fix(security): harden audit pseudonymization and refresh Netty evidence - #270
fix(security): harden audit pseudonymization and refresh Netty evidence#270seonghobae wants to merge 99 commits into
Conversation
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
📝 WalkthroughWalkthrough이번 변경은 정확한 커밋 검증, Maven 품질 게이트, Netty SBOM 일치성, 감사 식별자 가명화, 입력값 보호, 저장소 경계 테스트를 추가하고 관련 문서와 설정을 갱신합니다. Changes검증 게이트와 의존성 증거
감사 가명화와 경계 보호
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant CIWorkflow
participant MavenVerify
participant JaCoCo
participant Javadoc
PullRequest->>CIWorkflow: PR head SHA 전달
CIWorkflow->>CIWorkflow: checkout SHA 검증
CIWorkflow->>MavenVerify: verify 실행
MavenVerify->>JaCoCo: coverage gate 실행
MavenVerify->>Javadoc: public API 문서 gate 실행
JaCoCo-->>CIWorkflow: coverage 결과 반환
Javadoc-->>CIWorkflow: 문서 검증 결과 반환
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='c1239e20b048a582b19cb9eeb90f2c29f7c8f814'
printf '%s\n' '== Exact commit and PR state =='
git cat-file -t "$head"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
git diff --name-status "${head}^" "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,app:.app.slug}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '%s\n' '== Changed CI scope and workflow test =='
ast-grep outline scripts/test_ci_workflow_stack_coverage.py --items all --view expanded
git diff --unified=100 "${head}^" "$head" -- \
.github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
sed -n '1,320p' scripts/test_ci_workflow_stack_coverage.py
rg -n -C 12 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|verify_maven_test_reports|mvn -B --no-transfer-progress verify|actions/checkout|persist-credentials|permissions:|contents:\s*write|pull-requests:\s*write|git push|gh (pr|api|issue))' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Download authorization and audit-key implementation =='
for path in \
src/main/java/com/clearfolio/viewer/auth/TenantPermissions.java \
src/main/java/com/clearfolio/viewer/controller/ConversionController.java \
src/test/java/com/clearfolio/viewer/controller/ConversionDownloadAuthorizationTest.java \
src/main/java/com/clearfolio/viewer/security/AuditKeySeparationGuard.java \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java \
src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java \
src/main/resources/application.yml
do
printf '\n===== %s =====\n' "$path"
ast-grep outline "$path" --items all --view expanded || true
rg -n -C 24 \
'(downloadArtifact|ARTIFACT_READ|JOB_READ|artifactStore\.getPdf|conversionService\.getJob|requireSameTenant|HmacSHA256|AuditKeySeparationGuard\.validate|approverFingerprint|tokenFingerprint|configtree)' \
"$path" || true
done
printf '%s\n' '== Maven evidence gate and build enforcement =='
sed -n '1,320p' scripts/verify_maven_test_reports.py
rg -n -C 9 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
p = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
bom = json.loads(p.read_text(encoding="utf-8"))
components = bom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
entries = bom["dependencies"]
sources = {e["ref"] for e in entries}
targets = {target for e in entries for target in e.get("dependsOn", [])}
metadata_ref = bom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_component_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purl_ref_version_coherent=", all(
c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_dependency_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in p.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(byte-for-byte|render_third_party_attribution|read_bytes|sha256)' \
scripts/test_render_third_party_attribution.pyLength of output: 76716
I found no actionable source-level blocker in the inspected scope.
