chore(stack): reconcile artifact-token hardening with #270 - #288
Merged
seonghobae merged 3 commits intoAug 6, 2026
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review maintenance PR #288 at exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="2942f7608a1ed7131cf7a31e933f35a32abec874"
echo "== PR metadata =="
gh pr view "$pr" --repo "$repo" --json number,title,state,headRefOid,baseRefOid,mergeCommit,commits,files,statusCheckRollup \
--jq '{number,title,state,headRefOid,baseRefOid,mergeCommit, commits:[.commits[]|{oid:.oid,messageHeadline:.messageHeadline}], files:[.files[]|{path:.path,additions:.additions,deletions:.deletions}], checks:[.statusCheckRollup[]|{name:.name,status:.status,conclusion:.conclusion}]}'
echo "== Verify requested objects =="
for oid in "$head" "$base" "$merge"; do
printf '%s: ' "$oid"
git cat-file -t "$oid" 2>&1 || true
git show -s --format='%H%nparents: %P%nsubject: %s%n' "$oid" 2>&1 || true
done
echo "== Exact base-to-head diff summary =="
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
echo "== Base-to-synthetic-merge diff summary =="
git diff --stat "$base" "$merge"
git diff --name-status "$base" "$merge"
echo "== Parent restoration commits and changed paths =="
git log --oneline --decorate "$base..$head"
git diff --name-status "$head^" "$head" 2>/dev/null || true
echo "== Locate relevant source, test, evidence, changelog, and workflow files =="
fd -HI -t f -E .git | rg '(^|/)(CHANGELOG|changelog)|(\.github/workflows/)|(?i)(token|artifact|evidence|buyer|coverage|javadoc|stack)'Length of output: 15798 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="2942f7608a1ed7131cf7a31e933f35a32abec874"
echo "== Parent restoration patch =="
git diff --find-renames "$head^" "$head" -- .github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
echo "== Workflow at base and synthetic merge =="
git show "$base:.github/workflows/ci.yml" | nl -ba
echo "---- synthetic merge ----"
git show "$merge:.github/workflows/ci.yml" | nl -ba
echo "== Stack workflow contract test at synthetic merge =="
git show "$merge:scripts/test_ci_workflow_stack_coverage.py" | nl -ba
echo "== Signed-token preservation at synthetic merge =="
for path in \
"src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java" \
"scripts/test_artifact_token_parser_evidence.py" \
"CHANGELOG.md" \
"src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java" \
"src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java"; do
echo "---- $path ----"
git show "$merge:$path" | rg -n -C 4 -i 'whitespace|blank|required.claim|signed|evidence|token|claim' || true
done
echo "== Compare preservation files: base vs synthetic merge =="
git diff --exit-code "$base" "$merge" -- \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
|| true
echo "== Current check details =="
gh pr checks "$pr" --repo "$repo" --json name,state,link,workflow,bucket --jq '.[] | select(.name == "strix")'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {name,status,conclusion,details_url,output}'Length of output: 2827 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="2942f7608a1ed7131cf7a31e933f35a32abec874"
numbered_show() {
local revision_path="$1"
git show "$revision_path" | awk '{printf "%6d %s\n", NR, $0}'
}
echo "== Workflow at synthetic merge =="
numbered_show "$merge:.github/workflows/ci.yml"
echo "== Stack workflow contract test at synthetic merge =="
numbered_show "$merge:scripts/test_ci_workflow_stack_coverage.py"
echo "== Signed whitespace-only regression and evidence contract =="
for path in \
"src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java" \
"scripts/test_artifact_token_parser_evidence.py" \
"CHANGELOG.md"; do
echo "---- $path ----"
git show "$merge:$path" | awk '{printf "%6d %s\n", NR, $0}' \
| rg -n -C 8 -i 'whitespace|blank|required.claim|signed|evidence|claim'
done
echo "== Exact preservation comparison: base vs synthetic merge =="
git diff --name-status "$base" "$merge" -- \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo "== All CI job names and conditions at synthetic merge =="
git show "$merge:.github/workflows/ci.yml" \
| awk '/^[[:space:]]{2}[A-Za-z0-9_-]+:$/ || /^[[:space:]]+if:|^[[:space:]]+needs:|^[[:space:]]+uses:|^[[:space:]]+run:/{printf "%6d %s\n", NR, $0}'
echo "== Failed strix check details =="
gh pr checks "$pr" --repo "$repo" --json name,state,link,workflow,bucket \
