Skip to content

F1.1.2: Bind image-destination projection to the generation - #323

Open
omry wants to merge 1 commit into
pr321from
pr323
Open

F1.1.2: Bind image-destination projection to the generation#323
omry wants to merge 1 commit into
pr321from
pr323

Conversation

@omry

@omry omry commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Collect bounded mount-destination facts in the same verified immutable-image stream as identity evidence. Bind literal/resolved targets, content/type, platform, root policy and exact mount selection to the existing canonical build lock and generation digest. Reject missing, stale or malformed mapped evidence during publication, loading and reuse; preserve ordinary omitted-field identity and read-only file-bind compatibility.

Retain layered whiteout, alias, resource-limit and cancellation controls without extraction, a second store or per-launch export. Public mapped execution remains guarded pending host observation and launch qualification.

Validation: all 13 local repository commands passed on the exact corrected candidate, including complete Go inventory, build, ordinary CLI smoke/cleanup, distributions and website. Full current-agent review and a distinct fresh independent Sol review are clean. The established single WSL tmpfs exclusion and local Go timeout remain explicit; exact-head remote review and every ci.yml job are required before PR approval.

@omry
omry changed the base branch from main to pr321 November 2, 2026 22:17
@omry
omry added this pull request to stack #321 November 2, 2026 22:17
gitar-bot[bot]
gitar-bot Bot reviewed Nov 2, 2026
View reviewed changes
Comment thread internal/dockerdeploy/image_destination_index.go Resolved
@omry

omry commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:92161e1bc90aad336e98f24a94dcb22be99d38a9c5dadcf3532808d3a0649a77",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:92161e1bc90aad336e98f24a94dcb22be99d38a9c5dadcf3532808d3a0649a77",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 125622700749
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 125614476139
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 125614498896
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 125614499430
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 125614499734
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 125614499361
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 125614499603
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 125614499383
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 125614499425
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:fcc108eace6ed0d876b94e0432d25a67a0875c67641c75b1a902b37539c47783",
      "operation_identity": "sha256:cf8597d1cbad633b023ae7600d3df42b29af4f93ac3251a82373ae3b9ce2514b",
      "review_request": {
        "body_digest": "sha256:995ce45ea732783a03e4e72d0a579c579a1594b3a782efef71819f5190a01e46",
        "id": 6591088998
      },
      "review_result": {
        "body_digest": "sha256:f3d402245a1b9c2f5822b384c2b92276e96864ce759e0db84c88f097369de249",
        "id": 6591107836
      }
    },
    "evidence_fingerprint": "sha256:a01a97ac25a823a1cf40f8122f4a43afaa61a3f98f5f3c94bc049e5ad891ad0b",
    "head_sha": "eb8a5705909e44787b4445e32c5b1648f3f56883",
    "operation_identity": "sha256:cf8597d1cbad633b023ae7600d3df42b29af4f93ac3251a82373ae3b9ce2514b",
    "review_request_id": 6591088998,
    "review_result_id": 6591107836,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:92161e1bc90aad336e98f24a94dcb22be99d38a9c5dadcf3532808d3a0649a77",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 125622700749
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 125614476139
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 125614498896
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 125614499430
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 125614499734
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 125614499361
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 125614499603
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 125614499383
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 125614499425
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SKIPPED",
          "name": "Bash native evidence checks",
          "run_id": 125591438475,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125591438475"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 125587626783,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/125587626783"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 125590849495,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/125590849495"
        },
        {
          "conclusion": "FAILURE",
          "name": "Linux CI checks",
          "run_id": 125587612492,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587612492"
        },
        {
          "conclusion": "FAILURE",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 125587613224,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613224"
        },
        {
          "conclusion": "FAILURE",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 125587613378,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613378"
        },
        {
          "conclusion": "FAILURE",
          "name": "Target smoke (linux-amd64)",
          "run_id": 125587613353,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613353"
        },
        {
          "conclusion": "FAILURE",
          "name": "Target smoke (linux-arm64)",
          "run_id": 125587613255,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613255"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 125587613027,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613027"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 125587613160,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613160"
        }
      ],
      "head_sha": "9e0312d4b2a4fae69074331f78f893c272aceb12",
      "id": "sha256:47d37b51cc901acb1db9fd7df21dfc188ff24f821ea9259a5f6e96b88cdce4f5",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 125622700749,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125622700749"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 125614476139,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/125614476139"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 125614498896,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614498896"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 125614499430,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499430"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 125614499734,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499734"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 125614499361,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499361"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 125614499603,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499603"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 125614499383,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499383"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 125614499425,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/41543878457/job/125614499425"
        }
      ],
      "head_sha": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "id": "sha256:f2c513c1cbde7e87bef9f7f4a4816df9caf707696ace135084a44ea9c818754d",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "disposition": "accepted-current-slice-validation-defect",
      "evidence": [
        "https://github.com/omry/reploy/actions/runs/41535925172/job/125587612492",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-ci-source-base-comparison.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-controller-ready-fail-before.json",
        "internal/dockerdeploy/controlled_session_supervisor_test.go:1213-1245",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-local-review.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-focused-results.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-local-verification.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-checks-result.json",
        "https://github.com/omry/reploy/pull/323#issuecomment-6591107836"
      ],
      "id": "check-F112-controller-ready-fixture",
      "invariant": "Allowed controller requests begin after EventReadyV1; pre-ready refusal must remain tested and enforced.",
      "proposed_authorized_paths": [
        "internal/dockerdeploy/controlled_session_supervisor_test.go"
      ],
      "rationale": "Linux CI reports before-ready refusal. The unchanged positive fixture prequeues allowed requests before startup, so it depends on goroutine scheduling. Send those requests from EventReadyV1, following existing fixtures; keep runtime readiness enforcement and negative tests. A local100-repeat run passed and does not erase the actual CI failure; no timing-based sleep or runtime-policy change is proposed.",
      "required_outcome": "The positive fixture sends input/resize/terminate only after ready, without weakening pre-ready refusal.",
      "severity": "medium",
      "source_author": "current-coordinator (actual CI failure and fixture/lifecycle source inspected)",
      "source_surface": "required-checks",
      "status": "resolved",
      "title": "Send controller fixture requests after the ready event"
    },
    {
      "disposition": "accepted-current-slice-validation-defect",
      "evidence": [
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-pip263-fail-before.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-ci-source-base-comparison.json",
        "https://github.com/omry/reploy/actions/runs/41535925172/job/125587613378",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-local-review.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-focused-results.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-local-verification.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-checks-result.json",
        "https://github.com/omry/reploy/pull/323#issuecomment-6591107836"
      ],
      "id": "check-F112-pip263-manylinux-cache",
      "invariant": "The full test suite must exercise every selected-pip policy-hook case independently, without stale synthetic module state.",
      "proposed_authorized_paths": [
        "internal/providers/python/interpreter_inspection_test.go"
      ],
      "rationale": "All six target jobs fail the same unchanged test with pip26.3. Disposable pip26.3 reproduces failure; its new cached _get_manylinux_module retains the first absent fixture across later cases. Isolate/reset only synthetic fixture cache between cases; keep every false/raising assertion and selected-pip production authority unchanged.",
      "required_outcome": "All existing policy cases pass on both retained pip26.1.2 and CI pip26.3; no pinning or weakening of assertions.",
      "severity": "medium",
      "source_author": "current-coordinator (actual CI logs and disposable pip26.3 source/probe inspected)",
      "source_surface": "required-checks",
      "status": "resolved",
      "title": "Reset native module-cache fixture between synthetic manylinux policies"
    },
    {
      "disposition": "accepted-current-slice-defect",
      "evidence": [
        "https://github.com/omry/reploy/pull/323#discussion_r4448461766",
        "internal/dockerdeploy/image_destination_index.go:50-60",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-local-review.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-focused-results.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-local-verification.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-checks-result.json",
        "https://github.com/omry/reploy/pull/323#issuecomment-6591107836"
      ],
      "id": "github-inline-4448461766",
      "invariant": "Ordinary file removal in bounded image preparation should reuse the existing exact map rather than scan every unrelated image node.",
      "proposed_authorized_paths": [
        "internal/dockerdeploy/image_destination_index.go",
        "internal/dockerdeploy/image_destination_projection_test.go"
      ],
      "rationale": "The existing index invariant forbids children below a non-directory and retains implicit parents. Use bounded direct leaf/absent deletion with cancellation; retain existing subtree scanning for directories. A new parent/child index is unnecessary for this correction and no maximum-size throughput guarantee is added.",
      "required_outcome": "Remove regular/hardlink/symlink leaves and absent names without scanning unrelated nodes; preserve directory/opaque semantics.",
      "severity": "medium",
      "source_author": "gitar-bot",
      "source_message_id": 4448461766,
      "source_surface": "inline-review",
      "status": "resolved",
      "title": "Avoid complete index scans for non-directory whiteout/removal"
    },
    {
      "disposition": "accepted-current-slice-defect",
      "evidence": [
        "https://github.com/omry/reploy/pull/323#discussion_r4448554480",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/probes/remote-link-order-fail-before.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-local-review.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round01-correction-focused-results.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-local-verification.json",
        "/home/omry/.local/state/awd/reploy-FG-delivery-run_5m9b9c856cq1t51qw4qxr9hx00/F1.1.2-pr-cycle/round02-recovery01-checks-result.json",
        "https://github.com/omry/reploy/pull/323#issuecomment-6591107836"
      ],
      "id": "github-inline-4448554480",
      "invariant": "Authenticated destination path/content facts must follow Linux filesystem resolution within the image root.",
      "proposed_authorized_paths": [
        "internal/dockerdeploy/image_destination_index.go",
        "internal/dockerdeploy/image_destination_projection_test.go"
      ],
      "rationale": "Real Linux filesystem and production-reader overlay prove a/../safe is collapsed before resolving a symlink, misreporting populated /outside/safe as empty /safe. Resolve components in order with existing index and alias limit; preserve conservative refusal/cancellation.",
      "required_outcome": "Retain the physically resolved populated destination for intermediate-symlink parent traversal; no early lexical path collapse.",
      "severity": "medium",
      "source_author": "chatgpt-codex-connector[bot]",
      "source_body": "**<sub><sub>![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)</sub></sub>  Resolve symlink components before collapsing parent traversal**\n\nWhen a symlink target contains `..` after another symlink, `path.Join` collapses that traversal before the intermediate symlink is resolved, producing incorrect authenticated destination facts. For example, with `/data -> a/../safe`, `/a -> outside/sub`, an empty `/safe`, and `/outside/safe/code`, the new index reports `/data` as resolving to the empty `/safe`, whereas filesystem resolution reaches the populated `/outside/safe`. I reproduced this against the index implementation. Resolve link components in filesystem order within the image root, or reject unsupported ambiguous targets, rather than publishing an incorrect resolved path and content flag.\n\nUseful? React with 👍 / 👎.\n\n<!-- codex-code-review-finding:v1 -->",
      "source_message_id": 4448554480,
      "source_surface": "inline-review",
      "status": "resolved",
      "title": "Resolve symlink path components before parent traversal"
    }
  ],