I do not submit GitHub reports
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
base='f3cc09a9838f0f88c81a2ceae22138fab80a2edb'
merge='0f1817b60f0fb0e0e6d595c4724d2a586c1ec722'
printf '%s\n' '== Commit identity, ancestry, and requested delta =='
git cat-file -t "$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git cat-file -t "$merge" || true
git diff --name-status "${head}^" "$head"
git diff --unified=100 "${head}^" "$head" -- \
scripts/test_ci_workflow_stack_coverage.py \
.github/workflows/ci.yml \
CHANGELOG.md \
docs/engineering/acceptance-criteria.md
printf '%s\n' '== CI stack test implementation and discovery references =='
ast-grep outline scripts/test_ci_workflow_stack_coverage.py --items all --view expanded
sed -n '1,360p' scripts/test_ci_workflow_stack_coverage.py | nl -ba
rg -n -C 8 --glob '*.py' --glob 'pyproject.toml' --glob 'pytest.ini' --glob 'setup.cfg' \
'(test_ci_workflow_stack_coverage|unittest|pytest|discover)' \
scripts README.md AGENTS.md 2>/dev/null || true
printf '%s\n' '== Exact-head and synthetic-merge workflow controls =='
rg -n -C 12 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|actions/checkout|persist-credentials|permissions:|mvn -B --no-transfer-progress verify|verify_maven_test_reports|python3 -m unittest discover|python -m pytest)' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Tenant authorization and audit pseudonymization =='
rg -n -C 18 --glob '*.java' \
'(downloadArtifact|ARTIFACT_READ|JOB_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf|AuditKeySeparationGuard\.validate|HmacSHA256|approverFingerprint|tokenFingerprint)' \
src/main/java src/test/java
printf '%s\n' '== Maven gates, Netty, report parser, and write-scope scan =='
rg -n -C 8 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
rg -n -C 7 \
'(MAX|16 \* 1024|UTF-8|DOCTYPE|ENTITY|NUL|tests|skipped|failures|errors)' \
scripts/verify_maven_test_reports.py
rg -n -C 4 \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git push|gh (pr|api|issue)|curl .*(-X|--request) *(POST|PUT|PATCH|DELETE))' \
.github/workflows || true
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
sbom_path = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
sbom = json.loads(sbom_path.read_text(encoding="utf-8"))
components = sbom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
sources = {d["ref"] for d in sbom["dependencies"]}
targets = {x for d in sbom["dependencies"] for x in d.get("dependsOn", [])}
metadata_ref = sbom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purls_refs_coherent=", all(c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in sbom_path.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(byte-for-byte|render_third_party_attribution|read_bytes|write_bytes|assertEqual)' \
scripts/test_render_third_party_attribution.py
printf '%s\n' '== Exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,app:.app.slug}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,app:.app.slug,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 8289 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
printf '%s\n' '== CI stack test and discovery =='
sed -n '1,220p' scripts/test_ci_workflow_stack_coverage.py
rg -n -C 6 --glob '*.py' --glob 'pyproject.toml' --glob 'pytest.ini' --glob 'setup.cfg' \
'(test_ci_workflow_stack_coverage|unittest|pytest|discover)' \
scripts README.md AGENTS.md 2>/dev/null || true
printf '%s\n' '== Exact-head and synthetic-merge workflow controls =='
rg -n -C 12 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|actions/checkout|persist-credentials|permissions:|mvn -B --no-transfer-progress verify|verify_maven_test_reports|python3 -m unittest discover|python -m pytest)' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Tenant authorization and audit pseudonymization =='
rg -n -C 18 --glob '*.java' \
'(downloadArtifact|ARTIFACT_READ|JOB_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf|AuditKeySeparationGuard\.validate|HmacSHA256|approverFingerprint|tokenFingerprint)' \
src/main/java src/test/java
printf '%s\n' '== Maven gates, report parser, and workflow write-scope scan =='
rg -n -C 8 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
sed -n '1,280p' scripts/verify_maven_test_reports.py
rg -n -C 4 \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git push|gh (pr|api|issue)|curl .*(-X|--request) *(POST|PUT|PATCH|DELETE))' \
.github/workflows || true
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
sbom_path = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
sbom = json.loads(sbom_path.read_text(encoding="utf-8"))
components = sbom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
sources = {d["ref"] for d in sbom["dependencies"]}
targets = {x for d in sbom["dependencies"] for x in d.get("dependsOn", [])}
metadata_ref = sbom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purls_refs_coherent=", all(c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in sbom_path.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(byte-for-byte|render_third_party_attribution|read_bytes|write_bytes|assertEqual)' \
scripts/test_render_third_party_attribution.py
printf '%s\n' '== Exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,app:.app.slug}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,app:.app.slug,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 204362 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== CI coverage test and workflow contract =='
sed -n '1,100p' scripts/test_ci_workflow_stack_coverage.py
rg -n -C 8 \
'(pull_request:|merge_group:|name: Maven test|name: Maven merge compatibility|name: Buyer-readiness script tests|github\.event\.pull_request\.head\.sha|ref:|EXPECTED_SHA|persist-credentials|permissions:|verify_maven_test_reports)' \
.github/workflows/ci.yml
printf '%s\n' '== Direct-download authorization order =='
rg -n -C 25 \
'(downloadArtifact\s*\(|TenantPermissions\.ARTIFACT_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf)' \
src/main/java/com/clearfolio/viewer/controller/ConversionController.java
rg -n -C 12 \
'(downloadRejectsMissingTenantClaims|downloadRejectsJobReadWithoutArtifactRead|downloadConcealsCrossTenantJob|downloadReturnsOwnedSucceededArtifact|verifyNoInteractions|never\(\)\.getPdf)' \
src/test/java/com/clearfolio/viewer/controller/ConversionDownloadAuthorizationTest.java
printf '%s\n' '== Audit key and pseudonym contract =='
rg -n -C 14 \
'(MINIMUM|requireStrong|requireAudit|requireDistinct|validate\(|MessageDigest\.isEqual)' \
src/main/java/com/clearfolio/viewer/security/AuditKeySeparationGuard.java
rg -n -C 12 \
'(HmacSHA256|DOMAIN|fingerprint|keyVersion|Mac\.getInstance)' \
src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java
rg -n -C 12 \
'(AuditKeySeparationGuard\.validate|approverFingerprint|tokenFingerprint|LOGGER|logger\.)' \
src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java
printf '%s\n' '== Config-tree and attribution assertions =='
sed -n '1,100p' src/main/resources/application.yml
rg -n -C 6 \
'(render_markdown\(sbom\)|actual_attribution|Netty dependency edge|4\.1\.135\.Final)' \
scripts/test_render_third_party_attribution.pyLength of output: 38851
I found no actionable source-level blocker.
The CI controls remain present.
The authorization and privacy controls remain consistent.
The evidence gates remain consistent.
I do not submit At inspection time, the exact-head Maven, merge-compatibility, buyer-readiness, security, Semgrep, fuzz, and other checks were queued or in progress. GitHub reported You are interacting with an AI system. |
Pull request was converted to draft
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
@coderabbitai review |
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
base='f3cc09a9838f0f88c81a2ceae22138fab80a2edb'
printf '%s\n' '== Exact commit and PR state =='
git cat-file -t "$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git diff --name-status "${head}^" "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,status,conclusion,app:.app.slug}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,app:.app.slug,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '%s\n' '== Delta and CI test discovery =='
git diff --unified=100 "${head}^" "$head" -- \
scripts/test_ci_workflow_stack_coverage.py \
.github/workflows/ci.yml
ast-grep outline scripts/test_ci_workflow_stack_coverage.py --items all --view expanded
sed -n '1,260p' scripts/test_ci_workflow_stack_coverage.py | nl -ba
rg -n -C 10 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|actions/checkout|persist-credentials|permissions:|mvn -B --no-transfer-progress verify|verify_maven_test_reports|unittest discover|pytest)' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Authorization, audit, Maven, and workflow controls =='
rg -n -C 16 --glob '*.java' \
'(downloadArtifact|ARTIFACT_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf|AuditKeySeparationGuard\.validate|HmacSHA256|approverFingerprint|tokenFingerprint)' \
src/main/java src/test/java
rg -n -C 8 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
sed -n '1,280p' scripts/verify_maven_test_reports.py
rg -n -C 4 \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git push|gh (pr|api|issue)|curl .*(-X|--request) *(POST|PUT|PATCH|DELETE))' \
.github/workflows || true
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
p = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
bom = json.loads(p.read_text(encoding="utf-8"))
components = bom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
sources = {d["ref"] for d in bom["dependencies"]}
targets = {target for d in bom["dependencies"] for target in d.get("dependsOn", [])}
metadata_ref = bom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_component_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purl_ref_version_coherent=", all(
c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in p.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(render_markdown\(sbom\)|read_bytes|byte-for-byte|assertEqual|actual_attribution)' \
scripts/test_render_third_party_attribution.pyLength of output: 27527 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
printf '%s\n' '== Current exact-head non-success checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | {name,status,conclusion,app:.app.slug,details_url,started_at,completed_at}]'
printf '%s\n' '== Current exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '[.workflow_runs[] | {id,name,event,status,conclusion,head_sha,run_attempt,created_at,updated_at,html_url}] | sort_by(.created_at)'
printf '%s\n' '== CI discovery test and workflow semantics =='
sed -n '1,220p' scripts/test_ci_workflow_stack_coverage.py
rg -n -C 12 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|actions/checkout|persist-credentials|permissions:|mvn -B --no-transfer-progress verify|verify_maven_test_reports|unittest discover|pytest)' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Tenant authorization and audit controls =='
rg -n -C 16 --glob '*.java' \
'(downloadArtifact|ARTIFACT_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf|AuditKeySeparationGuard\.validate|HmacSHA256|approverFingerprint|tokenFingerprint)' \
src/main/java src/test/java
sed -n '1,260p' src/main/java/com/clearfolio/viewer/security/AuditKeySeparationGuard.java
sed -n '1,280p' src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java
sed -n '1,340p' src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.java
printf '%s\n' '== Maven and workflow enforcement =='
sed -n '1,300p' scripts/verify_maven_test_reports.py
rg -n -C 8 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
rg -n -C 4 \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git push|gh (pr|api|issue)|curl .*(-X|--request) *(POST|PUT|PATCH|DELETE))' \
.github/workflows || true
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
p = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
bom = json.loads(p.read_text(encoding="utf-8"))
components = bom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
sources = {d["ref"] for d in bom["dependencies"]}
targets = {target for d in bom["dependencies"] for target in d.get("dependsOn", [])}
metadata_ref = bom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_component_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purl_ref_version_coherent=", all(
c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in p.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(render_markdown\(sbom\)|read_bytes|byte-for-byte|assertEqual|actual_attribution)' \
scripts/test_render_third_party_attribution.pyLength of output: 204005 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
printf '%s\n' '== Active exact-head checks =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed") | {name,status,conclusion,app:.app.slug,details_url,started_at}]'
printf '%s\n' '== User-identified exact-head workflow runs =='
for run in 31146875930 31146875953 31146875908 31146875907; do
gh api "repos/$repo/actions/runs/$run" \
--jq '{id,name,event,status,conclusion,head_sha,run_attempt,created_at,updated_at,html_url}'
done
printf '%s\n' '== Netty PURL and dependency coherence =='
python3 - <<'PY'
import json
from pathlib import Path
path = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
bom = json.loads(path.read_text(encoding="utf-8"))
netty = [c for c in bom["components"] if c.get("group") == "io.netty"]
refs = {c["bom-ref"] for c in netty}
edge_refs = {
ref
for dependency in bom["dependencies"]
for ref in [dependency.get("ref"), *dependency.get("dependsOn", [])]
if isinstance(ref, str) and ref.startswith("pkg:maven/io.netty/")
}
expected = "4.1.136.Final"
print("count=", len(netty))
print("versions=", sorted({c.get("version") for c in netty}))
print("purl_equals_bom_ref=", all(c.get("purl") == c.get("bom-ref") for c in netty))
print("purl_has_expected_version=", all(f"@{expected}" in c.get("purl", "") for c in netty))
print("netty_edge_refs_equal_component_refs=", edge_refs == refs)
for component in netty:
print(component["purl"], component["bom-ref"])
PY
printf '%s\n' '== Repository attribution and Netty validation test =='
sed -n '100,200p' scripts/test_render_third_party_attribution.py
printf '%s\n' '== Current PR merge and review state =='
gh pr view 270 --repo "$repo" \
--json headRefOid,mergeStateStatus,reviewDecision,reviews \
--jq '{headRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'Length of output: 10327
I found no actionable source-level finding.
The security controls remain correct.
The evidence controls remain correct.
The named exact-head workflow runs completed successfully:
However, the current exact-head I do not submit You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
printf '%s\n' '== Exact PR and check state =='
git cat-file -t "$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '%s\n' '== Requested-head delta and CI discovery test =='
git diff --name-status "${head}^" "$head"
ast-grep outline scripts/test_ci_workflow_stack_coverage.py --items all --view expanded
sed -n '1,240p' scripts/test_ci_workflow_stack_coverage.py
rg -n -C 10 \
'(pull_request:|merge_group:|pull_request\.head\.sha|github\.sha|actions/checkout|persist-credentials|permissions:|mvn -B --no-transfer-progress verify|verify_maven_test_reports|unittest discover|pytest)' \
.github/workflows/ci.yml .github/workflows/fuzz.yml
printf '%s\n' '== Artifact authorization and audit controls =='
rg -n -C 22 --glob '*.java' \
'(downloadArtifact|ARTIFACT_READ|conversionService\.getJob|requireSameTenant|artifactStore\.getPdf|AuditKeySeparationGuard\.validate|HmacSHA256|approverFingerprint|tokenFingerprint)' \
src/main/java src/test/java
sed -n '1,260p' src/main/java/com/clearfolio/viewer/security/AuditKeySeparationGuard.java
sed -n '1,280p' src/main/java/com/clearfolio/viewer/security/AuditPseudonymizer.java
sed -n '1,280p' scripts/verify_maven_test_reports.py
printf '%s\n' '== Build and workflow enforcement =='
rg -n -C 8 \
'(netty.version|4\.1\.136\.Final|jacoco-maven-plugin|MISSEDCOUNT|maven-javadoc-plugin|doclint|failOnWarnings|failOnError)' \
pom.xml
rg -n -C 4 \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git push|gh (pr|api|issue)|curl .*(-X|--request) *(POST|PUT|PATCH|DELETE))' \
.github/workflows || true
printf '%s\n' '== SBOM and attribution invariants =='
python3 - <<'PY'
import json
from pathlib import Path
path = Path("docs/qa/evidence/2026-07-02-krw2b-sale-readiness/sbom-cyclonedx.json")
bom = json.loads(path.read_text(encoding="utf-8"))
components = bom["components"]
refs = {c["bom-ref"] for c in components}
netty = [c for c in components if c.get("group") == "io.netty"]
netty_refs = {c["bom-ref"] for c in netty}
sources = {d["ref"] for d in bom["dependencies"]}
targets = {t for d in bom["dependencies"] for t in d.get("dependsOn", [])}
metadata_ref = bom["metadata"]["component"].get("bom-ref")
print("component_count=", len(components))
print("netty_component_count=", len(netty))
print("netty_versions=", sorted({c["version"] for c in netty}))
print("netty_purl_ref_version_coherent=", all(
c["purl"] == c["bom-ref"] and "`@4.1.136.Final`" in c["purl"] for c in netty))
print("netty_edges_complete=", netty_refs <= sources and netty_refs <= targets)
print("only_metadata_non_component_refs=", (sources - refs | targets - refs) <= {metadata_ref})
print("legacy_netty_present=", "4.1.135.Final" in path.read_text(encoding="utf-8"))
PY
rg -n -C 8 \
'(render_markdown\(sbom\)|read_bytes|byte-for-byte|assertEqual|actual_attribution)' \
scripts/test_render_third_party_attribution.pyLength of output: 204347 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
pr='270'
head='ed3863209109cd24a3cf1f1d6bdcd51db16fbef1'
printf '%s\n' '== Exact current GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,mergeStateStatus,reviewDecision,reviews \
--jq '{headRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '%s\n' '== CI discovery regression test =='
cat -n scripts/test_ci_workflow_stack_coverage.py
printf '%s\n' '== CI trigger and revision controls =='
sed -n '1,260p' .github/workflows/ci.yml | nl -ba
sed -n '1,180p' .github/workflows/fuzz.yml | nl -ba
printf '%s\n' '== Direct-download authorization regressions =='
rg -n -C 14 --glob 'ConversionDownloadAuthorizationTest.java' \
'(downloadRejects|downloadConceals|downloadReturns|verifyNoInteractions|verify\(.*getPdf|ARTIFACT_READ|JOB_READ)' \
src/test/java
printf '%s\n' '== Raw override identifiers in production log calls =='
rg -n -P -C 5 --glob '*.java' \
'(LOGGER|logger|LOG)\.(trace|debug|info|warn|error)\s*\(' \
src/main/java/com/clearfolio/viewer/service/DefaultDocumentValidationService.javaLength of output: 10957
I found no actionable source-level blocker.
