Repository navigation
fix(ci): gate CLI changes on relocated acceptance - #837
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Fixed hosted shard 5 environment-isolation finding in a314c2d. New real CLI-entry probes made the whole-file scan detect the existing Bash draft-fan-in fixture copying process.env. The fixture now passes only its explicit gate inputs; no scanner exception or assertion change. Local guard, selector, trusted-policy and shard regressions: 194 pass /1253 assertions; privacy and changed-file lint pass. Persistent reviewer round 59 CLEAN. No next run rerun/cancel/merge. @codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Ready for lead: a314c2d Ready CLI-source PRs now retain the Linux x64 Config compiler acceptance lane. The planner and independent shell boundary both cover HOME-writing lifecycle changes ( Current-head run43584876562: both Linux compiler acceptance lanes, Linux Candidate, all five Linux unit shards (including corrected shard5 environment guard), Docker shards/fan-in, lifetime, models and docs passed. Local194 guard/planner/trusted-policy/shard tests1253assertions, earlier scope/wiring tests, root gates, actionlint and docs checks pass; removing either policy rule independently exposes omission in negative controls. Cost:0 additional default Mac minutes, one Linux x64 lane. Measured local8relocated scripts59.5s +CLIbuild0.7s +compilerprep41.9s cached=102.1s components. Actual current-head hosted x64 compiler lane230s including setup; its transport/relocated/release acceptance step131s. Hosted release-install check passed, closing the local sandbox-prerequisite gap. Keep existing non-cancelling next group (onlyPR events cancel active runs), with the lead's documented rule: after a batch, wait for a completed next run unless the batch verifier ran the same checks on the combined tree. GitHub can replace pending runs, so concurrency alone does not enforce that checkpoint. Review status: persistent second-family CLEAN (55–57,59); current-head Codex no findings; |
|
The lead Mac timeout is addressed in 2c3b39d: the old single test built 18 repositories under one five-second timeout; now eight tests each build one repository (six independent path cases, one ci:mac case, one draft case). No timeout was raised. Existing path/host assertions remain, with policy=base also asserted in the Mac mode. Added explicit shell and planner regression coverage for scripts/lib/native-plan-home.ts through the protected scripts rule. Local guard/policy/selector run: 150 pass,814assertions; individual new boundary cases67–80ms on Linux. Mac timing needs the lead recheck. Persistent reviewer60 CLEAN. @codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Ready for lead: 2c3b39d — Mac recheck requested. This supersedes the a314c2d readiness note after the lead's reproducible Mac timeout. The old single test created 18 Git repositories under one five-second timeout. It now creates eight repositories across eight tests: one for each of the same six path cases, one ci:mac case, and one draft case. Every test retains the default five-second timeout. No file-wide or individual timeout was raised, and path/host assertions remain intact. The shared Local guard/policy/selector checks: 150 passed, 814 assertions; each new boundary case took 67–80 ms on Linux. Lint/privacy passed. Same persistent second-family reviewer: CLEAN, round 60. Mac timing is not qualified by these Linux measurements; please recheck this head in the Mac batch. New current-head Actions run 43591953429 is queued. The prior head's Linux acceptance evidence remains historical; it is not claimed as a new-head CI pass. GitHub says MERGEABLE against next 1f761ac with no authored-path conflicts. No further pushes after this note. #832 is untouched and retains the lead's Mac pass. No next rerun/cancel/merge and no manual Mac dispatch. Task scratch cleaned; validation evidence retained. |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
A lifecycle change such as #810 can write under HOME or change the refusal envelope without touching the compiler crate. Light PR policy previously removed the Config compiler job, so its relocated CLI contracts were exercised only after merge.
Ready PRs changing CLI source (
src/, rootindex.ts,packages/cli/) now retain the existing Linux x64 Config compiler lane, including the release build, eight relocated CLI scripts and release-install acceptance. The planner and independent inline boundary both enforce it, including withci:macand older trusted base policy. Protected acceptance-script changes already select full tiers. Drafts stay light; unrelated test/docs PRs keep their smaller plan. The requiredtestfan-in now rejects failure, cancellation or an unexpected skip of any selected compiler host. Full native tiers therefore wait for the selected Mac/Intel compiler lanes too.Keep the existing
nextconcurrency policy: an active run completes, only one pending run is retained, and new pushes may replace the pending run. Only PR events cancel active runs. The workflow comment, verification guide and CI docs now record the lead rule: after one batch merges, no further merge until anextrun completes, unless the batch verifier ran the same checks on the combined tree. Splitting job concurrency would complicate matching evidence without guaranteeing a checkpoint between batches. Nonextrun was rerun or cancelled; the freeze on 5002cf8 remains in force.Cost: 0 added default macOS minutes per CLI PR, plus one existing Linux x64 compiler job. On Linux with Bun 1.4.4/Rust 1.97.1, the eight relocated scripts passed in 59.5 s, CLI build in 0.7 s and compiler preparation in 41.9 s with cached dependencies (102.1 s combined). This is component timing: the whole hosted lane also includes setup, schema, transport/unit and release-install checks. The latter needs passwordless sandbox setup on the local host and was left for hosted CI. The lead separately measured about 80 s for all nine scripts on Mac once the release exists.
Validation: final-plan regression names the existing
src/lib/activity-log.tsHOME-writing path and actual command/backend/entry paths. The inline boundary is tested against old/tampered base policy, includingci:mac; shell fan-in tests exercise both selected and unselected compiler outcomes. Removing either guard independently in isolated copies exposes the missing Linux host. Focused planner/scope/fan-in/wiring tests, root typecheck/check/privacy, actionlint and docs checks pass. Persistent second-family Claude review CLEAN (rounds 55–57). Current-head hosted checks and Codex review pending.HACK-2240. Based on next 5002cf8; no production source change. No manual Mac dispatch. This PR changes protected CI inputs, so its own hosted run automatically selects full tiers; the light-PR regression is established by the planner and independent shell tests. Lead owns merge.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.