  "pr": {
    "base_ref": "pr321",
    "base_sha": "bc776aee6f37e65d97cccdde05ffd415bdbd8197",
    "body_digest": "sha256:1515eecd9e5f07841b4dd53fcc91065d9b49d7507b578330897bb00ddc79f9b9",
    "body_identity_version": 2,
    "diff_digest": "sha256:ffcd6ae5fe95004422c72e6bfa0e2eb01a44cad02d4722016efed647aad0e84d",
    "head_ref": "pr323",
    "head_sha": "eb8a5705909e44787b4445e32c5b1648f3f56883",
    "pr": 323,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:6f278d93ec80c42f9b905f990c585c1c9db7082cd7e7c2a827e9b840582b6c14",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:f6049a45f86b96b5a7c6616926804871d77e8b86bf3305cc42d3910320fc5b76",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:328ef56c3503e9c25f01c12c61ff91c6302578ccf14d3349bc448bfa4ca29f5f"
  },
  "record_version": 7,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-11-02T22:17:05Z",
      "base_ref": "pr321",
      "base_sha": "bc776aee6f37e65d97cccdde05ffd415bdbd8197",
      "body_digest": "sha256:4981c2599bae4949e4afc936fdece91f0f73b27b337e0256de45669eaaecad0a",
      "created_at": "2026-11-02T22:27:03Z",
      "head_sha": "9e0312d4b2a4fae69074331f78f893c272aceb12",
      "id": 6590067567,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-11-02T22:17:05Z",
      "base_ref": "pr321",
      "base_sha": "bc776aee6f37e65d97cccdde05ffd415bdbd8197",
      "body_digest": "sha256:995ce45ea732783a03e4e72d0a579c579a1594b3a782efef71819f5190a01e46",
      "created_at": "2026-11-02T23:26:01Z",
      "head_sha": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "id": 6591088998,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr321",
      "base_sha": "bc776aee6f37e65d97cccdde05ffd415bdbd8197",
      "body_digest": "sha256:b1edabea32d41ccd4be7d0c8093212959e88db192237a28d93247f141df44670",
      "commit_id": "9e0312d4b2a4fae69074331f78f893c272aceb12",
      "id": 5744330500,
      "inline_message_ids": [
        4448554480
      ],
      "request_comment_id": 6590067567,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-11-02T22:28:33Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6y47Xp",
        "PRRT_kwDOTFQCkM6y5JOD"
      ]
    },
    {
      "base_ref": "pr321",
      "base_sha": "bc776aee6f37e65d97cccdde05ffd415bdbd8197",
      "body_digest": "sha256:f3d402245a1b9c2f5822b384c2b92276e96864ce759e0db84c88f097369de249",
      "commit_id": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "id": 6591107836,
      "inline_message_ids": [],
      "request_comment_id": 6591088998,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-11-02T23:27:10Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:92161e1bc90aad336e98f24a94dcb22be99d38a9c5dadcf3532808d3a0649a77",
  "rounds": [
    {
      "applied_fix_paths": [
        "internal/dockerdeploy/controlled_session_supervisor_test.go",
        "internal/dockerdeploy/image_destination_index.go",
        "internal/dockerdeploy/image_destination_projection_test.go",
        "internal/providers/python/interpreter_inspection_test.go"
      ],
      "disposition_changes": [
        "github-inline-4448554480",
        "github-inline-4448461766",
        "check-F112-pip263-manylinux-cache",
        "check-F112-controller-ready-fixture"
      ],
      "effective_diff_digest": "sha256:ffcd6ae5fe95004422c72e6bfa0e2eb01a44cad02d4722016efed647aad0e84d",
      "finding_ids": [
        "github-inline-4448554480",
        "github-inline-4448461766",
        "check-F112-pip263-manylinux-cache",
        "check-F112-controller-ready-fixture"
      ],
      "invariants": [
        "Authenticated destination path/content facts must follow Linux filesystem resolution within the image root.",
        "Ordinary file removal in bounded image preparation should reuse the existing exact map rather than scan every unrelated image node.",
        "The full test suite must exercise every selected-pip policy-hook case independently, without stale synthetic module state.",
        "Allowed controller requests begin after EventReadyV1; pre-ready refusal must remain tested and enforced."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/dockerdeploy/controlled_session_supervisor_test.go",
        "internal/dockerdeploy/image_destination_index.go",
        "internal/dockerdeploy/image_destination_projection_test.go",
        "internal/providers/python/interpreter_inspection_test.go"
      ],
      "resulting_head": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "review_observation_id": null,
      "review_request_id": 6590067567,
      "review_result_id": 5744330500,
      "reviewed_head": "9e0312d4b2a4fae69074331f78f893c272aceb12",
      "root_cause": "The image resolver collapsed parent traversal before resolving intermediate aliases. Leaf removal scanned unrelated nodes unnecessarily. Separately, pip26.3 caches a synthetic module between test cases, and a positive controller fixture sent allowed requests before ready. These received bounded production/test truth fixes after actual enforced growth checkpoints, complete repository validation and local review; the corrected exact head still requires fresh remote review and every ci.yml check.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        "github-inline-4448554480",
        "github-inline-4448461766",
        "check-F112-pip263-manylinux-cache",
        "check-F112-controller-ready-fixture"
      ],
      "effective_diff_digest": "sha256:ffcd6ae5fe95004422c72e6bfa0e2eb01a44cad02d4722016efed647aad0e84d",
      "finding_ids": [],
      "invariants": [
        "Authenticated destination path/content facts must follow Linux filesystem resolution within the image root.",
        "Ordinary file removal in bounded image preparation should reuse the existing exact map rather than scan every unrelated image node.",
        "The full test suite must exercise every selected-pip policy-hook case independently, without stale synthetic module state.",
        "Allowed controller requests begin after EventReadyV1; pre-ready refusal must remain tested and enforced."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "review_observation_id": null,
      "review_request_id": 6591088998,
      "review_result_id": 6591107836,
      "reviewed_head": "eb8a5705909e44787b4445e32c5b1648f3f56883",
      "root_cause": "No new defect or source change in round2. The earlier symlink-order, leaf-removal and two fixture defects have truth fixes, completed focused and full local evidence, fresh exact-head clean review and all9 successful CI contexts. Existing design and authority remain unchanged.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review November 2, 2026 22:24
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-02T23:27:11.651568Z eb8a570 Manual request
🔒 Security Review ✅ Completed 2026-11-02T22:27:42.927131Z 9e0312d Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Nov 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: 9e0312d