--jq '.[] | select(.name == "strix")'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {name,status,conclusion,details_url,output}'Length of output: 23588 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="c1239e20b048a582b19cb9eeb90f2c29f7c8f814"
check_run_id="92617632481"
echo "== Strix annotation =="
gh api "repos/$repo/check-runs/$check_run_id/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title,raw_details}'
echo "== Relevant check runs at the declared head =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[]
| select(.name == "Maven test"
or .name == "Maven merge compatibility"
or .name == "Buyer-readiness script tests"
or (.name | startswith("fuzz "))
or .name == "coverage-evidence"
or .name == "coverage-source-tree"
or .name == "strix")
| {name,head_sha,status,conclusion,details_url}'
echo "== Fuzz workflow trigger and exact-head checkout definitions =="
git show "$head:.github/workflows/fuzz.yml" \
| awk '{printf "%6d %s\n", NR, $0}' \
| rg -n -C 3 'pull_request|head\.sha|EXPECTED_SHA|git rev-parse HEAD|ArtifactTokenParserFuzzTest'Length of output: 8294 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
run_id="31101999121"
job_id="92617632481"
echo "== Strix workflow run metadata =="
gh api "repos/$repo/actions/runs/$run_id" \
--jq '{id,event,status,conclusion,head_sha,head_branch,run_started_at,updated_at,html_url,name,workflow_id}'
echo "== Strix job metadata and failed steps =="
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{id,name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|select(.conclusion == "failure" or .status != "completed")|{number,name,status,conclusion}]}'
echo "== Strix failed job log =="
gh run view "$run_id" --repo "$repo" --job "$job_id" --log-failed 2>&1 \
| tail -n 240Length of output: 2037 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
for run_id in \
31109486742 \
31109284477 \
31101997681 \
31102000067 \
31101999462 \
31118927355 \
31118935332 \
31119013092; do
echo "== workflow run $run_id =="
gh api "repos/$repo/actions/runs/$run_id" \
--jq '{id,name,event,status,conclusion,head_sha,head_branch,pull_requests:[.pull_requests[]|{number,url,head:{ref:.head.ref,sha:.head.sha},base:{ref:.base.ref,sha:.base.sha}}]}'
doneLength of output: 12006
I found no code-level actionable findings in PR Verified results:
This is a review only. It is not an approval. Some newer CI runs for the same head remain queued or in progress. The failed Strix run identifies PR
|
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Re-review maintenance PR #288 at exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
echo "== Pull request metadata =="
gh pr view "$pr" --repo "$repo" \
--json number,title,state,headRefOid,baseRefOid,mergeCommit,commits,files,statusCheckRollup \
--jq '{
number,title,state,headRefOid,baseRefOid,
mergeCommit:(.mergeCommit.oid // null),
commits:[.commits[]|{oid,messageHeadline}],
files:[.files[]|{path,additions,deletions}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]
}'
echo "== Declared revisions =="
for oid in "$base" "$head" "$merge"; do
echo "-- $oid --"
git cat-file -t "$oid"
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$oid"
done
echo "== Ancestry checks =="
git merge-base --is-ancestor "$base" "$head" && echo "base is ancestor of head"
git merge-base --is-ancestor "$base" "$merge" && echo "base is ancestor of synthetic merge"
git merge-base --is-ancestor "$head" "$merge" && echo "head is ancestor of synthetic merge"
echo "merge parents: $(git show -s --format='%P' "$merge")"
echo "== Exact base-to-head changes =="
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
git log --oneline "$base..$head"
echo "== Base-to-synthetic-merge changes =="
git diff --stat "$base" "$merge"
git diff --name-status "$base" "$merge"
echo "== Locate relevant files =="
fd -HI -t f -E .git | rg '(^|/)(CHANGELOG\.md|ci\.yml|fuzz\.yml|ArtifactTokenBoundaryTest\.java|ArtifactTokenClaims\.java|ArtifactLinkService\.java|test_artifact_token_parser_evidence\.py|test_ci_workflow_stack_coverage\.py)$'
echo "== Full parent-restoration comparison against synthetic merge =="
parent=$(git show -s --format='%P' "$head" | awk '{print $1}')
echo "head first parent: $parent"
git diff --stat "$parent" "$head"
git diff --name-status "$parent" "$head"
git diff --find-renames "$parent" "$head" -- .github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
echo "== Signed-token preservation changes: base to synthetic merge =="
