Repository navigation
Compare retained installed timing observations - #2977
kantorcodes wants to merge 91 commits into
Conversation
…on (HGP-135) policy_bundle_is_enforceable treated every guard-policy-bundle.v2 envelope as live, so a correctly signed draft or pending-approval v2 document was admitted on sync and cached reads — changing local state for an unapproved policy. Admission now reads the publication-contract rollout state from payload.spec.rolloutState for v2 (top-level rolloutState for v1) and only admits enforcing/enforced/rollback_available. Rejected drafts retain the prior valid revision and never emit an applied acknowledgement. v2 documents that omit the optional rolloutState field remain live so already-published generic bundles keep working. Signature verification is unchanged. Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
… module moves the signed generic v2 admission suite (draft/pending rejection, enforcing admission, omitted-state compatibility, cached-revalidation inactive_rollout_state) out of test_policy_bundle_v2.py so both modules stay under the 500 non-blank-line limit; shared signing helpers are imported from the original module (qodo #2948) Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…review) The v2 compatibility path now applies only when payload.spec.rolloutState is omitted. A present null or other non-string value is not treated as live authority; GuardPolicyDocument.from_mapping rejects those the same way. Regression tests cover signed v2 bundles with null and non-string rollout states. Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
… (PR #2948 review) Drive sync_receipts with an inactive (draft/pending_approval/null) v2 bundle planted in the cache while a live enforcing bundle is retained: the cached bundle is rejected, never becomes effective, and last-good authority remains current. Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…tivation evidence (HGP-136-152) - generic review compiles as review, ignore is inert, device selectors rejected pre-publication (HGP-136) - runtime posture reports the real canonical lane incl. missing protected authority/capability (HGP-137) - generic v2 acks are revision/device-bound only after the lane applies; unverified otherwise; no fabricated extension proof (HGP-138/139) - receipt upload success separated from policy validation/application with machine-readable rejection + retained last-good (HGP-140) - memory writes own memory rows in one transaction; bundle replace scoped to bundle-owned rows; both authority sets survive alternation (HGP-141/142) - signed memory targets project exactly or are refused; no sibling scope broadening (HGP-143) - one injected UTC clock for v1/v2 envelope and key validity; future-dated v2 rejected with stable code, last-good retained (HGP-144/145) - offline lifetime states, revocation without resurrection, workspace isolation, first-install trust, same-version substitution protection, empty-vs-missing publication distinction, and atomic concurrent delivery proven with regression suites (HGP-146-152) Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…2948 review) draft/pending_approval fail the enforceability gate as inactive_rollout_state; present null fails document validation earlier as invalid_policy_document. Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…n' into hgp/batch-03-policy-source-ownership # Conflicts: # src/codex_plugin_scanner/guard/policy_bundle_parser.py
…n' into hgp/batch-03-policy-source-ownership
Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…e-accurate sync outcomes Qodo findings on #2949: generic acks no longer fabricate managed delivery/extension proofs; signed memory targets accept the portal 0..50 cardinality and project into real matcher fields; runtime posture threads contract/capability state so lane, fallback-vs-applied, retained-vs- no-authority, and rollout percentage are reported accurately; applied acks are never overwritten when rollout disables; duplicate advisories_stored key removed. Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…ship (HGP-191-194) - Two-device approved policy adoption against one stub cloud - Offline reconnect applies newest revision only - Review-to-continuation without a persistent grant - Alternating policy/memory durability: bundle apply replaces only bundle-owned remote sources; memory apply replaces only cloud-signed-memory rows (RF-03) Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…utcomes (HGP-195/196) - Release evidence collector fails on missing/silently-deselected required release tests; the one CI deselect is named in the report - Negative outcomes (draft, wrong-workspace, stale, unavailable-runtime, immutable-block) are required fail-closed evidence, never passed:true - Generic v2 draft/pending_approval/simulated rollout states are not live authority (presence-aware, matching #2948) - Operator docs replace Phase 0 gap notes with verified create/approve/sync/verify/recover guidance; semantics.md names in-review #2948/#2949/#2959 Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
…readiness, durable review state (HGP-153-172) - Activation failures classified (JSON/storage/transport) with idempotent retry and no false apply claims; desired/durable/resident visibility stages - Scope-specific effective-authority explanation; managed/immutable floors cannot be weakened; generic-matchers.v1 capability published - Bounded compile/parse error payloads; export/import roundtrips retain meaning; deterministic imports idempotent; device selectors match installation identity only - Headless sync after connect/restart; bounded worker intervals; CLI readiness requires both workers; one status projection for CLI and settings; enable/disable lifecycle convergence - Capability expiry explained; OAuth refresh bindings; held/quarantined events identity-bound; oldest-first outbox batching; partial-ack repair; durable SQLite/process recovery Signed-off-by: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
Keep independently observed policy revisions distinct and retain numeric failure status for troubleshooting. Verify completion evidence and public policy guidance. Decision-Diff-Framed-SHA256: 05069f050147a373b0de8092605f7bda8d45979d0362f5d7d7634fd2b08499d7
Keep policy source consent and exact selectors bound through review, preserve enrollment outcomes, and retain bounded verification diagnostics. Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
Decision-Diff-Framed-SHA256: 18e11987745548f4705c3fe367bdf98df1661e11861140089ffd947b32155fe6
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI failed: CI failure in the installed-timing-comparison workflow due to a non-zero exit code from the comparison script.Overview1 log analyzed showing a failure in the installed-timing-observations comparison step where the script exited with code 1. FailuresInstalled Timing Comparison Script Failure (confidence: medium)
Summary
Code Review ✅ No issues found🟡 Medium risk · Adds a macOS CI workflow that installs artifacts and runs timing comparisons Compares two retained installed builds using existing timing checks in a fixed previous/current/current/previous order, verifying artifact selection and unchanged benchmark inputs while recording bounded worker and timing observations. Seven diagnostic-contract tests pass, style checks pass, and both retained wheels match their pinned manifests and executable hashes. No issues found. Options ✅ Auto-apply✅ Auto-apply is on → Gitar will commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
074c0f6 to
a53d471
Compare
Compare two retained installed builds using the existing timing checks in a fixed previous/current/current/previous order. Verify the selected artifacts and unchanged benchmark inputs, then record bounded observations without adding requests or changing warmup and limits.
Validation: seven diagnostic-contract tests and repository style checks pass. Both retained artifacts match their pinned manifests and executable hashes. The completed comparison produced four valid observations: three passed all timing checks; the final observation of the previous build exceeded the existing concurrency limit. Every observation completed all requests without errors.
The result demonstrates variation within an unchanged retained build. It does not establish a source-specific cause or runtime acceptance, and the earlier failed gate remains recorded.