Repository navigation
Conversation
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Owner
Author
|
PR-cycle state — maintained automatically. Do not edit by hand. Mechanical PR-cycle state (JSON){
"approval": {
"candidate_revision_fingerprint": "sha256:33f16086a84e6d4d7906e39e2af2b02e9a5aecbad712fe67c4ed99940af0046e",
"evidence": {
"attestations": [],
"candidate_revision_fingerprint": "sha256:33f16086a84e6d4d7906e39e2af2b02e9a5aecbad712fe67c4ed99940af0046e",
"check_conclusions": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 125075282023
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 125069957205
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 125069964105
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 125069964417
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 125069964370
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 125069964484
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 125069964398
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 125069964297
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 125069964292
}
],
"delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"finding_dispositions_digest": "sha256:b90b7ccac71da8b309e0b85a8a03e4639a9781ad046acb426c8075fa43347514",
"operation_identity": "sha256:809daf25af1da1afa8a3cad0e068a7fe88f32caebed4e26299b5a86162254e12",
"review_request": {
"body_digest": "sha256:aa0b555b54bff9d048403e395acf97fa22bd1314f1814c4e6c08144a19dcfe2d",
"id": 6568756400
},
"review_result": {
"body_digest": "sha256:404a4dd4250290a8b54768188f533edc2125b75224f2ea3587fff79ea93b06ed",
"id": 6568774888
}
},
"evidence_fingerprint": "sha256:eba3a2f6765a7f28d199f12caec03fa17b0bdf624c16acbff1b5796b555adb5c",
"head_sha": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"operation_identity": "sha256:809daf25af1da1afa8a3cad0e068a7fe88f32caebed4e26299b5a86162254e12",
"review_request_id": 6568756400,
"review_result_id": 6568774888,
"status": "approved-evidence-recorded"
},
"candidate_revision_fingerprint": "sha256:33f16086a84e6d4d7906e39e2af2b02e9a5aecbad712fe67c4ed99940af0046e",
"check_conclusions": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 125075282023
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 125069957205
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 125069964105
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 125069964417
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 125069964370
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 125069964484
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 125069964398
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 125069964297
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 125069964292
}
],
"check_observations": [
{
"checks": [
{
"name": "Bash native evidence checks",
"reason": "missing",
"status": "pending"
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 125046645678,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/runs/125046645678"
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 125048529087,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/runs/125048529087"
},
{
"name": "Linux CI checks",
"run_id": 125046639115,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639115"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 125046639342,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639342"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 125046639329,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639329"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 125046639395,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639395"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 125046639546,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639546"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 125046639269,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639269"
},
{
"conclusion": "FAILURE",
"name": "Windows host smoke (windows-arm64)",
"run_id": 125046639295,
"run_status": "completed",
"status": "failure",
"url": "https://github.com/omry/reploy/actions/runs/41372786209/job/125046639295"
}
],
"head_sha": "8756387a4b25e4033efe493c887bb688f1f0b62a",
"id": "sha256:5c4202bd28ce1f0ee8118cd58d7fbfce56d322402ce6fc72be532404364a7970",
"required_checks": [
"Bash native evidence checks",
"Gitar",
"Linux CI checks",
"Target smoke (darwin-amd64)",
"Target smoke (darwin-arm64)",
"Target smoke (linux-amd64)",
"Target smoke (linux-arm64)",
"Windows host smoke (windows-amd64)",
"Windows host smoke (windows-arm64)"
],
"status": "failure"
},
{
"checks": [
{
"conclusion": "SUCCESS",
"name": "Bash native evidence checks",
"run_id": 125075282023,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125075282023"
},
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 125069957205,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/runs/125069957205"
},
{
"conclusion": "SUCCESS",
"name": "Linux CI checks",