The named exact-head CI, merge-compatibility, buyer-readiness, security, Semgrep, fuzz, and Strix checks are successful. The PR has zero unresolved review threads. I did not count skipped, cancelled, failed, or predecessor results as passing evidence. I do not submit You are interacting with an AI system. |
2 participants
Objective
Authoritative buyer-readiness parent for privacy-safe audit evidence, coordinated dependency remediation, deterministic SBOM/attribution evidence, fail-closed exact-head CI, zero-missed production coverage, warning-free public Javadocs, fail-closed test evidence, and tenant-safe document access.
Exact current head:
ed3863209109cd24a3cf1f1d6bdcd51db16fbef1.This PR supersedes closed-unmerged #165, #222, #257, #267, and #269. It remains the authoritative parent of #264, #268, #271, #276, and replacement availability PR #295 (which supersedes closed-unmerged #265 only as a review container). Maintenance PRs #286–#290 reconcile the current parent into downstream slices; predecessor-head checks, comments, reviews, approvals, and synthetic-merge results do not transfer.
Security, privacy, and acceptance contract
4.1.136.Final.python3 -m unittest discover -s scriptscommand and CI's pytest invocation.verifyenforces zero missed production lines and branches plus warning-free public Java 21 Javadocs.testsuiteexplicitly supplies non-negativetests,skipped,failures, anderrorscounts. XML evidence is bounded, strict UTF-8, DTD/entity-free, and fails closed.artifact:readpermission and same-tenant ownership.job:readalone never authorizes document bytes; cross-tenant UUID access is concealed as404.Test-first remediation
Strix found a valid cross-tenant IDOR on predecessor head
26563218ae42eaa876c784fcf56b27f8cb810080. RED regressions established missing-claim, missing-permission, cross-tenant, owned-success, and least-privilegeartifact:readboundaries before production remediation.CodeRabbit correctly identified that successful Maven execution alone did not reject disabled, skipped, or zero-executed tests. The implementation added strict bounded Surefire/Failsafe report validation and retained JaCoCo diagnostics.
A later evidence audit found that CI was restricted to pull requests targeting
main, leaving stacked PR exact heads without the same acceptance gate. This branch changes CI topull_request: {}while preserving exact-head checkout, synthetic-merge verification, least-privilege permissions, immutable action pins, and buyer-readiness tests. Until #270 itself is merged, the protected default branch still containspull_request.branches: [main]; therefore child PRs targeting this stacked base do not yet have usable exact-head Actions evidence and must remain unmerged. No child check is inferred from this branch-local workflow change.CodeRabbit then correctly found that the initial regression used top-level pytest functions and therefore was not executed by the repository's canonical standard-library discovery command. Exact head
ed3863209109cd24a3cf1f1d6bdcd51db16fbef1converts the regression to a documentedunittest.TestCasewith standard assertion methods while retaining pytest compatibility.Exact-head acceptance state
All successful evidence for predecessor heads is stale and non-transferable. For exact current head
ed3863209109cd24a3cf1f1d6bdcd51db16fbef1:31146875930is complete and successful.92767994350checked out and asserted the exact SHA, used Java 21, ranmvn -B --no-transfer-progress verify, executed 476 tests with 0 failures, errors, or skips, analyzed 59 production classes with zero missed production lines and branches, generated warning-free public Javadocs, and recordedsurefire: tests=476 skipped=0.92767994322is successful.92767994236is successful.31146875953is complete and successful.31146875908is complete and successful.31146875907is complete and successful.31119467438(Security Scan) and31119467763(CI) remain queued, but are superseded duplicate attempts of workflows that have newer successful same-head runs. They are not used as passing evidence and do not invalidate the newer exact-head successes.Remaining merge gate
Do not merge until formal current-head external review evidence remains free of unresolved actionable findings, a repository-write-authorized independent reviewer submits a counted approval, and every branch-protection and repository-policy rule is satisfied expected-head safely. Do not weaken tests, bypass protection, infer approval from successful checks or bot comments, or publish a release before integrated release acceptance succeeds.