 "${base}..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_output_boundary.py \
tests/test_sealed_release_evidence.py
echo '== Documentation and changelog =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,560p'
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo '== PR metadata =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'Length of output: 10293 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='b17e8a044704bb98b59970510492c4915d374f5a'
repo='ContextualWisdomLab/EgressWeave'
numbered_range() {
awk -v start="$2" -v end="$3" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$1"
}
numbered_all() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Manifest output and CLI implementation =='
numbered_range src/egressweave/release_evidence.py 430 560
echo '== Input boundary implementation used before output =='
numbered_range src/egressweave/release_evidence.py 55 430
echo '== Output-boundary tests =='
numbered_all tests/test_sealed_release_evidence_output_boundary.py
echo '== Output-related test call sites =='
rg -n -C 5 -P '\b(write_evidence_manifest|_encode_evidence_manifest|_open_exclusive_manifest|main)\s*\(' \
tests src/egressweave/release_evidence.py
echo '== Exact output implementation and test diff =='
git diff --unified=100 "${base}..${head}" -- \
src/egressweave/release_evidence.py \
tests/test_sealed_release_evidence_output_boundary.py
echo '== Operator output guidance and changelog =='
rg -n -i -C 5 'manifest|output|symlink|no-follow|fsync|descriptor|credential|reference' \
docs/sealed-release-evidence.md CHANGELOG.md
numbered_all docs/sealed-release-evidence.md
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,name,workflowName,status,conclusion,url \
--jq '.[] | [.databaseId,.workflowName,.name,.status,(.conclusion // "null"),.url] | `@tsv`'Length of output: 111951 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/EgressWeave'
head='b17e8a044704bb98b59970510492c4915d374f5a'
echo '== PR exact-head status and required checks =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
echo '== Python 3.13 test and package evidence =='
gh run view 31030533311 --repo "$repo" --log 2>&1 \
| grep -Ei -C 2 '697 passed|[0-9]+ passed|TOTAL|coverage|1543|526|100%|wheel|sdist|compileall|ruff|error|failed' \
| tail -n 240 || true
echo '== Dedicated coverage evidence =='
gh run view 31030531622 --repo "$repo" --job 92389891259 --log 2>&1 \
| grep -Ei -C 2 '1543|526|100%|TOTAL|coverage|branch|statement|miss|partial|error|failed' \
| tail -n 180 || true
echo '== Failed non-PR workflow metadata =='
gh run view 31030529434 --repo "$repo" \
--json workflowName,event,headSha,conclusion,createdAt,url \
--jq '{workflowName,event,headSha,conclusion,createdAt,url}'
echo '== Current Strix check =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {name,status,conclusion,started_at,completed_at,html_url}'Length of output: 41781
I found no actionable code or documentation defect. The diff contains the expected nine paths. It contains no The manifest output boundary is implemented correctly.
The prior sealed-evidence boundary also remains intact. It enforces exact five-file cardinality, regular-file descriptor/path identity, bounded reads, stable checksum and SBOM snapshots, final payload and checksum rehashing, strict RFC 8259 parsing, CycloneDX 1.7 validation, recomputed UUIDv5 identity, exact root-artifact bindings, and deterministic repository/source-bound manifest data. Exact-head CI evidence shows:
An all-gates-successful verdict is not available yet. The exact-head You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='b17e8a044704bb98b59970510492c4915d374f5a'
repo='ContextualWisdomLab/EgressWeave'
echo '== Exact commit identity =='
printf 'checkout='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show --no-patch --format='commit=%H%nparents=%P%nsubject=%s%ncommitted=%cI' "$head"
echo '== Full changed-path set =='
git diff --name-status "${base}..${head}"
echo '== Workflow paths in range =='
git diff --name-only "${base}..${head}" -- .github
echo '== Changed-file structure =='
git diff --name-only "${base}..${head}" | while IFS= read -r path; do
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
esac
done
echo '== Verifier: input boundary, semantic verification, and output boundary =='
nl -ba src/egressweave/release_evidence.py | sed -n '1,620p'
echo '== Sealed-evidence tests =='
for file in $(fd -t f '^test_sealed_release_evidence.*\.py$' tests | sort); do
echo "== $file =="
nl -ba "$file"
done
echo '== Exact implementation and test diff =='
git diff --unified=100 "${base}..${head}" -- \
src/egressweave/release_evidence.py tests
echo '== Operator guidance and changelog =='
nl -ba docs/sealed-release-evidence.md | sed -n '1,560p'
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo '== PR metadata and status rollup =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'Length of output: 10098 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7c4792c06261bafddcfb1e083cb0f1f606f9d6a5'
head='b17e8a044704bb98b59970510492c4915d374f5a'
repo='ContextualWisdomLab/EgressWeave'