"run_id": 125069964105,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964105"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-amd64)",
"run_id": 125069964417,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964417"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (darwin-arm64)",
"run_id": 125069964370,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964370"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-amd64)",
"run_id": 125069964484,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964484"
},
{
"conclusion": "SUCCESS",
"name": "Target smoke (linux-arm64)",
"run_id": 125069964398,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964398"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-amd64)",
"run_id": 125069964297,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964297"
},
{
"conclusion": "SUCCESS",
"name": "Windows host smoke (windows-arm64)",
"run_id": 125069964292,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/reploy/actions/runs/41380473086/job/125069964292"
}
],
"head_sha": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"id": "sha256:e7ef7bcee2b1a0cf76bb33eaf0c46695ea2b9127ad1a1a168d9cc3f414d7991b",
"required_checks": [
"Bash native evidence checks",
"Gitar",
"Linux CI checks",
"Target smoke (darwin-amd64)",
"Target smoke (darwin-arm64)",
"Target smoke (linux-amd64)",
"Target smoke (linux-arm64)",
"Windows host smoke (windows-amd64)",
"Windows host smoke (windows-arm64)"
],
"status": "success"
}
],
"delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"delivery_deferrals": [],
"findings": [
{
"disposition": "external-ci-evidence-requires-new-head-pass",
"evidence": [
"https://github.com/omry/reploy/actions/runs/41372786209/job/125046639295",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-windows-arm64-failure.log",
"https://github.com/omry/reploy/actions/runs/41380473086/job/125069964292"
],
"id": "check-windows-arm64-round01",
"proposed_authorized_paths": [],
"rationale": "Observed cumulative package timeout; active current subtest elapsed one second and stack was in File.Sync. F1.0 adds only a Python fixture and inert Go text, neither executes in this Go suite. No F1.0 source fix or timeout-policy weakening is justified. Exact-head successful Windows ARM64 CI remains mandatory.",
"source_surface": "required-checks",
"status": "non-actionable",
"title": "Unchanged dockerdeploy suite exceeded five-minute package timeout"
},
{
"disposition": "accepted-current-slice-defect",
"evidence": [
"https://github.com/omry/reploy/pull/320#discussion_r4438252958",
"tools/conformance/multiidentity/f10_filesystem_boundary.py:163",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-repair-local-review.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-focused-repair-checks.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0/guest-proof-attempt09/report.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-verified-thread-resolutions.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round02-local-receipt.json",
"https://github.com/omry/reploy/pull/320#issuecomment-6568774888"
],
"id": "codex-inline:4438252958",
"invariant": "A validated fixture binary remains executable from the disposable working directory.",
"proposed_authorized_paths": [
"tools/conformance/multiidentity/f10_filesystem_boundary.py"
],
"required_outcome": "Normalize the caller-relative binary path before changing subprocess directories while retaining digest and symlink checks.",
"severity": "medium",
"source_author": "chatgpt-codex-connector[bot]",
"source_surface": "pull-request-review",
"status": "resolved",
"title": "Relative binary path is reinterpreted after subprocess cwd changes"
},
{
"disposition": "accepted-current-slice-defect",
"evidence": [
"https://github.com/omry/reploy/pull/320#discussion_r4438214600",
"tools/conformance/multiidentity/f10_filesystem_boundary.py:299-304",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-repair-local-review.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-focused-repair-checks.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0/guest-proof-attempt09/report.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-verified-thread-resolutions.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round02-local-receipt.json",
"https://github.com/omry/reploy/pull/320#issuecomment-6568774888"
],
"id": "local-F10-gid-map-oracle",
"invariant": "Host UID and GID allocations are independent; assert each observed mapping against its own base.",
"proposed_authorized_paths": [
"tools/conformance/multiidentity/f10_filesystem_boundary.py"
],
"required_outcome": "Use the observed host GID base independently of the UID base and retain root/owner rejection plus exact mapping shape checks.",
"severity": "medium",
"source_author": "current-coordinator (Gitar diagnostic independently verified)",
"source_surface": "local-source-inspection",
"status": "resolved",
"title": "Fixture GID oracle assumes the UID allocation base"
},
{
"disposition": "accepted-current-slice-defect",
"evidence": [
"https://github.com/omry/reploy/pull/320#discussion_r4438214648",
"tools/conformance/multiidentity/f10_filesystem_boundary.py:237-284 and :331-376",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-repair-local-review.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-focused-repair-checks.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0/guest-proof-attempt09/report.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round01-verified-thread-resolutions.json",
"/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.0-pr-cycle/round02-local-receipt.json",
"https://github.com/omry/reploy/pull/320#issuecomment-6568774888"
],
"id": "local-F10-restore-cleanup",
"invariant": "Every attempted substitution restores the original retained path and preserves the first failure.",
"proposed_authorized_paths": [
"tools/conformance/multiidentity/f10_filesystem_boundary.py"
],
"required_outcome": "Both restore paths tolerate absence of the substitute while restoring the original pinned artifact.",
"severity": "medium",
"source_author": "current-coordinator (Gitar diagnostic independently verified)",
"source_surface": "local-source-inspection",
"status": "resolved",
"title": "Substitution cleanup can hide failure and skip restoration"
}
],
"pr": {
"base_ref": "pr318",
"base_sha": "faf58d145caf48e82419d905f145b4d45c7b0fa4",
"body_digest": "sha256:dbd96590ed6e2931f54c6d6e6d11350bb42bea12bc643e022f5374126aa4fb15",
"body_identity_version": 2,
"diff_digest": "sha256:9ba621e8cd655e3b35c7c96394c965f2f345394bb0dc22e7d7c305876af555a7",
"head_ref": "pr320",
"head_sha": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"pr": 320,
"repository": "omry/reploy",
"scope_authority": [
{
"digest": "sha256:6f278d93ec80c42f9b905f990c585c1c9db7082cd7e7c2a827e9b840582b6c14",
"path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
},
{
"digest": "sha256:f6049a45f86b96b5a7c6616926804871d77e8b86bf3305cc42d3910320fc5b76",
"path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
}
],
"title_digest": "sha256:85e1adcbfa78bf912a986ba08c2da498a6d9d6758be01dd4c0862961276f1839"
},
"record_version": 7,
"review_observations": [],
"review_requests": [
{
"base_established_at": "2026-11-02T01:29:59Z",
"base_ref": "pr318",
"base_sha": "faf58d145caf48e82419d905f145b4d45c7b0fa4",
"body_digest": "sha256:f04bc6a3a98131755cdf69ccab64622b83c5f0eab29f9a22dd87a4fbfd889f61",
"created_at": "2026-11-02T01:41:28Z",
"head_sha": "8756387a4b25e4033efe493c887bb688f1f0b62a",
"id": 6567057723,
"kind": "regular-review"
},
{
"base_established_at": "2026-11-02T01:29:59Z",
"base_ref": "pr318",
"base_sha": "faf58d145caf48e82419d905f145b4d45c7b0fa4",
"body_digest": "sha256:aa0b555b54bff9d048403e395acf97fa22bd1314f1814c4e6c08144a19dcfe2d",
"created_at": "2026-11-02T04:03:44Z",
"head_sha": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"id": 6568756400,
"kind": "regular-review"
}
],
"review_results": [
{
"base_ref": "pr318",
"base_sha": "faf58d145caf48e82419d905f145b4d45c7b0fa4",
"body_digest": "sha256:42a24d361e69f246ac8c8828b74714d9b1804145d97aead3e7107cf2d242ca58",
"commit_id": "8756387a4b25e4033efe493c887bb688f1f0b62a",
"id": 5731297595,
"inline_message_ids": [
4438252958
],
"request_comment_id": 6567057723,
"result_kind": "findings",
"status": "result",
"submitted_at": "2026-11-02T01:42:44Z",
"unresolved_thread_ids": [
"PRRT_kwDOTFQCkM6ygfcm",
"PRRT_kwDOTFQCkM6ygfdG",
"PRRT_kwDOTFQCkM6yglSw"
]
},
{
"base_ref": "pr318",
"base_sha": "faf58d145caf48e82419d905f145b4d45c7b0fa4",
"body_digest": "sha256:404a4dd4250290a8b54768188f533edc2125b75224f2ea3587fff79ea93b06ed",
"commit_id": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"id": 6568774888,
"inline_message_ids": [],
"request_comment_id": 6568756400,
"result_kind": "clean",
"status": "result",
"submitted_at": "2026-11-02T04:05:14Z",
"unresolved_thread_ids": []
}
],
"revision_fingerprint": "sha256:33f16086a84e6d4d7906e39e2af2b02e9a5aecbad712fe67c4ed99940af0046e",
"rounds": [
{
"applied_fix_paths": [
"tools/conformance/multiidentity/f10_filesystem_boundary.py"
],
"disposition_changes": [
"codex-inline:4438252958",
"local-F10-gid-map-oracle",
"local-F10-restore-cleanup"
],
"effective_diff_digest": "sha256:9ba621e8cd655e3b35c7c96394c965f2f345394bb0dc22e7d7c305876af555a7",
"finding_ids": [
"codex-inline:4438252958",
"local-F10-gid-map-oracle",
"local-F10-restore-cleanup",
"check-windows-arm64-round01"
],
"invariants": [
"Validated caller-relative binary remains usable after the subprocess cwd changes.",
"Host UID/GID allocations are independent; maps remain bounded and avoid owner/root authority.",
"Failure before substitute creation preserves the first error and restores the retained source.",
"Checked create/release refusal controls, empty capabilities, public activation guards and exact cleanup remain intact."
],
"outcome": "corrected-head-needs-review",
"proposed_fix_paths": [
"tools/conformance/multiidentity/f10_filesystem_boundary.py"
],
"resulting_head": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"review_observation_id": null,
"review_request_id": 6567057723,
"review_result_id": 5731297595,
"reviewed_head": "8756387a4b25e4033efe493c887bb688f1f0b62a",
"root_cause": "Relative binary argv was reused under a private cwd; the GID oracle reused the UID base; two finally blocks assumed the substitute existed. All three source defects are tested truth fixes. A separate description correction removed a stale moving LOC claim with no code-tree change. Old-head Windows ARM64 hit the cumulative five-minute package timeout; current-head CI success remains mandatory.",
"round": 1,
"unresolved_current_slice_findings": 0,
"unresolved_design_blockers": 0
},
{
"applied_fix_paths": [],
"disposition_changes": [],
"effective_diff_digest": "sha256:9ba621e8cd655e3b35c7c96394c965f2f345394bb0dc22e7d7c305876af555a7",
"finding_ids": [],
"invariants": [
"Exact/bounded filesystem and checked source-lifetime proof remains confined to disposable fixtures.",
"Independent UID/GID maps, caller-relative binary, and pre-substitution cleanup preserve their verified fixes.",
"All current-head ci.yml jobs, local full profile and fresh remote review passed."
],
"outcome": "clean",
"proposed_fix_paths": [],
"resulting_head": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"review_observation_id": null,
"review_request_id": 6568756400,
"review_result_id": 6568774888,
"reviewed_head": "cf790cccef494ce173bc61701cb8dcc3ba416737",
"root_cause": "No new defect in fresh review; all three prior source defects are verified truth-fixed. Current-head Windows ARM64 CI passed with the unchanged CI policy.",
"round": 2,
"unresolved_current_slice_findings": 0,
"unresolved_design_blockers": 0
}
],
"schema": "awd:swe:pr-cycle-state",
"version": 2
} |
omry
marked this pull request as ready for review
November 2, 2026 01:39
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Owner
Author
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8756387a4b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Add a disposable rootless compatible-API fixture for exact and bounded ID maps, confined filesystem descriptors, protected executable binds and read-only or explicit writable roots. Exercise source replacement through the same checked create/release path as positive cases and retain an omitted-check detection control. Validation: eight actual guest cases, six descriptor controls, both Python suites and all 35 tracked Go packages passed. The established WSL tmpfs exclusion remains. Engine qualification is limited to the retained patched Podman 6.2.0-dev/crun 1.30.1 fixture. Public mapped activation remains gated.
Code Review ✅ Approved 2 closed / 2 findings🟡 Medium risk · The new disposable Podman harness creates containers and mount fixtures and signals helpers; cleanup failure could leave host processes or resources behind. Adds a disposable rootless compatible-API fixture covering exact and bounded ID maps, confined filesystem descriptors, protected executable binds, and read-only or explicit writable roots, with source replacement exercised through the checked create/release path. Resolved the GID map oracle assumption about subgid starting at the subuid base and the restore ✅ 2 closed✅ Edge Case: GID map oracle assumes subgid range starts at the subuid base
✅ Quality: Restore
|
| Auto-apply | Compact |
|
|
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source
Owner
Author
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Nov 2, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a disposable rootless compatible-API fixture for exact and bounded ID maps, confined filesystem descriptors, protected executable binds and read-only or explicit writable roots. Exercise source replacement through the same checked create/release path as positive cases and retain an omitted-check detection control.
Validation: eight actual guest cases, six descriptor controls, both Python suites and all 35 tracked Go packages passed. The established WSL tmpfs exclusion remains. Engine qualification is limited to the retained patched Podman 6.2.0-dev/crun 1.30.1 fixture. Public mapped activation remains gated.