git diff --name-status "$base" "$merge" -- \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo "== Relevant synthetic-merge content =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
.github/workflows/ci.yml \
.github/workflows/fuzz.yml \
scripts/test_ci_workflow_stack_coverage.py \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
echo "---- $path ----"
git show "$merge:$path" | nl -ba | rg -n -C 5 -i \
'whitespace|blank|required.claim|signature|signed|fail.closed|evidence|pull_request|head\.sha|expected_sha|merge compatibility|coverage|javadoc|buyer|stack|token|claim' || true
done
echo "== Check runs on declared head =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {
name,status,conclusion,head_sha,details_url,
started_at,completed_at,
app:.app.slug
}'
echo "== Workflow runs whose head SHA is declared head =="
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" --paginate \
--jq '.workflow_runs[] | {
id,name,event,status,conclusion,head_sha,head_branch,
run_started_at,updated_at,html_url,
pull_requests:[.pull_requests[]|{number,head:{sha:.head.sha},base:{sha:.base.sha}}]
}'Length of output: 45141 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
show_numbered() {
git show "$1" | awk '{printf "%6d %s\n", NR, $0}'
}
echo "== Synthetic-merge signed-token regression and evidence contract =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
echo "---- $path ----"
show_numbered "$merge:$path" | rg -n -C 8 -i \
'whitespace|blank|required.claim|signed|signature|fail.closed|evidence|token|claim' || true
done
echo "== Synthetic-merge CI and fuzz contract =="
for path in .github/workflows/ci.yml .github/workflows/fuzz.yml scripts/test_ci_workflow_stack_coverage.py; do
echo "---- $path ----"
show_numbered "$merge:$path" | rg -n -C 5 \
'pull_request|branches:|head\.sha|EXPECTED_SHA|git rev-parse HEAD|Maven test|Maven merge compatibility|Buyer-readiness|mvn verify|coverage|javadoc|fuzz|ArtifactTokenParserFuzzTest|unittest|pytest|python' || true
done
echo "== Whole-file stack workflow contract test at merge =="
show_numbered "$merge:scripts/test_ci_workflow_stack_coverage.py"
echo "== Verify base versions are preserved byte-for-byte at synthetic merge =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
if git diff --quiet "$base" "$merge" -- "$path"; then
echo "PRESERVED $path"
else
echo "CHANGED $path"
fi
done
echo "== CI run 31119467241 jobs and pull request association =="
gh api "repos/$repo/actions/runs/31119467241" \
--jq '{id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|{number,base:{sha:.base.sha},head:{sha:.head.sha}}]}'
gh api "repos/$repo/actions/runs/31119467241/jobs?per_page=100" --paginate \
--jq '.jobs[] | {id,name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
echo "== Fuzz run 31119466967 jobs and pull request association =="
gh api "repos/$repo/actions/runs/31119466967" \
--jq '{id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|{number,base:{sha:.base.sha},head:{sha:.head.sha}}]}'
gh api "repos/$repo/actions/runs/31119466967/jobs?per_page=100" --paginate \
--jq '.jobs[] | {id,name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
echo "== Failed CodeQL actions analysis annotation =="
gh api "repos/$repo/check-runs/92676777307/annotations?per_page=100" --paginate \
--jq '.[] | {path,start_line,end_line,annotation_level,title,message,raw_details}'Length of output: 56371 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
echo "== Current selected check runs at declared head =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(
.name == "Maven test"
or .name == "Maven merge compatibility"
or .name == "Buyer-readiness script tests"
or (.name | startswith("fuzz "))
)
| {name,status,conclusion,details_url,started_at,completed_at}'
echo "== Current CI run associated with pull request `#288` =="
for run_id in 31119467241 31119467763 31119468888 31119469298 31119507026 31119526136; do
gh api "repos/$repo/actions/runs/$run_id" \
--jq 'select(any(.pull_requests[]; .number == 288 and .base.sha == "801e0ab5ce81fea10d331db7ddd089244a4171f2" and .head.sha == "ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"))
| {id,name,status,conclusion,head_sha,pull_requests:[.pull_requests[]|select(.number == 288)|{number,base:{sha:.base.sha},head:{sha:.head.sha}}]}'
done
echo "== Jobs in the original current CI and fuzz runs =="
for run_id in 31119467241 31119466967; do
echo "-- run $run_id --"
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" --paginate \
--jq '.jobs[]
| select(
.name == "Maven test"
or .name == "Maven merge compatibility"
or .name == "Buyer-readiness script tests"
or (.name | startswith("fuzz "))
)
| {name,status,conclusion,started_at,completed_at}'
doneLength of output: 9293
I found no code-level actionable findings. Verified results:
Current evidence is incomplete:
This is a formal review only. It is not an approval. No predecessor result or approval was transferred. The separate counted write-authorized independent approval remains mandatory. You are interacting with an AI system. |
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
echo "== Revision identity and ancestry =="
for oid in "$base" "$head" "$merge"; do
echo "-- $oid --"
git cat-file -t "$oid"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$oid"
done
git merge-base --is-ancestor "$base" "$head" && echo "base_ancestor_of_head=true"
git merge-base --is-ancestor "$base" "$merge" && echo "base_ancestor_of_merge=true"
git merge-base --is-ancestor "$head" "$merge" && echo "head_ancestor_of_merge=true"
echo "== PR exact metadata =="
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefOid,mergeStateStatus,files \
--jq '{number,state,headRefOid,baseRefOid,mergeStateStatus,files:[.files[]|{path,additions,deletions}]}'
echo "== Exact base-to-head and base-to-merge path changes =="
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$merge"
git diff --name-status "$base" "$merge"
echo "== Head maintenance commit delta =="
parent="$(git show -s --format='%P' "$head" | awk '{print $1}')"
echo "head_first_parent=$parent"
git diff --name-status "$parent" "$head"
git diff --find-renames "$parent" "$head" -- \
.github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
echo "== Required synthetic-merge files: selected relevant lines =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
.github/workflows/ci.yml \
scripts/test_ci_workflow_stack_coverage.py; do
echo "-- $path --"
git show "$merge:$path" | nl -ba | rg -n -C 5 -i \
'whitespace|blank|required|malformed|base64|epoch|uuid|version|field.count|trailing|signature|hmac|unauthorized|evidence|pull_request|unittest|discover|head\.sha|merge compatibility|mvn verify|javadoc|coverage|buyer' || true
done
echo "== Required files are unchanged from base at synthetic merge =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
if git diff --quiet "$base" "$merge" -- "$path"; then
echo "preserved=$path"
else
echo "changed=$path"
fi
done
echo "== Current check runs on the declared head =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,head_sha,details_url,started_at,completed_at,app:.app.slug}'
echo "== Current Actions runs on the declared head associated with PR `#288` =="
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" --paginate \
--jq '.workflow_runs[]
| select(any(.pull_requests[]; .number == 288))
| {id,name,event,status,conclusion,head_sha,head_branch,
pull_requests:[.pull_requests[]|select(.number == 288)|{number,base:{sha:.base.sha},head:{sha:.head.sha}}]}'Length of output: 24196 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
run_id="31119507026"
numbered() {
git show "$1" | awk '{printf "%6d %s\n", NR, $0}'
}
echo "== Boundary tests: required deterministic rejection cases =="
numbered "$merge:src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java" \
| rg -n -C 10 \
'rejectsSignedPayloadWithAWhitespaceOnlyRequiredField|whitespace|malformed|Base64|epoch|UUID|version|trailing|delimiter|field.count|Unauthorized|UNAUTHORIZED|assertThat'
echo "== Parser evidence contract =="
numbered "$merge:scripts/test_artifact_token_parser_evidence.py" \
| rg -n -C 8 \
'ArtifactTokenBoundaryTest|whitespace|malformed|Base64|epoch|UUID|version|trailing|delimiter|evidence|assert|unittest|pytest|main'
echo "== Claims and service fail-closed logic =="
for path in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
echo "-- $path --"
numbered "$merge:$path" \
| rg -n -C 10 \
'isBlank|field|HMAC|signature|verify|parse|Unauthorized|UNAUTHORIZED|401|split|Base64|UUID|epoch|version'
done
echo "== CI workflow acceptance contract =="
numbered "$merge:.github/workflows/ci.yml" \
| rg -n -C 8 \
'pull_request|head\.sha|EXPECTED_SHA|git rev-parse HEAD|Maven test|Maven merge compatibility|Buyer-readiness script tests|mvn verify|javadoc|coverage|test_ci_workflow_stack_coverage|unittest'
echo "== Canonical unittest discovery contract test =="
numbered "$head:scripts/test_ci_workflow_stack_coverage.py"
echo "== Jobs in successful current CI run =="
gh api "repos/$repo/actions/runs/$run_id" \
--jq '{id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|{number,base:{sha:.base.sha},head:{sha:.head.sha}}]}'
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" --paginate \
--jq '.jobs[] | {name,status,conclusion,head_sha,started_at,completed_at,
failed_steps:[.steps[]|select(.conclusion == "failure")|.name]}'
echo "== Changelog evidence =="
numbered "$merge:CHANGELOG.md" | rg -n -C 4 'signed|blank|whitespace|artifact|token'Length of output: 42489
I found no code-level actionable findings. I reviewed only:
Verified results:
This is a formal review only. It is not an approval. I did not transfer a predecessor review, check, or approval. The separate counted repository-write-authorized independent approval remains required before merge. You are interacting with an AI system. |
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review maintenance PR #288 at exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
echo "== Revision identity, merge parents, and PR metadata =="
for oid in "$base" "$head" "$merge"; do
git cat-file -e "${oid}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$oid"
done
git merge-base --is-ancestor "$base" "$head" && echo "base_is_head_ancestor=true"
git merge-base --is-ancestor "$base" "$merge" && echo "base_is_merge_ancestor=true"
git merge-base --is-ancestor "$head" "$merge" && echo "head_is_merge_ancestor=true"
gh pr view "$pr" --repo "$repo" --json number,state,headRefOid,baseRefOid,mergeStateStatus \
--jq '{number,state,headRefOid,baseRefOid,mergeStateStatus}'
echo "== Base-to-merge scope and head commit scope =="
git diff --name-status "$base" "$merge"
first_parent="$(git show -s --format='%P' "$head" | awk '{print $1}')"
printf 'head_first_parent=%s\n' "$first_parent"
git diff --name-status "$first_parent" "$head"
echo "== Token hardening content at synthetic merge =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md; do
echo "-- $path --"
git show "$merge:$path" | nl -ba | rg -n -C 6 -i \
'whitespace|isBlank|field.count|trailing|delimiter|base64|epoch|uuid|version|signature|hmac|unauthorized|fail.closed|evidence|payload' || true
git diff --quiet "$base" "$merge" -- "$path" && echo "preserved_from_base=true" || echo "preserved_from_base=false"
done
echo "== CI workflow semantics, permissions, and action references at synthetic merge =="
for path in .github/workflows/ci.yml .github/workflows/fuzz.yml scripts/test_ci_workflow_stack_coverage.py; do
echo "-- $path --"
git show "$merge:$path" | nl -ba | rg -n -C 4 \
'pull_request|permissions:|contents:|actions/checkout@|head\.sha|EXPECTED_SHA|git rev-parse HEAD|Maven test|Maven merge compatibility|Buyer-readiness|mvn verify|coverage|javadoc|unittest|discover|uses:' || true
done
echo "-- non-SHA action references --"
git show "$merge:.github/workflows/ci.yml" "$merge:.github/workflows/fuzz.yml" \
| rg -n '^\s*uses:\s+' \
| rg -v '@[0-9a-fA-F]{40}(\s|$)' || true
echo "== Current checks and workflow runs for exact head, associated with PR `#288` =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,head_sha,details_url,started_at,completed_at,app:.app.slug}'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" --paginate \
--jq '.workflow_runs[]
| select(any(.pull_requests[]; .number == 288 and .head.sha == "ed3863209109cd24a3cf1f1d6bdcd51db16fbef1" and .base.sha == "801e0ab5ce81fea10d331db7ddd089244a4171f2"))
| {id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|select(.number == 288)|{number,head:.head.sha,base:.base.sha}]}'Length of output: 24506 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
numbered_show() {
git show "$1" | awk '{printf "%6d %s\n", NR, $0}'
}
echo "== Signed-token boundary regressions and evidence contract =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md; do
echo "-- $path --"
numbered_show "$merge:$path" | rg -n -C 8 -i \
'whitespace|blank|required|malformed|base64|epoch|uuid|version|field.count|trailing|delimiter|signature|unauthorized|evidence|assert'
done
echo "== Exact HMAC payload handling and fail-closed behavior =="
for path in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java; do
echo "-- $path --"
numbered_show "$merge:$path" | rg -n -C 12 -i \
'isBlank|split|field|hmac|mac\.|signature|verify|payload|constant|base64|parse|unauthorized|exception|badrequest'
done
echo "== CI contract and canonical unittest discovery =="
for path in .github/workflows/ci.yml .github/workflows/fuzz.yml scripts/test_ci_workflow_stack_coverage.py; do
echo "-- $path --"
numbered_show "$merge:$path" | rg -n -C 7 \
'pull_request|permissions:|contents:|actions/checkout@|head\.sha|EXPECTED_SHA|git rev-parse HEAD|merge compatibility|mvn verify|coverage|javadoc|buyer|unittest|discover|TestCase|main'
done
echo "== All workflow action references and permissions =="
while IFS= read -r path; do
echo "-- $path --"
git show "$merge:$path" | awk '
/^[[:space:]]*permissions:/ ||
/^[[:space:]]+[A-Za-z-]+:[[:space:]]*(read|write)/ ||
/^[[:space:]]*uses:[[:space:]]*/ { printf "%6d %s\n", NR, $0 }
'
done < <(git ls-tree -r --name-only "$merge" .github/workflows | sort)
echo "== Failed current-head merge-compatibility job details =="
gh api "repos/$repo/actions/jobs/92676783785" \
--jq '{name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
gh run view 31119467763 --repo "$repo" --job 92676783785 --log-failed 2>&1 | tail -n 180Length of output: 48561 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
echo "== Workflow permissions and unpinned action references =="
git ls-tree -r --name-only "$merge" .github/workflows | sort | while IFS= read -r path; do
echo "-- $path --"
git show "$merge:$path" | awk '
/^[[:space:]]*permissions:/ ||
/^[[:space:]]+[A-Za-z-]+:[[:space:]]*(read|write)/ ||
/^[[:space:]]*uses:[[:space:]]*/ { printf "%6d %s\n", NR, $0 }
'
done
echo "== Action references that are not full commit-SHA pins =="
git ls-tree -r --name-only "$merge" .github/workflows | sort | while IFS= read -r path; do
git show "$merge:$path" | awk -v path="$path" '
/^[[:space:]]*uses:[[:space:]]*/ {
ref=$0
if (ref !~ /@[0-9a-fA-F]{40}([[:space:]]|$)/) {
printf "%s:%d:%s\n", path, NR, ref
}
}
'
done
echo "== Failed merge-compatibility job =="
gh api "repos/$repo/actions/jobs/92676783785" \
--jq '{name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[]|{name,status,conclusion}]}'
gh run view 31119467763 --repo "$repo" --job 92676783785 --log-failed 2>&1 | tail -n 180Length of output: 5487
I found no code-level actionable findings. I reviewed only these revisions:
Verified results:
This is a formal review only. It is not an approval. I did not transfer predecessor reviews, checks, or approvals. The separate counted repository-write-authorized independent approval remains required before merge. You are interacting with an AI system. |
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Review this maintenance PR at exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
echo "== Revision identity and PR identity =="
for oid in "$base" "$head" "$merge"; do
git cat-file -e "${oid}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$oid"
done
gh pr view "$pr" --repo "$repo" --json number,state,headRefOid,baseRefOid,mergeStateStatus \
--jq '{number,state,headRefOid,baseRefOid,mergeStateStatus}'
echo "== Declared base-to-head scope =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Declared base-to-synthetic-merge scope =="
git diff --name-status "$base" "$merge"
git diff --stat "$base" "$merge"
echo "== Exact parent-restoration delta =="
first_parent="$(git show -s --format='%P' "$head" | awk '{print $1}')"
printf 'head_first_parent=%s\n' "$first_parent"
git diff --name-status "$first_parent" "$head"
git diff --find-renames "$first_parent" "$head" -- \
.github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
echo "== Required signed-token files at synthetic merge =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md; do
echo "-- ${path} --"
git show "$merge:$path" | nl -ba | rg -n -C 7 -i \
'whitespace|blank|required|field.count|trailing|delimiter|base64|epoch|uuid|version|signature|hmac|payload|unauthorized|evidence|assert|changelog' || true
git diff --quiet "$base" "$merge" -- "$path" && echo "preserved_from_base=true" || echo "preserved_from_base=false"
done
echo "== CI workflow and canonical unittest contract =="
for path in .github/workflows/ci.yml .github/workflows/fuzz.yml scripts/test_ci_workflow_stack_coverage.py; do
echo "-- ${path} --"
git show "$merge:$path" | nl -ba | rg -n -C 5 \
'pull_request|permissions:|contents:|actions/checkout@|head\.sha|EXPECTED_SHA|git rev-parse HEAD|merge compatibility|mvn verify|coverage|javadoc|buyer|unittest|discover|TestCase|main' || true
done
echo "== Unpinned workflow actions =="
git ls-tree -r --name-only "$merge" .github/workflows | while IFS= read -r path; do
git show "$merge:$path" | awk -v path="$path" '
/^[[:space:]]*uses:[[:space:]]*/ && $0 !~ /@[0-9a-fA-F]{40}([[:space:]]|$)/ {
printf "%s:%d:%s\n", path, NR, $0
}'
done
echo "== Current exact-head checks =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,head_sha,details_url,started_at,completed_at,app:.app.slug}'
echo "== Current exact-head Actions runs associated with PR `#288` and declared base =="
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" --paginate \
--jq '.workflow_runs[]
| select(any(.pull_requests[]; .number == 288 and .head.sha == "ed3863209109cd24a3cf1f1d6bdcd51db16fbef1" and .base.sha == "801e0ab5ce81fea10d331db7ddd089244a4171f2"))
| {id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|select(.number == 288)|{number,head:.head.sha,base:.base.sha}]}'Length of output: 27239 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
merge="b662b1701b85afed17f44d3ab62a193003e92e1c"
numbered_show() {
git show "$1" | awk '{printf "%6d %s\n", NR, $0}'
}
echo "== Artifact token boundary tests =="
numbered_show "$merge:src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java" \
| rg -n -C 10 \
'Whitespace|whitespace|blank|required|field count|trailing|delimiter|Base64|epoch|UUID|version|signature|Unauthorized|UNAUTHORIZED|assertThat'
echo "== ArtifactTokenClaims implementation =="
numbered_show "$merge:src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java" \
| rg -n -C 12 'requireText|isBlank|split|Base64|epoch|UUID|version|payload|claim|IllegalArgument'
echo "== ArtifactLinkService implementation =="
numbered_show "$merge:src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java" \
| rg -n -C 14 \
'parseAndVerify|split|field|Hmac|Mac\.|MessageDigest\.isEqual|signature|payload|Unauthorized|UNAUTHORIZED|Base64|catch'
echo "== Executable evidence contract =="
numbered_show "$merge:scripts/test_artifact_token_parser_evidence.py" \
| rg -n -C 10 \
'ArtifactTokenBoundaryTest|Whitespace|whitespace|field|trailing|delimiter|Base64|epoch|UUID|version|signature|assert|unittest|main'
echo "== CHANGELOG evidence =="
numbered_show "$merge:CHANGELOG.md" \
| rg -n -C 6 -i 'artifact|token|signed|blank|whitespace|claim'
echo "== Complete restored CI workflow =="
numbered_show "$merge:.github/workflows/ci.yml"
echo "== `#270` authoritative parent comparison =="
gh pr view 270 --repo "$repo" --json state,headRefOid,baseRefOid,mergeCommit,files \
--jq '{state,headRefOid,baseRefOid,mergeCommit:(.mergeCommit.oid // null),files:[.files[]|.path]}'
parent_270="$(gh pr view 270 --repo "$repo" --json headRefOid --jq .headRefOid)"
printf 'pr270_head=%s\n' "$parent_270"
git diff --name-status "$base" "$parent_270" || true
git diff --name-status "$base" "$merge"
echo "== Current queued or failed exact-head checks only =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped"))
| {name,status,conclusion,details_url,app:.app.slug}'Length of output: 45785
I reviewed only:
I found no code-level actionable findings. Verified results:
Current gate status is incomplete:
I did not treat queued, failed, cancelled, or absent checks as passing evidence. This is a formal review only. It is not an approval. You are interacting with an AI system. |
Collaborator
Author
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="288"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
echo "== PR identity =="
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefOid,mergeStateStatus,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{
number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,
checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}],
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]
}'
echo "== Revision and delta identity =="
for oid in "$base" "$head"; do
git cat-file -e "${oid}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$oid"
done
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=true"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo "== Reconciliation commit delta =="
parent="$(git show -s --format='%P' "$head" | awk '{print $1}')"
printf 'first_parent=%s\n' "$parent"
git diff --name-status "$parent" "$head"
git diff -- "$parent" "$head" -- .github/workflows/ci.yml scripts/test_ci_workflow_stack_coverage.py
echo "== Workflow and test contract regions =="
for path in \
.github/workflows/ci.yml \
.github/workflows/fuzz.yml \
scripts/test_ci_workflow_stack_coverage.py \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
scripts/test_artifact_token_parser_evidence.py; do
echo "-- $path --"
git show "$head:$path" | nl -ba | rg -n -C 5 -i \
'pull_request|unittest|discover|head\.sha|EXPECTED_SHA|merge compatibility|mvn verify|coverage|javadoc|buyer|fuzz|permissions|contents:|checkout@|whitespace|isBlank|field.count|trailing|delimiter|base64|epoch|uuid|version|hmac|signature|MessageDigest|unauthorized|fail.closed|ledger|evidence' || true
done
echo "== Immutable action pin exceptions =="
git ls-tree -r --name-only "$head" .github/workflows | while IFS= read -r path; do
git show "$head:$path" | awk -v path="$path" \
'/^[[:space:]]*uses:[[:space:]]*/ && $0 !~ /@[0-9a-fA-F]{40}([[:space:]]|$)/ {print path ":" NR ":" $0}'
done
echo "== Exact-head checks associated with PR 288 and declared base =="
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" --paginate \
--jq '.workflow_runs[]
| select(any(.pull_requests[]; .number == 288 and .head.sha == "ed3863209109cd24a3cf1f1d6bdcd51db16fbef1" and .base.sha == "801e0ab5ce81fea10d331db7ddd089244a4171f2"))
| {id,name,event,status,conclusion,head_sha,pull_requests:[.pull_requests[]|select(.number == 288)|{number,head:.head.sha,base:.base.sha}]}'Length of output: 17518 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="ed3863209109cd24a3cf1f1d6bdcd51db16fbef1"
base="801e0ab5ce81fea10d331db7ddd089244a4171f2"
show_lines() {
local revision="$1"
local path="$2"
echo "-- ${revision}:${path} --"
if git cat-file -e "${revision}:${path}" 2>/dev/null; then
git show "${revision}:${path}" | awk '{printf "%6d %s\n", NR, $0}'
else
echo "ABSENT"
fi
}
echo "== Existence and exact file status =="
for path in \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
CHANGELOG.md; do
printf '%s: base=' "$path"
git cat-file -e "${base}:${path}" 2>/dev/null && printf 'present' || printf 'absent'
printf ' head='
git cat-file -e "${head}:${path}" 2>/dev/null && printf 'present\n' || printf 'absent\n'
done
echo "== Token source and test delta =="
git diff --find-renames --unified=20 "$base" "$head" -- \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
CHANGELOG.md
echo "== Current head token implementation =="
show_lines "$head" src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java
show_lines "$head" src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo "== Base boundary test and evidence contract selected methods =="
git show "$base:src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java" \
| awk '{printf "%6d %s\n", NR, $0}' \
| rg -n -C 6 'Whitespace|whitespace|trailing|delimiter|Base64|epoch|UUID|version|signature|field|Unauthorized|UNAUTHORIZED'
git show "$base:scripts/test_artifact_token_parser_evidence.py" \
| awk '{printf "%6d %s\n", NR, $0}' \
| rg -n -C 6 'Whitespace|whitespace|trailing|delimiter|Base64|epoch|UUID|version|signature|ArtifactTokenBoundaryTest|assert'
echo "== Compare `#270` current head =="
parent270="$(gh pr view 270 --repo "$repo" --json headRefOid --jq .headRefOid)"
printf 'pr270_head=%s\n' "$parent270"
git diff --name-status "$base" "$parent270"
git diff --name-status "$parent270" "$head" -- \
.github/workflows/ci.yml \
scripts/test_ci_workflow_stack_coverage.py \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
CHANGELOG.mdLength of output: 56560
The current head also deletes You are interacting with an AI system. |
seonghobae
merged commit Aug 6, 2026
b662b17
into
fix/artifact-token-boundaries-2ff43f
45 of 65 checks passed
Collaborator
Author
|
Superseded by direct fast-forward synchronization of |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Reconcile PR #276 onto authoritative parent #270 exact head
ed3863209109cd24a3cf1f1d6bdcd51db16fbef1while preserving the current test-first signed-token boundary changes.Evidence boundary
PR #276 remains divergent from the declared parent. Its exact head adds deterministic delimiter-free, signature-mismatch, empty-claim, correctly signed whitespace-only required-claim, malformed Base64URL/epoch/UUID/version, field-count, and trailing-delimiter regressions; an executable evidence-contract assertion; and CHANGELOG evidence. This maintenance merge restores the full parent, including the standard-library-discoverable stacked-PR CI regression, without dropping those changes.
After merge, #276 must be re-inspected at its resulting exact head and all exact-head and base-sensitive CI, fuzz, security, review, approval, and repository-policy gates must rerun. No predecessor result transfers.