feat(ci): export portable kit and document review and rollout - #2871
feat(ci): export portable kit and document review and rollout#2871Chris0Jeky wants to merge 3 commits into
Conversation
…runbook Export an explicit immutable Git allowlist with inherited license bytes, source/blob identities and bounded checksums. Verify pristine exports and run the independent portable regression suite without Taskdeck files. Document stack review, staged activation, remaining provenance boundaries, measurement and rollback. No publication or production reuse activation. Refs #2329, #2336
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3508ef0d3b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Independent review and single fix-round checkpoint Reviewed this slice with an independent Terra reader, then reviewed only the blocking fix diff. Current head: de0f50b. The integrated final tree is byte-identical to independently reviewed 636a17329e5a480d702fcf1a9585cf279bbf60fb after preserving each original stack branch and propagating fixes with merge commits. Blocking changes: prohibit Git lazy fetch/protocol execution in immutable readers; use independently trusted self-contained export verification; repair Windows CRLF and privilege-free symlink fixtures. Slice-specific changes remain visible in this PR diff. No result-reuse activation or settings changes. Validation: cumulative Windows control command node --test scripts/ci/smart-ci/*.test.mjs passed 509/509, no failures/skips/cancellations. Independent fix checks: core/repository 110/110; export/workflow 11/11. node scripts/check-doc-links.mjs passed, 683 Markdown files and zero broken relative links. These are additive; hosted CI at the current head/base is still required. Nonblocking findings are tracked once on #2336: #2336 (comment) . Review budget: one original pass and one scoped fix verification, complete. Original E2E/nightly-map findings were already corrected in the previous authored heads and remain covered by the green control tests. The maintainer's current local request explicitly includes finishing and merging this CI work. Parent-first merge order remains #2863, #2864, #2865, #2867, #2868, #2869, #2871; children are retargeted only after parents land, with moved-base requalification. No branch deletion while it is a stack base. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de0f50b882
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Stack / review entry point
Final child of #2869. Review in order: #2863 → #2864 → #2865 → #2867 → #2868 → #2869 → this PR. Merge parents first, then retarget/requalify each child against current main. R4: park for maintainer plus independent fresh-context review under SC-10; no auto-merge.
Start with
docs/ci/continuation/OPERATIONS.md, which indexes all eight scoped guides and distinguishes deployed workflow changes from reference mechanisms and outstanding activation requirements.Portable implementation
tools/export-kit.mjscopies an explicit provider-neutral allowlist from exact immutable Git blobs into a NEW directory outside the source repository. It excludes Taskdeck workflows/policy/bespoke adapter/staging tooling, preserves source LICENSE bytes, adds a standalone README/private package manifest, and records source commit/tree, blob IDs, lengths and SHA-256 checksums. No dirty worktree scan, candidate execution, arbitrary recursive copy, publication or licence change.tools/verify-export.mjschecks bounded inventory/length/checksums and rejects missing/extra/tampered/symlink/special files. Unsigned checksum integrity is not trusted-source authentication. Keep the manifest/source revision independently trusted. Generated configs/reports belong outside the pristine export.The portable kit retains conservative Node/.NET/Python onboarding, protected-base policy reading, read-only GitHub attempt observation and tested core/admission/ledger libraries. No portable example authorises omission or establishes production provenance.
Validation
Final local repository-overlay run: 357 passed, 0 failed/skipped/cancelled, Node 22.16.0/Linux/Git 2.47.3. The standalone export independently runs 309 passing tests without Taskdeck files; its verifier validates 27 payload files. Reproducibility, dirty-input isolation, output containment, overwrite refusal, missing/link inputs, tampered/extra/link output and independent execution are covered.
The standalone smoke used an explicitly labelled temporary local Git validation snapshot, not a claimed GitHub/release commit. Existing GPL-3 LICENSE bytes were verified against repository blob
f288702d2fa16d3cdf0035b15a9fcbc552cd88e7. A nested-runner fixture initially inherited Node's IPC environment; the test now isolates it and requests TAP explicitly. Initial failure and successful rerun are retained separately.Local results are NOT the full Taskdeck product/governance/Windows suite. Hosted configured-Node/exact-head checks and independent review remain required. No real second-repository deployment, observer deployment, signing/publication, distributed durability or measured production saving is claimed.
Implemented versus still gated
After approved merges: test discovery, failure barriers, isolated launcher/frontend qualification, and protected read-only metadata observation. Canonical policy remains shadow and Taskdeck result reuse stays disabled. Actual execution provenance, protected issuer/anchor/revocation infrastructure, full-audit/landed integration and canonical gate consumption still require implementation/review/qualification. No permissive placeholder is used to pretend those are complete.
Administrative settings, signing/releases, visibility/spend/runners, existing required contexts and coordinator-owned canonical docs are untouched. Parent issues stay open. Rollback/export/licensing/measurement instructions are in OPERATIONS.md and PORTABILITY.md.
Refs #2329, #2336.