feat(ci): add portable repository adapters and protected-base CLI - #2864
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7574f88d45
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Independent review and single fix-round checkpoint Reviewed this slice with an independent Terra reader, then reviewed only the blocking fix diff. Current head: 0a80090. The integrated final tree is byte-identical to independently reviewed 636a17329e5a480d702fcf1a9585cf279bbf60fb after preserving each original stack branch and propagating fixes with merge commits. Blocking changes: prohibit Git lazy fetch/protocol execution in immutable readers; use independently trusted self-contained export verification; repair Windows CRLF and privilege-free symlink fixtures. Slice-specific changes remain visible in this PR diff. No result-reuse activation or settings changes. Validation: cumulative Windows control command node --test scripts/ci/smart-ci/*.test.mjs passed 509/509, no failures/skips/cancellations. Independent fix checks: core/repository 110/110; export/workflow 11/11. node scripts/check-doc-links.mjs passed, 683 Markdown files and zero broken relative links. These are additive; hosted CI at the current head/base is still required. Nonblocking findings are tracked once on #2336: #2336 (comment) . Review budget: one original pass and one scoped fix verification, complete. Original E2E/nightly-map findings were already corrected in the previous authored heads and remain covered by the green control tests. The maintainer's current local request explicitly includes finishing and merging this CI work. Parent-first merge order remains #2863, #2864, #2865, #2867, #2868, #2869, #2871; children are retargeted only after parents land, with moved-base requalification. No branch deletion while it is a stack base. |
|
Base-refresh checkpoint: parent #2863 landed as2cdd39d02eaec272cb1244e59bffb719af211d34. This PR now targets main and head is0133a6be0f3773e84e258714099e5a01a626e4f9. The complete source tree is byte-identical to reviewed0a800907a (git diff --exit-code passed); only merge ancestry changed. The independent code review therefore still covers the same implementation. Fresh exact-head hosted CI is running against the landed base; prior hosted green is not used as moved-base qualification. |
1 participant
Stack and scope
Depends on #2863. Merge the parent first; retarget this PR to main only after that merge and requalification.
Adds declarative
ci.repository-adapter.v1, conservative Node/.NET/Python starters, and a no-dependency CLI (init,validate,plan). Configuration is read from an exact protected-base Git blob, never candidate code or dirty worktree contents. Repository ID, control-path coverage, ownership rules and transitive input contracts are validated. Existing canonical selection is an additive floor.Also imports the Taskdeck-specific auxiliary bridge and the dependency-only workflow proposal tool from the supplied bundle. The Taskdeck bridge imports canonical validation from its own reviewed tooling, derives canonical lane IDs and binds the planned merge parent/commit/tree; all Taskdeck reuse contracts stay unreviewed.
stage-taskdeck.mjswrites a separate proposed file and does not edit live workflow YAML in this PR.Detailed protocol, commands, trust boundaries and porting instructions:
docs/ci/continuation/ADAPTERS.md.Verification
node --test scripts/ci/smart-ci/continuation.test.mjs: 253 passed, 0 failed/skipped/cancelled, local Node 22.16.0/Linux. Includes 30 new generic adapter/CLI tests plus the bundle's 31 Taskdeck/staging tests and the parent's 192 core tests. A temporary real Git repository proves a candidate's malicious policy edit and dirty worktree cannot replace the immutable base configuration. Tests exercise transitive impact, unknown/control paths, invalid options, size limits and output-overwrite refusal.Full Taskdeck control/governance/product checks, configured Node 24.13.1, Windows and independent fresh-context review remain owed; this environment has only a connector-backed source overlay, not a complete Git checkout. Hosted exact-head qualification is required. No second-real-repository deployment or measured savings are claimed from fixture tests.
Safety / rollout
Observation only: no task execution, workflow edits, check/status writes, required-context changes, registry publication or result-reuse activation. The generic command examples are identities to review against each repository's actual workflow, not blindly executable recipes. Licensing remains inherited from Taskdeck.
R4: park for maintainer plus independent review under SC-10. No auto-merge. No canonical STATUS/MASTERPLAN/OUTSTANDING_TASKS edits or administrative changes. Revert the adapter/CLI/tests/docs to roll back; no runtime migration exists.
Refs #2329, #2336.