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '== Input selection, descriptor reads, checksums, and strict JSON =='
awk 'NR >= 55 && NR <= 296 { printf "%6d %s\n", NR, $0 }' \
src/egressweave/release_evidence.py
echo '== SBOM validation, lifetime rehashes, manifest construction =='
awk 'NR >= 297 && NR <= 446 { printf "%6d %s\n", NR, $0 }' \
src/egressweave/release_evidence.py
echo '== Manifest encoding, exclusive output, synchronization, CLI =='
awk 'NR >= 447 && NR <= 560 { printf "%6d %s\n", NR, $0 }' \
src/egressweave/release_evidence.py
echo '== Output-boundary regressions =='
numbered tests/test_sealed_release_evidence_output_boundary.py
echo '== Checksum lifetime and resource-limit regressions =='
numbered tests/test_sealed_release_evidence_checksum_snapshot.py
numbered tests/test_sealed_release_evidence_resource_limits.py
echo '== Snapshot and symlink boundary regressions =='
numbered tests/test_sealed_release_evidence_snapshot_boundary.py
numbered tests/test_sealed_release_evidence_symlink_boundary.py
echo '== Core contract test sections =='
awk 'NR >= 120 && NR <= 430 { printf "%6d %s\n", NR, $0 }' \
tests/test_sealed_release_evidence.py
echo '== Documentation =='
numbered docs/sealed-release-evidence.md
echo '== Changelog delta =='
git diff --unified=100 "${base}..${head}" -- CHANGELOG.md
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`'
echo '== PR approval and merge state =='
gh pr view 54 --repo "$repo" \
--json headRefOid,isDraft,mergeStateStatus,reviewDecision,reviews,url \
--jq '{url,headRefOid,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'Length of output: 90815
I found no actionable code or documentation defect. The exact range contains nine changed paths. It contains no The verifier enforces the requested input boundary:
The manifest-output boundary is also correct:
The regression tests cover overwrite refusal, symlink refusal, non-strict manifest values, private output mode, synchronization failure, final-path replacement, CLI dangling-symlink handling, bounded snapshot reads, deep JSON nesting, checksum mutation, payload mutation, and evidence-directory symlinks. The operator document states the credential separation, failure procedure, output behavior, finite limits, and APA-style references. The public docstrings are clear and specific. The exact-head check runs are complete and successful. This includes Python 3.10–3.13, package verification, Semgrep, Security Scan components, CodeQL, and I do not approve this PR. PR You are interacting with an AI system. |
1 participant
Summary
SHA256SUMS;SHA256SUMSsnapshot through final manifest issuance so mutation of any accepted file fails closed;CHANGELOG.md.Exact-head scope
7c4792c06261bafddcfb1e083cb0f1f606f9d6a5.b235fac34b75964d63250ed31d65db95f0eb1960.b17e8a044704bb98b59970510492c4915d374f5a.The branch is now diverged from protected
mainby one integrated commit and remains draft. It is 29 commits ahead and one commit behind. No auditable credential-separated exact-tree integration mechanism is currently available in this repository context, so the branch has not been rebased, merged, force-updated, or retargeted.Changed paths are limited to
CHANGELOG.md, operator documentation, the credential-free verifier, and its tests. No GitHub Actions workflow, release permission, token contract, signing identity, publication job, tag behavior, or protected branch is modified. Distributions and SBOMs remain inert data.Test-first evidence
Initial exact test-only head
50e0351f4a3f0890b47c6396d1b78f5f08b02c69produced 32 failures before implementation. Subsequent RED exact heads independently demonstrated path replacement, mutation, bounded-read, parser-recursion, checksum-lifetime, and handoff-output gaps before each fix was added. The final output-boundary RED heada28cfcd82c34a8c28a1d334d0d172e804a846637produced seven failures before exclusive private output, strict detached encoding, durable synchronization, and descriptor/path rebinding were implemented.Exact-head verification
Exact head
b17e8a044704bb98b59970510492c4915d374f5apassed:Every counted run checked out exact head
b17e8a044704bb98b59970510492c4915d374f5awith persisted credentials disabled and read-only repository permissions. Predecessor, queued, cancelled, stale, skipped-required, or wrapper-only results are not counted. Exact-head automated review reported no actionable code or documentation defect. There are no submitted reviews or unresolved inline review threads.Trust boundary
This slice prepares evidence only. It does not sign, publish, create or move tags, claim provenance, or grant a pull-request-controlled tree access to
id-token: write,attestations: write, package publication, release, or repository-write credentials.Protected SBOM attestation and publication integration remains tracked in
ContextualWisdomLab/.github#783; repository-level completion remains tracked in #46. A future credentialed job must consume only a sealed copy, independently recheck identity, cardinality, and digests, and never rebuild or execute caller-controlled source under a write identity.Remaining gates
Before integration or merge, require:
mainwithout publishing it first;Progresses #46.