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Nov 2, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e0312d4b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/dockerdeploy/image_destination_index.go Resolved
@omry
F1.1.2: Bind image-destination projection to the generation
eb8a570 
Collect bounded mount-destination facts in the same verified immutable-image stream as identity evidence. Bind literal/resolved targets, content/type, platform, root policy and exact mount selection to the existing canonical build lock and generation digest. Reject missing, stale or malformed mapped evidence during publication, loading and reuse; preserve ordinary omitted-field identity and read-only file-bind compatibility.

Retain layered whiteout, alias, resource-limit and cancellation controls without extraction, a second store or per-launch export. Public mapped execution remains guarded pending host observation and launch qualification.

Validation: all 13 local repository commands passed on the exact corrected candidate, including complete Go inventory, build, ordinary CLI smoke/cleanup, distributions and website. Full current-agent review and a distinct fresh independent Sol review are clean. The established single WSL tmpfs exclusion and local Go timeout remain explicit; exact-head remote review and every ci.yml job are required before PR approval.
@gitar-bot

gitar-bot Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · The layered-image destination projection and lock binding could misclassify mount contents, rejecting valid builds or permitting unsafe mapped-mount reuse.

Binds image-destination mount facts to the verified immutable-image stream and existing build lock and generation digest, so missing, stale or malformed mapped evidence is rejected during publication, loading and reuse. The whiteout O(whiteouts × nodes) scan is resolved: absent and non-directory paths now use direct map deletion after cancellation checking, while directory and opaque deletions keep the cancellable subtree scan. No open findings remain.

✅ 1 closed
✅ Performance: Each whiteout scans the whole destination index: O(whiteouts × nodes)

📄 internal/dockerdeploy/image_destination_index.go:50-60 📄 internal/dockerdeploy/image_destination_index.go:77-85 📄 internal/dockerdeploy/image_destination_index.go:99-103 📄 internal/dockerdeploy/image_destination_index.go:164-171
imageDestinationIndexV1.remove walks every entry in the map, and checks ctx.Err() on each one, every time it handles a whiteout. That includes a single-file .wh.name marker, which can only delete one exact path plus that path's children. apply calls remove once for every whiteout, and again whenever an entry replaces a non-directory. Nodes come from one shared budget of up to 1M, so a layered image with thousands of whiteouts over a large lower tree costs billions of map iterations. One example is a layer that uninstalls many packages file by file. This runs inside build completion, before publication. destination also does a full map scan for every mount. Suggested fix: when the target path is not a directory, delete it directly with delete(index, name) and skip the scan. Only scan the subtree when the removed node was a directory. Better still, keep a parent-to-children index so subtree removal and content checks only cost the size of the subtree.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Nov 2, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Exact head: eb8a570

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 2, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: eb8a570590

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved PR reviewed and approved label Nov 3, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved PR reviewed and approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry