release: prepare sealed six-file evidence set - #64
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@opencode-agent Apply the bounded documentation/changelog completion to exact current head Current exact-head implementation and tests already exist in:
Modify only:
Required changes:
Do not modify |
|
@opencode-agent Supersede the earlier docs-only request and apply this bounded test-first hardening to exact current head A valid resource-bound gap remains: Use an immutable RED commit first, then GREEN:
Modify only:
Do not modify |
|
@coderabbitai review Review only exact current stacked head |
|
I will not approve, merge, rebase, retarget, publish, or release. I will treat the successful CI result as separate from the required stacked-base security scans and independent approval.
|
|
@coderabbitai review Review only exact current stacked head |
|
I will focus on the specified archive preflight, identity binding, deterministic and owner-only outputs, reconstruction, documentation boundaries, and prohibited behavior. I will not approve, merge, publish, release, rebase, or retarget.
|
|
@coderabbitai review Perform a complete static review of exact current head Focus on the credential-free release-evidence boundary: exactly one canonical wheel and one matching source distribution; rejection of stale, extra, nested, symlinked, non-regular, malformed, mismatched, or oversized inputs before generator loading and archive parsing; deterministic CycloneDX 1.7 SBOMs; canonical source identity and filename-sorted checksums; exclusive owner-only outputs and separately stored handoff; post-publication independent reconstruction; exact repository/source binding; and preservation of existing member, metadata, digest, path, and mutable-storage defenses. Confirm there is no network, credential, model, signing, attestation, publication, release, tag, ref, repository-write, OIDC, dependency, or workflow behavior, and that documentation, APA 7 references, and CHANGELOG claims match the implementation. Do not approve, merge, retarget, rebase, mark ready, publish, or infer success from CI alone. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='13cd59b5d0307f1a4dc1e4ffe777ed31b878c657'
head='421c0975cdabbc24cb4c42a9bb11e202cd33b0a4'
printf '%s\n' '== Exact commit verification =='
git rev-parse "${base}^{commit}"
git rev-parse "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head"
printf 'base_is_ancestor=true\n'
printf '%s\n' '== Changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Diff summary =='
git diff --stat "$base" "$head"
printf '%s\n' '== Implementation outline =='
ast-grep outline scripts/ci/prepare_release_evidence.py --items all || true
printf '%s\n' '== Test outline =='
ast-grep outline tests/test_prepare_release_evidence.py --items all || true
printf '%s\n' '== Security-relevant definitions and calls =='
rg -n -C 4 \
'^(def |class )|MAX_DISTRIBUTION_BYTES|_load_attestable_generator|stat\(|lstat\(|open\(|os\.open|chmod|mkdir|unlink|rmtree|replace|rename|sha256|tarfile|zipfile|json\.|subprocess|urlopen|requests|http|socket|oidc|credential|token|sign|attest|publish|release|git ' \
scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py || true
printf '%s\n' '== Exact range prohibited-behavior scan =='
git diff --unified=3 "$base" "$head" -- \
':!scripts/ci/prepare_release_evidence.py' ':!tests/test_prepare_release_evidence.py' \
| rg -n -i -C 2 'https?://|requests|urllib|socket|subprocess|os\.system|github|oidc|credential|token|secret|sign|attest|publish|release|git (tag|push|commit|checkout|reset)|workflow|\.github' || true
printf '%s\n' '== Full diff for reviewed files =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py \
tests/test_prepare_release_evidence.py \
docs/release-evidence-preparation.md \
docs/release.md \
CHANGELOG.mdLength of output: 100571 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Locate delegated implementation and tests =='
fd -a 'generate_attestable_release_sbom\.py|release_evidence\.py|test_release_sbom\.py|test_release_evidence.*\.py' . \
-E .git -E node_modules -E dist -E build
printf '%s\n' '== Delegated implementation outlines =='
ast-grep outline scripts/ci/generate_attestable_release_sbom.py --items all || true
ast-grep outline src/egressweave/release_evidence.py --items all || true
printf '%s\n' '== Generator archive and input handling =='
rg -n -C 8 \
'^(def |class )|build_attestable_sbom|ZipFile|TarFile|tarfile|zipfile|open\(|lstat\(|fstat\(|stat\(|resolve\(|sha256|MAX_|member|extract|subprocess|urlopen|requests|socket' \
scripts/ci/generate_attestable_release_sbom.py || true
printf '%s\n' '== Verifier creation, reconstruction, and mutable-storage handling =='
rg -n -C 10 \
'^(def |class )|build_evidence_manifest|write_evidence_manifest|_require_post_publication_state|open\(|os\.open|lstat\(|fstat\(|stat\(|fsync|chmod|O_NOFOLLOW|O_EXCL|resolve\(|is_relative_to|sha256|MAX_|ZipFile|TarFile|tarfile|zipfile|subprocess|urlopen|requests|socket' \
src/egressweave/release_evidence.py || true
printf '%s\n' '== Relevant existing test definitions =='
ast-grep outline tests/test_release_sbom.py --items all || true
fd -a -t f 'test*release*evidence*.py' tests -x sh -c \
'echo "== $1 =="; ast-grep outline "$1" --items all' sh {} \; || true
printf '%s\n' '== Entire requested range: imports and invoked external interfaces =='
git diff --unified=0 \
13cd59b5d0307f1a4dc1e4ffe777ed31b878c657 \
421c0975cdabbc24cb4c42a9bb11e202cd33b0a4 \
-- scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py \
| rg -n '^\+.*\b(import|from|subprocess|socket|requests|urllib|http|open|exec|eval|system|popen|run|check_call|check_output|git|token|credential|secret|oidc|sign|attest|publish|release)\b' || trueLength of output: 44676 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Locate foundation generator =='
fd -a '^generate_release_sbom\.py$' scripts
printf '%s\n' '== Foundation generator outline =='
ast-grep outline scripts/ci/generate_release_sbom.py --items all
printf '%s\n' '== Foundation generator: archive parsing and artifact digest code =='
rg -n -C 12 \
'^(def |class )|build_sbom|ZipFile|TarFile|tarfile|zipfile|artifact_path|open\(|lstat\(|fstat\(|stat\(|sha256|MAX_|metadata|extract|read\(' \
scripts/ci/generate_release_sbom.py
printf '%s\n' '== Exact source slices for the preparer boundary =='
nl -ba scripts/ci/prepare_release_evidence.py | sed -n '90,215p'
nl -ba scripts/ci/prepare_release_evidence.py | sed -n '258,360p'
printf '%s\n' '== Generator call chain around artifact handling =='
nl -ba scripts/ci/generate_attestable_release_sbom.py | sed -n '175,200p'
nl -ba scripts/ci/generate_release_sbom.py | sed -n '1,360p'
printf '%s\n' '== Existing tests for replacement, descriptor identity, and generator input size =='
rg -n -i -C 5 \
'replace|rename|symlink|descriptor|inode|fstat|lstat|mutable|concurrent|race|oversized|MAX_ARTIFACT_BYTES|preflight' \
tests scripts/ci/generate_release_sbom.py scripts/ci/prepare_release_evidence.pyLength of output: 25640
I found one issue.
The range adds no direct network, credential, OIDC, workflow, repository-write, ref/tag, signing, attestation, publication, or release behavior. The documentation and changelog accurately state the credential-free and non-provenance/SLSA boundaries. I did not approve the pull request. You are interacting with an AI system. |
|
@coderabbitai review Perform a complete static review of exact current stacked head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='13cd59b5d0307f1a4dc1e4ffe777ed31b878c657'
head='421c0975cdabbc24cb4c42a9bb11e202cd33b0a4'
printf '%s\n' '== Exact range =='
git rev-parse "${base}^{commit}"
git rev-parse "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== Full five-file diff =='
git diff --find-renames --find-copies --unified=100 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py \
tests/test_prepare_release_evidence.py \
docs/release-evidence-preparation.md \
docs/release.md \
CHANGELOG.md
printf '%s\n' '== Preparer outline and relevant source =='
ast-grep outline scripts/ci/prepare_release_evidence.py --items all
nl -ba scripts/ci/prepare_release_evidence.py | sed -n '1,430p'
printf '%s\n' '== Test outline and relevant source =='
ast-grep outline tests/test_prepare_release_evidence.py --items all
nl -ba tests/test_prepare_release_evidence.py | sed -n '1,520p'
printf '%s\n' '== Locate and map repository-local generator/verifier =='
fd -a -t f 'generate_attestable_release_sbom.py|generate_release_sbom.py|release_evidence.py' . \
-E .git -E node_modules -E dist -E build
ast-grep outline scripts/ci/generate_attestable_release_sbom.py --items all || true
ast-grep outline scripts/ci/generate_release_sbom.py --items all || true
ast-grep outline src/egressweave/release_evidence.py --items all || true
printf '%s\n' '== Generator and verifier security-critical call chains =='
rg -n -C 8 \
'^(def |class )|build_attestable_sbom|build_sbom|ZipFile|tarfile\.open|TarFile|lstat\(|fstat\(|stat\(|os\.open|O_NOFOLLOW|O_EXCL|open\(|sha256|MAX_|member|artifact|manifest|reconstruct|post_publication|chmod|unlink|rmtree|replace|rename' \
scripts/ci/generate_attestable_release_sbom.py \
scripts/ci/generate_release_sbom.py \
src/egressweave/release_evidence.py || true
printf '%s\n' '== Changed-range prohibited behavior scan =='
git diff --unified=3 "$base" "$head" | rg -n -i -C 2 \
'https?://|urllib|requests|socket|subprocess|os\.system|popen|oidc|credential|token|secret|sign|attest|publish|git (tag|push|commit|checkout|reset)|workflow|\.github|release|ref' || true
printf '%s\n' '== Documentation and changelog in current head =='
nl -ba docs/release-evidence-preparation.md | sed -n '1,360p'
nl -ba docs/release.md | sed -n '1,360p'
nl -ba CHANGELOG.md | sed -n '1,180p'Length of output: 52899 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='13cd59b5d0307f1a4dc1e4ffe777ed31b878c657'
head='421c0975cdabbc24cb4c42a9bb11e202cd33b0a4'
printf '%s\n' '== Confirm requested ancestry =='
if git merge-base --is-ancestor "$base" "$head"; then
printf '%s\n' 'base_is_ancestor=true'
fi
printf '%s\n' '== Entire preparer =='
sed -n '1,430p' scripts/ci/prepare_release_evidence.py
printf '%s\n' '== Entire preparer tests =='
sed -n '1,520p' tests/test_prepare_release_evidence.py
printf '%s\n' '== Candidate generator and verifier files =='
fd -a -t f . scripts src | grep -E '(^|/)(generate_attestable_release_sbom|generate_release_sbom|release_evidence)\.py$' || true
printf '%s\n' '== Generator and verifier outlines =='
ast-grep outline scripts/ci/generate_attestable_release_sbom.py --items all || true
ast-grep outline scripts/ci/generate_release_sbom.py --items all || true
ast-grep outline src/egressweave/release_evidence.py --items all || true
printf '%s\n' '== Archive opening and artifact identity call sites =='
grep -nE -C 10 \
'ZipFile|tarfile\.open|TarFile|build_attestable_sbom|build_sbom|artifact_path|lstat\(|fstat\(|os\.open|O_NOFOLLOW|MAX_ARTIFACT_BYTES|MAX_DISTRIBUTION_BYTES|stream' \
scripts/ci/generate_attestable_release_sbom.py \
scripts/ci/generate_release_sbom.py \
src/egressweave/release_evidence.py || true
printf '%s\n' '== Full generator and verifier source =='
sed -n '1,460p' scripts/ci/generate_attestable_release_sbom.py || true
sed -n '1,460p' scripts/ci/generate_release_sbom.py || true
sed -n '1,620p' src/egressweave/release_evidence.py || true
printf '%s\n' '== Changed code imports and external-effect indicators =='
git diff --unified=0 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py \
| grep -nE '^\+.*\b(import|from|subprocess|requests|urllib|socket|http|OIDC|oidc|credential|token|secret|sign|attest|publish|release|git|os\.system|popen)\b' || true
printf '%s\n' '== Diff file list and documentation references =='
git diff --name-only "$base" "$head"
grep -nE -C 3 'SLSA|provenance|byte|parser|credential|handoff|CycloneDX|Reference|References' \
docs/release-evidence-preparation.md docs/release.md CHANGELOG.md || trueLength of output: 149063
I found one high-severity issue.
The exact range changes only the requested five files. I found no added direct network, credential, workflow, repository-write, OIDC, signing, attestation, tag, release, or publication behavior in those files. The static implementation otherwise matches the reviewed claims for cardinality and version binding, deterministic CycloneDX 1.7 documents, canonical source identity, filename-sorted checksums, exclusive owner-only output creation, external handoff storage, post-publication reconstruction, failure guidance, non-provenance and SLSA boundaries, APA references, and changelog wording. I did not approve, merge, rebase, retarget, publish, or release this pull request.
|
|
@coderabbitai review Review only exact current head Focus on exact-one wheel/sdist selection; rejection of stale, extra, nested, symlinked, non-regular, malformed, mismatched, or oversized inputs before generator/parser loading; descriptor-bound hashing and archive/member validation; deterministic CycloneDX 1.7 SBOMs, |
|
@opencode-agent Review only exact current head The current two-parent merge synchronizes the prior bounded implementation head Independently review exact artifact selection, compressed-byte preflight before generator/parser loading, descriptor-bound hashing, archive/member and SBOM semantics, deterministic six-file evidence, owner-only exclusive creation, verifier and handoff reconstruction, documentation and APA references, explicit non-provenance/no-SLSA boundary, and absence of workflow, credential, permission, network, signing, attestation, release, tag, ref, repository-write, OIDC, or publication behavior. Submit a current-head review outcome only after checking the exact tree and evidence. Keep the PR draft; do not merge, mark ready, enable auto-merge, release, publish, rebase, or retarget. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6a8f57c29c9ebb561c771829ba75501ba9a91eb8'
head='fb54b615cbc69ef92c3ac787db1f3faafbc2cba9'
first_parent='421c0975cdabbc24cb4c42a9bb11e202cd33b0a4'
printf '%s\n' '== Exact topology =='
git rev-parse "${base}^{commit}"
git rev-parse "${head}^{commit}"
git cat-file -p "$head" | sed -n '1,8p'
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
printf '%s\n' '== Parent diffs =='
git diff --name-status "${head}^1" "$head"
git diff --name-status "${head}^2" "$head"
printf '%s\n' '== Requested base-to-head diff =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== Merge import diff =='
git diff --find-renames --find-copies --unified=20 "${head}^1" "$head"
printf '%s\n' '== Target outlines =='
ast-grep outline scripts/ci/prepare_release_evidence.py --items all
ast-grep outline tests/test_prepare_release_evidence.py --items all
ast-grep outline scripts/ci/generate_attestable_release_sbom.py --items all
ast-grep outline scripts/ci/generate_release_sbom.py --items all
ast-grep outline src/egressweave/release_evidence.py --items all
printf '%s\n' '== Preparer and test critical sections =='
nl -ba scripts/ci/prepare_release_evidence.py | sed -n '1,430p'
nl -ba tests/test_prepare_release_evidence.py | sed -n '1,560p'
printf '%s\n' '== Generator/verifier parser and identity call chains =='
rg -n -C 10 \
'^(def |class )|build_attestable_sbom|build_sbom|ZipFile|tarfile\.open|TarFile|lstat\(|fstat\(|stat\(|os\.open|O_NOFOLLOW|O_EXCL|MAX_|artifact_path|sha256|member|reconstruct|post_publication|handoff|chmod|unlink|rmtree|replace|rename' \
scripts/ci/generate_attestable_release_sbom.py \
scripts/ci/generate_release_sbom.py \
src/egressweave/release_evidence.py
printf '%s\n' '== Full five-file diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py \
tests/test_prepare_release_evidence.py \
docs/release-evidence-preparation.md \
docs/release.md \
CHANGELOG.md
printf '%s\n' '== Changed-range external-effect indicators =='
git diff --unified=0 "$base" "$head" | rg -n -i -C 2 \
'^\+.*\b(https?://|urllib|requests|socket|subprocess|os\.system|popen|oidc|credential|token|secret|sign|attest|publish|git\s+(tag|push|commit|checkout|reset)|workflow|\.github|release|ref)\b' || true
printf '%s\n' '== Current documentation and changelog claims =='
rg -n -C 4 \
'preflight|byte|parser|credential|exact SHA|SLSA|provenance|CycloneDX|SOURCE_IDENTITY|SHA256SUMS|handoff|References|Unreleased' \
docs/release-evidence-preparation.md docs/release.md CHANGELOG.mdLength of output: 15534 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6a8f57c29c9ebb561c771829ba75501ba9a91eb8'
head='fb54b615cbc69ef92c3ac787db1f3faafbc2cba9'
printf '%s\n' '== Preparer =='
sed -n '1,430p' scripts/ci/prepare_release_evidence.py
printf '%s\n' '== Preparer tests =='
sed -n '1,560p' tests/test_prepare_release_evidence.py
printf '%s\n' '== Attestable generator =='
sed -n '1,260p' scripts/ci/generate_attestable_release_sbom.py
printf '%s\n' '== Foundation generator archive handling =='
sed -n '1,175p' scripts/ci/generate_release_sbom.py
sed -n '360,510p' scripts/ci/generate_release_sbom.py
printf '%s\n' '== Evidence verifier I/O and reconstruction =='
sed -n '55,155p' src/egressweave/release_evidence.py
sed -n '470,735p' src/egressweave/release_evidence.py
printf '%s\n' '== Documentation and changelog =='
sed -n '1,240p' docs/release-evidence-preparation.md
sed -n '1,260p' docs/release.md
sed -n '1,120p' CHANGELOG.md
printf '%s\n' '== Targeted source locations =='
rg -n -C 6 \
'_select_distributions|_require_distribution_preflight|_load_attestable_generator|build_attestable_sbom|_sha256_file|_write_private_file|build_evidence_manifest|write_evidence_manifest|_require_post_publication_state|ZipFile|tarfile\.open|_wheel_metadata|_sdist_metadata|_require_open_regular_file|_require_stable_read' \
scripts/ci/prepare_release_evidence.py \
scripts/ci/generate_attestable_release_sbom.py \
scripts/ci/generate_release_sbom.py \
src/egressweave/release_evidence.py
printf '%s\n' '== Exact range: added imports and effectful API calls =='
git diff --unified=0 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py \
| rg -n -C 2 \
'^\+.*\b(import|from|open|os\.open|chmod|mkdir|unlink|rmtree|replace|rename|subprocess|requests|urllib|socket|http|oidc|credential|token|secret|sign|attest|publish|git)\b' || trueLength of output: 130537
I found one high-severity issue.
The merge topology matches the requested stack-sync claim. The requested head has first parent The diff against the requested base contains the intended five files only. The static review found no added direct workflow, credential, permission, network, signing, attestation, release, tag, ref, repository-write, OIDC, or publication behavior. The implementation otherwise matches the reviewed claims for exact wheel/sdist selection, version binding, deterministic CycloneDX 1.7 output, canonical source identity, filename-sorted checksums, exclusive owner-only output creation, external handoff storage, post-publication reconstruction, failure guidance, non-provenance and no-SLSA boundaries, APA-style references, and changelog wording. I did not approve, merge, mark ready, rebase, retarget, release, or publish this pull request. You are interacting with an AI system. |
|
@opencode-agent Apply only the bounded CHANGELOG completion to exact current head The test-first parser-binding repair is already implemented and documented. Modify only
Do not modify scripts, tests, documentation, |
|
@coderabbitai review Review exact current head |
|
@opencode-agent Perform a read-only exact-head review of Reassess the earlier blocking finding that mutable distribution pathnames could be replaced after preflight and reach ZIP/tar parsing. Verify the current implementation binds accepted device/inode/size through no-follow descriptors, creates finite owner-only parser-only snapshots, delegates parsing only to those snapshots, refuses replacement before parser execution, preserves stable fail-closed behavior and complete later hashing/SBOM/checksum verification, and accurately documents residual mutable-storage and non-provenance boundaries. Also inspect all five changed files for new correctness, security, resource-bound, portability, cleanup, API, documentation, and coverage issues. Anchor every finding and any formal review outcome to exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6a8f57c29c9ebb561c771829ba75501ba9a91eb8'
head='961abb78b9df1fd3dba0dd23582c8379d845556c'
printf '%s\n' '== Exact commit and topology =='
git rev-parse "${base}^{commit}"
git rev-parse "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== Exact base-to-head changed files =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== Target file outlines =='
ast-grep outline scripts/ci/prepare_release_evidence.py --items all
ast-grep outline tests/test_prepare_release_evidence.py --items all
ast-grep outline scripts/ci/generate_attestable_release_sbom.py --items all || true
ast-grep outline scripts/ci/generate_release_sbom.py --items all || true
ast-grep outline src/egressweave/release_evidence.py --items all || true
printf '%s\n' '== Preparer and focused tests =='
nl -ba scripts/ci/prepare_release_evidence.py | sed -n '1,460p'
rg -n -C 12 \
'preflight|snapshot|replace|rename|descriptor|inode|device|MAX_DISTRIBUTION_BYTES|_load_attestable_generator|build_attestable_sbom|cleanup|unlink|rmtree|handoff|unsafe|bound' \
tests/test_prepare_release_evidence.py
printf '%s\n' '== Parser and verifier interfaces =='
rg -n -C 10 \
'^(def |class )|build_attestable_sbom|build_sbom|ZipFile|tarfile\.open|open\(|os\.open|O_NOFOLLOW|O_EXCL|fstat\(|lstat\(|sha256|MAX_|reconstruct|post_publication|manifest|member' \
scripts/ci/generate_attestable_release_sbom.py \
scripts/ci/generate_release_sbom.py \
src/egressweave/release_evidence.py
printf '%s\n' '== Full requested diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py \
tests/test_prepare_release_evidence.py \
docs/release-evidence-preparation.md \
docs/release.md \
CHANGELOG.md
printf '%s\n' '== Added external-effect indicators =='
git diff --unified=0 "$base" "$head" | rg -n -i -C 2 \
'^\+.*\b(https?://|urllib|requests|socket|subprocess|os\.system|popen|oidc|credential|token|secret|sign|attest|publish|git\s+(tag|push|commit|checkout|reset)|workflow|\.github|release|ref)\b' || true
printf '%s\n' '== Current documentation claims =='
rg -n -C 5 \
'snapshot|preflight|parser|replacement|SLSA|provenance|CycloneDX|SOURCE_IDENTITY|SHA256SUMS|handoff|References|Unreleased' \
docs/release-evidence-preparation.md docs/release.md CHANGELOG.mdLength of output: 13359 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6a8f57c29c9ebb561c771829ba75501ba9a91eb8'
head='961abb78b9df1fd3dba0dd23582c8379d845556c'
show_lines() {
file="$1"
start="$2"
end="$3"
printf '\n== %s:%s-%s ==\n' "$file" "$start" "$end"
sed -n "${start},${end}p" "$file" | awk -v n="$start" '{printf "%5d %s\n", n++, $0}'
}
show_lines scripts/ci/prepare_release_evidence.py 1 520
show_lines tests/test_prepare_release_evidence.py 1 360
show_lines scripts/ci/generate_attestable_release_sbom.py 150 225
show_lines scripts/ci/generate_release_sbom.py 75 165
show_lines scripts/ci/generate_release_sbom.py 360 500
show_lines src/egressweave/release_evidence.py 55 155
show_lines src/egressweave/release_evidence.py 470 735
printf '%s\n' '== Exact requested diff =='
git diff --find-renames --find-copies --unified=100 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py \
tests/test_prepare_release_evidence.py \
docs/release-evidence-preparation.md \
docs/release.md \
CHANGELOG.md
printf '%s\n' '== Call sites: selected distributions, snapshots, and parser inputs =='
rg -n -C 7 \
'_select_distributions\(|_require_distribution_preflight\(|_snapshot_distribution\(|_load_attestable_generator\(|build_attestable_sbom\(|_sha256_file\(|build_evidence_manifest\(|write_evidence_manifest\(' \
scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py
printf '%s\n' '== Documentation and changelog =='
sed -n '1,240p' docs/release-evidence-preparation.md
sed -n '1,300p' docs/release.md
sed -n '1,100p' CHANGELOG.md
printf '%s\n' '== Changed code external-effect scan =='
git diff --unified=0 "$base" "$head" -- \
scripts/ci/prepare_release_evidence.py tests/test_prepare_release_evidence.py \
| rg -n -i -C 3 \
'^\+.*\b(urllib|requests|socket|subprocess|os\.system|popen|oidc|credential|token|secret|sign|attest|publish|git\s+(tag|push|commit|checkout|reset)|workflow|\.github)\b' || trueLength of output: 175219 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='961abb78b9df1fd3dba0dd23582c8379d845556c'
printf '%s\n' '== Checked-out head =='
actual="$(git rev-parse HEAD)"
printf 'expected=%s\nactual=%s\n' "$expected" "$actual"
test "$actual" = "$expected"
printf '%s\n' 'checkout_matches_expected=true'
printf '%s\n' '== PR `#64` head =='
gh api repos/ContextualWisdomLab/EgressWeave/pulls/64 \
--jq '.head.sha | "pr_head=\(.)"' \
| tee /tmp/pr-head.txt
test "$(sed 's/^pr_head=//' /tmp/pr-head.txt)" = "$expected"
printf '%s\n' 'pr_head_matches_expected=true'Length of output: 1064 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='961abb78b9df1fd3dba0dd23582c8379d845556c'
actual="$(gh api repos/ContextualWisdomLab/EgressWeave/pulls/64 --jq '.head.sha')"
printf 'expected=%s\npr_head=%s\n' "$expected" "$actual"
test "$actual" = "$expected"
printf '%s\n' 'pr_head_matches_expected=true'Length of output: 565
I found no new issue in the reviewed scope. The earlier parser-path finding is not reproducible on this head. The preparer now:
The replacement regression verifies that a replacement after preflight reaches neither the generator nor the parser. It also verifies that the preparer creates no generated evidence or handoff. The implementation retains later bounded descriptor/path hashing, archive and SBOM validation, checksum binding, exclusive owner-only output creation, and independent post-publication reconstruction. The failure and retry guidance correctly treats partial local output as untrusted. The documentation preserves the non-provenance and no-SLSA-Build-level boundary. The reviewed diff adds no network, credential, workflow, repository-write, OIDC, signing, attestation, tag, release, or publication behavior. I did not approve, merge, rebase, retarget, publish, or release the pull request. You are interacting with an AI system. |
1 participant
Test-first credential-free release-evidence preparation
Progresses #63 without modifying
.github, workflow permissions, credentials, protected refs, release identities, dependencies, or files owned by the stacked base PR.Exact tree binding
6a8f57c29c9ebb561c771829ba75501ba9a91eb8.18dbf66dcf1e1b336daa76403a687d513bebefaa.0a8d352680358c1551240eae0a8db042bebf13e0.60a57f16986eac1b2d0fc733236f10e1bed13a9b.421c0975cdabbc24cb4c42a9bb11e202cd33b0a4.fb54b615cbc69ef92c3ac787db1f3faafbc2cba9.2de4bd093014e164b73f0fd61dd4cc414f44d69c.0f0db5e5df748e9098bad51240e90116f5b62194.961abb78b9df1fd3dba0dd23582c8379d845556c.PR #62 advanced after this stack was verified. No rebase, retarget, force update, automatic conflict strategy, or credential-bearing publication has been used to hide that divergence. This PR therefore remains draft until an auditable credential-separated integration mechanism reconstructs the intended tree against an accepted #62 head and independently verifies that exact result.
Implemented bounded slice
SOURCE_IDENTITY.json, and filename-sortedSHA256SUMSwithout clocks, randomness, runner-local paths, network access, or credentials;[Unreleased]without a version bump;Test-first evidence
Exact RED head
2de4bd093014e164b73f0fd61dd4cc414f44d69creplaced the accepted wheel pathname after preflight and proved the former implementation could still reach the delegated generator. The bounded implementation refuses the replacement before parser execution; the regression records no parser input and creates no generated evidence or handoff.An intermediate exact-head run
31104830261failed only because the regression expected the generic unsafe error while the implementation correctly rejected the oversized replacement through the stable safety-bound error. Commitb33e424957e4eb38642e79f91c60e93bdaf9a75dnarrowed the test to accept either valid fail-closed outcome without weakening the no-parser assertion.Historical exact-head evidence
CI run
31105569311succeeded on exact PR #64 head961abb78b9df1fd3dba0dd23582c8379d845556c:That evidence validates this exact branch head only against its historical stacked base. It is not evidence for a future reconstructed tree incorporating current #62. Applicable SAST and Security Scan evidence also remains required for the integrated exact tree.
Remaining gates
Keep this PR draft. Require accepted #62 integration first, an auditable credential-separated reconstruction with stale-head refusal, then exact integrated-tree CI, Python 3.10–3.13, 100% production statement/branch coverage, package acceptance, automated review, applicable SAST/Security Scan, independent non-author approval, branch protection, and every repository policy gate.
Do not merge, enable auto-merge, mark ready, release, publish, rebase, retarget, force-update, or claim provenance or a SLSA Build level.