Skip to content

[arbiter-authentication/2.10.4] Public CLI reuse and installed acceptance - #82

Merged
omry merged 1 commit into
pr81from
pr82
Nov 2, 2026
Merged

[arbiter-authentication/2.10.4] Public CLI reuse and installed acceptance#82
omry merged 1 commit into
pr81from
pr82

Conversation

@omry

@omry omry commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Expose portable identity reuse through the enrollment CLI and verify the complete installed flow. A selected enrolled identity keeps its portable key and certificate while the target issues independent access and approval. Hold the native enrollment lock across source loading, target exchange and promotion. Reject equivalent source/target enrollment endpoint URLs before cleanup, including ignored trailing slashes on root and prefixed paths.

Require registration wire version2 on the public endpoint, retain historical receipt decoding, and migrate the existing native approval fixture. Installed acceptance exercises the actual local approval authority, offline source server, lost commit replies and exact resume. Update enrollment documentation and the server release note.

Validation after the URL regression repair: 1,855 Python tests passed (43 skipped) using a freshly rebuilt Go client; full Go tests and vet passed; explicit Black check passed over140 targets; complete configured type check passed with zero errors in the existing lint environment. The new focused regression fails against original production bytes and passes after repair. Native platform CI and current remote review remain publication gates.

@omry omry mentioned this pull request Nov 1, 2026
Merged
@omry
omry added this pull request to stack #77 November 1, 2026 16:58
@omry

omry commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:2e127ac3e0f03e8014cc8f431904f6e5fd85eb1b3653494eae238ae11a3a8c5b",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:2e127ac3e0f03e8014cc8f431904f6e5fd85eb1b3653494eae238ae11a3a8c5b",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124978116782
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124978127749
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 124978127623
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124978127627
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124978127600
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124978127691
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124978127662
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124978127579
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124978127713
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124978127465
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124978127557
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124978127508
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124978127316
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:61bb6e999c23a75fe36939445bda9051823307a2d93a7d70294a11fc58b8d6fe",
      "review_request": {
        "body_digest": "sha256:348f9961030148f522cf0a99e815cc8d967f5dafb8a807c9ad76729dee90b08e",
        "id": 6564020380
      },
      "review_result": {
        "body_digest": "sha256:a5fb201664a627960dad2bded5de49c4ccbb2a9579332a0bc8a3d9b3dd85c1e3",
        "id": 6564031332
      },
      "security_review": {
        "context_identity": "sha256:000dae91edc7876c1bb8efb04e4dc8a90decb4d6085e3c02592f81f65c304eb5",
        "proof_identity": "sha256:f7b0dca39a4766ee9d9a6713107f8cbbf677dacf0470402c9ffa35f856070baf",
        "requested": "dbb",
        "schema_version": 1
      }
    },
    "evidence_fingerprint": "sha256:d306a3bd728bd4a273a27c77ef1cca4f9539377e14b0af63bcaf17aaaa950349",
    "head_sha": "92f57c8036f81efbb746f959491d272bf68be316",
    "operation_identity": "sha256:61bb6e999c23a75fe36939445bda9051823307a2d93a7d70294a11fc58b8d6fe",
    "review_request_id": 6564020380,
    "review_result_id": 6564031332,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:2e127ac3e0f03e8014cc8f431904f6e5fd85eb1b3653494eae238ae11a3a8c5b",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 124978116782
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux arm64",
      "run_id": 124978127749
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Linux x64",
      "run_id": 124978127623
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows arm64",
      "run_id": 124978127627
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform Windows x64",
      "run_id": 124978127600
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS arm64",
      "run_id": 124978127691
    },
    {
      "conclusion": "SUCCESS",
      "name": "Platform macOS x64",
      "run_id": 124978127662
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.10",
      "run_id": 124978127579
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.11",
      "run_id": 124978127713
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.12",
      "run_id": 124978127465
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python 3.14",
      "run_id": 124978127557
    },
    {
      "conclusion": "SUCCESS",
      "name": "Python lint",
      "run_id": 124978127508
    },
    {
      "conclusion": "SUCCESS",
      "name": "Website",
      "run_id": 124978127316
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124914994716,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124914994716"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124934061956,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934061956",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934061956,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 124934060887,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934060887",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934060887,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124934062133,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934062133",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934062133,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124934098018,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934098018",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934098018,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124934061847,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934061847",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934061847,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124934089068,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934089068",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934089068,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124934097935,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934097935",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934097935,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124934062048,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934062048",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934062048,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124934098184,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934098184",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934098184,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124934105200,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934105200",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934105200,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124934099525,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934099525",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934099525,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124934060945,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124934060945",
          "workflow": {
            "app_id": 15368,
            "attempt": 2,
            "check_suite_id": 112010663912,
            "event": "pull_request",
            "job_id": 124934060945,
            "name_unique": true,
            "run": {
              "conclusion": "success",
              "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
              "number": 361,
              "status": "completed"
            },
            "run_id": 41329022659,
            "workflow_id": 286506297
          }
        }
      ],
      "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
      "id": "sha256:2381cb77ab766c4b23d2e8dfc70b19922a8195d7f99902ee2b6fc20d0c2dfd7e",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124978116782,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124978116782"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124978127749,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127749"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux x64",
          "run_id": 124978127623,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127623"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124978127627,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127627"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124978127600,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127600"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124978127691,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127691"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124978127662,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127662"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124978127579,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127579"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124978127713,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127713"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124978127465,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127465"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124978127557,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127557"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124978127508,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127508"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124978127316,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41350068571/job/124978127316"
        }
      ],
      "head_sha": "92f57c8036f81efbb746f959491d272bf68be316",
      "id": "sha256:758193cfffc8eea6749a5c9c10f14f58f8ac5ec00a4d0d6958a0cee7aace3fc5",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 124914994716,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/runs/124914994716"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Linux arm64",
          "run_id": 124914992089,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992089"
        },
        {
          "conclusion": "FAILURE",
          "name": "Platform Linux x64",
          "run_id": 124914991986,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914991986"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows arm64",
          "run_id": 124914992150,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992150"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform Windows x64",
          "run_id": 124914992147,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992147"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS arm64",
          "run_id": 124914992094,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992094"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Platform macOS x64",
          "run_id": 124914992168,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992168"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.10",
          "run_id": 124914992086,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992086"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.11",
          "run_id": 124914991997,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914991997"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.12",
          "run_id": 124914991953,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914991953"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python 3.14",
          "run_id": 124914992029,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914992029"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Python lint",
          "run_id": 124914991993,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914991993"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Website",
          "run_id": 124914991804,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/arbiter/actions/runs/41329022659/job/124914991804"
        }
      ],
      "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
      "id": "sha256:b98fedcaab30c1ee6feba26e6ff7afbe87348085f6822ee391d94d2f745306b2",
      "required_checks": [
        "Gitar",
        "Platform Linux arm64",
        "Platform Linux x64",
        "Platform Windows arm64",
        "Platform Windows x64",
        "Platform macOS arm64",
        "Platform macOS x64",
        "Python 3.10",
        "Python 3.11",
        "Python 3.12",
        "Python 3.14",
        "Python lint",
        "Website"
      ],
      "status": "failure"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr81",
    "base_sha": "cb91525ab9f3a071c39f4f8bc945faa1b2fe56e1",
    "body_digest": "sha256:ac8f7c85cab7db742d8190dda1b4b5fe8b8a898034a88661c392fca9075b27a0",
    "body_identity_version": 2,
    "diff_digest": "sha256:b77571c00a2c8cc9d81c921810e45f0cdda4c7a4f094e382b690a53f5a8d29cd",
    "head_ref": "pr82",
    "head_sha": "92f57c8036f81efbb746f959491d272bf68be316",
    "pr": 82,
    "repository": "omry/arbiter",
    "scope_authority": [
      {
        "digest": "sha256:3c0fada6a105777ecd5546b3f3898b0b2dea71f1032176e6ccd7c3fd51386a6a",
        "path": "docs/authentication/implementation-plan.md"
      },
      {
        "digest": "sha256:7cbad8803d0ade4090289d22a681a01026782ade9785c731ac7a2d8a33b9c0e1",
        "path": "docs/authentication/portable-enrollment-lld.md"
      }
    ],
    "title_digest": "sha256:92b1e7e260f573823658c92fbbc53adae2dafef4d4209700abe4f41042893b2d"
  },
  "record_version": 7,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-11-01T16:58:14Z",
      "base_ref": "pr81",
      "base_sha": "cb91525ab9f3a071c39f4f8bc945faa1b2fe56e1",
      "body_digest": "sha256:b594e90948cd9ce822804532c7eb56a39587aa5cd1048b4541b1f2c1902a23aa",
      "created_at": "2026-11-01T18:08:23Z",
      "head_sha": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
      "id": 6561836653,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-11-01T16:58:14Z",
      "base_ref": "pr81",
      "base_sha": "cb91525ab9f3a071c39f4f8bc945faa1b2fe56e1",
      "body_digest": "sha256:348f9961030148f522cf0a99e815cc8d967f5dafb8a807c9ad76729dee90b08e",
      "created_at": "2026-11-01T21:18:00Z",
      "head_sha": "92f57c8036f81efbb746f959491d272bf68be316",
      "id": 6564020380,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr81",
      "base_sha": "cb91525ab9f3a071c39f4f8bc945faa1b2fe56e1",
      "body_digest": "sha256:89f8e945f8d741425ef107e6b762d689f594f7a8ec76014df2281d83c4750d21",
      "commit_id": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
      "id": 6561851068,
      "inline_message_ids": [],
      "request_comment_id": 6561836653,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-11-01T18:09:33Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOSmRaHM6ycgo0"
      ]
    },
    {
      "base_ref": "pr81",
      "base_sha": "cb91525ab9f3a071c39f4f8bc945faa1b2fe56e1",
      "body_digest": "sha256:a5fb201664a627960dad2bded5de49c4ccbb2a9579332a0bc8a3d9b3dd85c1e3",
      "commit_id": "92f57c8036f81efbb746f959491d272bf68be316",
      "id": 6564031332,
      "inline_message_ids": [],
      "request_comment_id": 6564020380,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-11-01T21:18:57Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:2e127ac3e0f03e8014cc8f431904f6e5fd85eb1b3653494eae238ae11a3a8c5b",
  "rounds": [
    {
      "applied_fix_paths": [
        "client/go-cli/internal/identity/enrollment_test.go",
        "client/go-cli/internal/identity/provisional_session.go"
      ],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:b77571c00a2c8cc9d81c921810e45f0cdda4c7a4f094e382b690a53f5a8d29cd",
      "finding_ids": [],
      "invariants": [
        "Reject equivalent source/target enrollment endpoints before provisional cleanup under existing native owner."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "client/go-cli/internal/identity/enrollment_test.go",
        "client/go-cli/internal/identity/provisional_session.go"
      ],
      "resulting_head": "92f57c8036f81efbb746f959491d272bf68be316",
      "review_observation_id": null,
      "review_request_id": 6561836653,
      "review_result_id": 6561851068,
      "reviewed_head": "6f4faf979a89d94c3bb7b10dbe4cd5d9770e3789",
      "root_cause": "Actual local DBB R1-1/R2-1 original immutable reports, not remote findings: URL string comparison missed hostnamecase/effective decimal port/literal-IP equivalence. Standard netip plus effective decimal-port normalization under same owner; exact2path fixes independently reviewed and validated. See auth2104-pr82-round1-reconciliation.json and original report references; no fabricated GitHubfindingIDs.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:b77571c00a2c8cc9d81c921810e45f0cdda4c7a4f094e382b690a53f5a8d29cd",
      "finding_ids": [],
      "invariants": [
        "Exact current published candidate has no unresolved source/approval/activation/recovery findings; original local fixes verified."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "92f57c8036f81efbb746f959491d272bf68be316",
      "review_observation_id": null,
      "review_request_id": 6564020380,
      "review_result_id": 6564031332,
      "reviewed_head": "92f57c8036f81efbb746f959491d272bf68be316",
      "root_cause": null,
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review November 1, 2026 18:05
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-01T21:18:58.355973Z 92f57c8 Manual request
🔒 Security Review ✅ Completed 2026-11-01T18:07:48.602710Z 6f4faf9 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 6f4faf9

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 1, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 6f4faf979a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry
[arbiter-authentication/2.10.4] Public CLI reuse and installed accept…
92f57c8 
…ance

Expose portable identity reuse through the enrollment CLI and verify the complete installed flow. A selected enrolled identity keeps its portable key and certificate while the target issues independent access and approval. Hold the native enrollment lock across source loading, target exchange and promotion. Reject equivalent source/target enrollment endpoint URLs before cleanup, including ignored trailing slashes on root and prefixed paths.

Require registration wire version2 on the public endpoint, retain historical receipt decoding, and migrate the existing native approval fixture. Installed acceptance exercises the actual local approval authority, offline source server, lost commit replies and exact resume. Update enrollment documentation and the server release note.

Validation after the URL regression repair: 1,855 Python tests passed (43 skipped) using a freshly rebuilt Go client; full Go tests and vet passed; explicit Black check passed over140 targets; complete configured type check passed with zero errors in the existing lint environment. The new focused regression fails against original production bytes and passes after repair. Native platform CI and current remote review remain publication gates.
@gitar-bot

gitar-bot Bot commented Nov 1, 2026

Copy link
Copy Markdown
Code Review ✅ Approved 1 closed / 1 findings

🔴 High risk · Adding cross-server portable identity reuse changes enrollment trust and key issuance; a binding error could let an unintended identity enroll on the target.

Exposes portable identity reuse through the enrollment CLI and verifies the full installed flow, including source loading, target exchange, and promotion under the native enrollment lock. Same-server URL guard now also catches host case differences and explicit default ports, addressing that resolved finding. No open issues found.

✅ 1 closed
✅ Edge Case: Same-server guard misses host case and explicit default port

📄 client/go-cli/internal/identity/provisional_session.go:201-205
The same-server check compares enrollmentURL(...).String() values, but enrollmentURL only trims trailing slashes from the path. It does not lowercase the scheme or host, and it does not drop the :443 default port. If the source was saved as https://source.invalid, then identity= with url=https://SOURCE.invalid or url=https://source.invalid:443 passes the check. The tool then cleans the provisional directory and registers against the source server itself, which is the case the PR says it rejects before cleanup. Fix: build a comparison key from the lowercased Hostname(), the port with an empty value treated as 443, and the trimmed path, and add test cases for host case and the explicit default port.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 92f57c8

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 1, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 92f57c8036

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved PR passed review and required checks label Nov 1, 2026
@omry
omry merged commit d52f8bc into main Nov 2, 2026
14 checks passed
@omry
omry deleted the pr82 branch November 2, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments

Assignees

No one assigned

Labels

approved PR passed review and required checks

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry