feat(ci): export portable kit and document review and rollout - #2871
Conversation
…runbook Export an explicit immutable Git allowlist with inherited license bytes, source/blob identities and bounded checksums. Verify pristine exports and run the independent portable regression suite without Taskdeck files. Document stack review, staged activation, remaining provenance boundaries, measurement and rollback. No publication or production reuse activation. Refs #2329, #2336
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3508ef0d3b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Independent review and single fix-round checkpoint Reviewed this slice with an independent Terra reader, then reviewed only the blocking fix diff. Current head: de0f50b. The integrated final tree is byte-identical to independently reviewed 636a17329e5a480d702fcf1a9585cf279bbf60fb after preserving each original stack branch and propagating fixes with merge commits. Blocking changes: prohibit Git lazy fetch/protocol execution in immutable readers; use independently trusted self-contained export verification; repair Windows CRLF and privilege-free symlink fixtures. Slice-specific changes remain visible in this PR diff. No result-reuse activation or settings changes. Validation: cumulative Windows control command node --test scripts/ci/smart-ci/*.test.mjs passed 509/509, no failures/skips/cancellations. Independent fix checks: core/repository 110/110; export/workflow 11/11. node scripts/check-doc-links.mjs passed, 683 Markdown files and zero broken relative links. These are additive; hosted CI at the current head/base is still required. Nonblocking findings are tracked once on #2336: #2336 (comment) . Review budget: one original pass and one scoped fix verification, complete. Original E2E/nightly-map findings were already corrected in the previous authored heads and remain covered by the green control tests. The maintainer's current local request explicitly includes finishing and merging this CI work. Parent-first merge order remains #2863, #2864, #2865, #2867, #2868, #2869, #2871; children are retargeted only after parents land, with moved-base requalification. No branch deletion while it is a stack base. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de0f50b882
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Current-base refresh after #2869 merged as 2f0ec03: retargeted to main and updated branch to bc4b7d1. The complete portability patch is byte-identical to the independently reviewed original patch. Concurrent product changes are preserved and do not touch the CI-control dependency boundary. Fresh full required qualification is running; original export and trust-boundary review evidence remains applicable. Production reuse stays disabled. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc4b7d17ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Confirmed merge blocker: HIGH severity, review3977694865. A trusted verifier invoked through a Windows directory junction returns exit0 with no verification even for a missing target; direct invocation returns1. Independent review reproduced the bypass and classified it HIGH, not CRITICAL. A concrete two-file correction is prepared locally: canonicalize both entry paths and test valid/missing/tampered exports under default Node resolution and --preserve-symlinks-main. All seven export tests pass. It is not published yet: the original review/fix ceiling is exhausted, and the owner has been asked for one explicitly scoped additional round. This PR and its child will not merge while the bypass exists. Existing CI success does not waive this defect. |
|
The owner explicitly authorized the additional scoped round. Correction cdc6d8e canonicalizes both the module and invocation paths before detecting CLI execution. The regression verifies valid, missing and tampered exports through a linked directory under default Node resolution and --preserve-symlinks-main. The current portability control suite passes 510 tests, with no failures/skips/cancellations; docs governance and686links pass. The later scheduling branch has two additional tests and will be qualified separately. Fix-only independent review and fresh full hosted qualification are required at this new head. The previously exported archive will be replaced with a separately verified version containing this correction. |
There was a problem hiding this comment.
💡 Codex Review
https://github.com/Chris0Jeky/Taskdeck/blob/cdc6d8e9fa801d0b90d152935e14c540dba6c835//workspace/Task/workspace/Taskdeck/scripts/%D0%A6%D0%98/smart-ci/continuation/tools/export-kit.mjs#L70
When export-kit.mjs is launched through a symlinked file or symlinked checkout path, Node resolves import.meta.url.url to the real path while leaving process.argv[1] as the linked path, so this condition is false and the CLI exits successfully without creating an export. I reproduced a symlinked invocation returning status 0_CTX with no output directory, which lets wrappers mistake a no-op for a completed export; canonicalize both paths before comparing them, as the verifier now does.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Fresh-context review of this PR found I had searched the wrong issue. The continuation train's tracker is CI-12 #2336, not #2337 or #2324, and #2336 records the session as maintainer-requested and, at 02:40:20Z on 2026-09-10, "the maintainer's 2026-09-10 request to finish implementation, merging, testing and CI improvements". So "no delegation is recorded" was wrong. The row now asks whether that request supplied the per-PR review the amendment wants, and infers nothing either way. Three further corrections the same review prompted: The divergence did not start 2026-09-09. J.1 (#2772) and J.2 (#2787) are both 2026-09-08, and 2026-09-09 is the day the rule was honoured, with the four-PR delegation. The pointer file said the opposite. The row omitted the train's quality record, which changes how question (a) reads. Every PR carried a Codex and an independent review with current-base full required qualification. One confirmed HIGH, a trusted verifier bypassed through a Windows directory junction, was refused at 09:44Z, fixed in cdc6d8e at 09:49:14Z and is an ancestor of #2871's 10:23:22Z merge; export.test.mjs passes 7/7 on current main. The gap is procedural, not a shipped known defect. #2878 is added: it is the eighth merge in the same train. #2868's ci-continuation-observe.yml and #2791's nightly observer are different PRs under different trackers, and #2791 was delegated on 2026-09-09. An unqualified ruling about "the observer" would hit the wrong one, so the row says which is which. Also: name J.2 as where a parked control-plane PR is recorded now that SC-10 is closed; stop hard-coding live connector status in a file whose own preamble says live GitHub outranks it, and restore the standing "a usage-limit notice is informational, not a finding" triage line; correct the CF subset sentence, which spans v0.4 as well; bump Last reviewed. Refs #2337, #2336.
1 participant
Stack / review entry point
Final child of #2869. Review in order: #2863 → #2864 → #2865 → #2867 → #2868 → #2869 → this PR. Merge parents first, then retarget/requalify each child against current main. R4: park for maintainer plus independent fresh-context review under SC-10; no auto-merge.
Start with
docs/ci/continuation/OPERATIONS.md, which indexes all eight scoped guides and distinguishes deployed workflow changes from reference mechanisms and outstanding activation requirements.Portable implementation
tools/export-kit.mjscopies an explicit provider-neutral allowlist from exact immutable Git blobs into a NEW directory outside the source repository. It excludes Taskdeck workflows/policy/bespoke adapter/staging tooling, preserves source LICENSE bytes, adds a standalone README/private package manifest, and records source commit/tree, blob IDs, lengths and SHA-256 checksums. No dirty worktree scan, candidate execution, arbitrary recursive copy, publication or licence change.tools/verify-export.mjschecks bounded inventory/length/checksums and rejects missing/extra/tampered/symlink/special files. Unsigned checksum integrity is not trusted-source authentication. Keep the manifest/source revision independently trusted. Generated configs/reports belong outside the pristine export.The portable kit retains conservative Node/.NET/Python onboarding, protected-base policy reading, read-only GitHub attempt observation and tested core/admission/ledger libraries. No portable example authorises omission or establishes production provenance.
Validation
Final local repository-overlay run: 357 passed, 0 failed/skipped/cancelled, Node 22.16.0/Linux/Git 2.47.3. The standalone export independently runs 309 passing tests without Taskdeck files; its verifier validates 27 payload files. Reproducibility, dirty-input isolation, output containment, overwrite refusal, missing/link inputs, tampered/extra/link output and independent execution are covered.
The standalone smoke used an explicitly labelled temporary local Git validation snapshot, not a claimed GitHub/release commit. Existing GPL-3 LICENSE bytes were verified against repository blob
f288702d2fa16d3cdf0035b15a9fcbc552cd88e7. A nested-runner fixture initially inherited Node's IPC environment; the test now isolates it and requests TAP explicitly. Initial failure and successful rerun are retained separately.Local results are NOT the full Taskdeck product/governance/Windows suite. Hosted configured-Node/exact-head checks and independent review remain required. No real second-repository deployment, observer deployment, signing/publication, distributed durability or measured production saving is claimed.
Implemented versus still gated
After approved merges: test discovery, failure barriers, isolated launcher/frontend qualification, and protected read-only metadata observation. Canonical policy remains shadow and Taskdeck result reuse stays disabled. Actual execution provenance, protected issuer/anchor/revocation infrastructure, full-audit/landed integration and canonical gate consumption still require implementation/review/qualification. No permissive placeholder is used to pretend those are complete.
Administrative settings, signing/releases, visibility/spend/runners, existing required contexts and coordinator-owned canonical docs are untouched. Parent issues stay open. Rollback/export/licensing/measurement instructions are in OPERATIONS.md and PORTABILITY.md.
Refs #2329, #2336.