security: reconstruct exact connection-count value types on current stack - #152
Closed
seonghobae wants to merge 41 commits into
Conversation
Reconstruct the credential-free six-file release-evidence preparation source, focused tests, and operator documentation directly on protected main after #62 integrated. Keep the historical #64 branch untouched; release-history parity remains a separate integrated-tree step so current-main behavior is proven without transferring stale stack evidence.
Reconstruct the repository-local publisher removal, literal-\\n startup repair, offline verifier completeness contract, and maintainer documentation directly on the accepted #62 protected-main tree. Preserve current protected-main CHANGELOG history for a separate parity commit instead of overwriting newly integrated release evidence.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
12 tasks
* test: reject validated-result subclasses before attribute access * security: reject validated-result subclasses before attribute access * fix: preserve missing-signature denial after exact-type check * test: require exact validation-result boundary documentation * test: defer documentation parity to canonical docs branch * test: isolate hostile signature lookup without special-method override * test: prove validation-result integrity on sync and async builders --------- Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
…kflow-yaml-parse-current-main-20260811 fix: restore hourly product workflow YAML parsing on current main
…nomous-write-publisher-d3498ec security: remove publisher and autonomous merge paths
seonghobae
marked this pull request as ready for review
August 11, 2026 06:21
…sealed-evidence-d3498ec release: reconstruct sealed evidence preparer on current main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Historical reconstruction of primitive connection-count integrity on an older stack. This branch is now closed as superseded by the current reconstruction chain #158 -> #182 -> #187. Historical checks, reviews, approvals, base identity, mergeability, and branch history remain evidence only and do not transfer.
Original TDD evidence
4457d0a1fae85b5060270d8a591e58c639bab50b8e08064f577368ea9f25c69473d31a6e6a26e1be31434043141: package acceptance succeeded; Python 3.10-3.13 failed the intended subclass boundaryed1ba61fd5dc966bdd6e657163b9be5996bfd20a31434233680: Python 3.10-3.13 and package acceptance succeeded1ab99d3c0c7118cb83e70c8abcb6f5f0129d9366, not the older body snapshot26c794dd....2026-08-12 supersession audit
Fresh protected main remained
52a5c6a0862e0d035b0698b79a0e8556269e0b00. The stale #152 head is diverged from current main; its current-main residual is exactly the 11-path union now owned by the replacement chain:The replacement chain does not merely resemble #152. Exact blob comparison proves identical implementation and focused regression artifacts for the semantic payload:
src/egressweave/policy.py:9221a70a457d53d107e2439976a3e1617f2000d0on both trees;src/egressweave/connection_pool_policy.py:93574602aba99e07e4fc3e9777a42df4d5e6fe4aon both trees;180b9b32e82ebf2ab9240c3ab9f4304afe8c19a2;275357e3b9a05acdbb9599498e0596b70a998b95;e1a5a4569d9ff8ef185c4380284bb5b8e1e0f15b;d0c336f9f812af0a070570db49504541cf20a57d;dd6b61d529dd4b730bb47721bef64195aa52561e;fa38af49665b067ef2a93a99356142238e317063;1d0996b744cfdb996018ad5c1f0639281c6da08con both trees.The connection-pool guide differs only in prose organization/detail. The current #187 guide still states exact built-in integer acceptance, retained ASCII decimal-string support, rejection of integer subclasses before finite capacity retention, the no-Python-sandbox boundary, and exact-policy-type migration. It is validated by the same documentation-contract test blob above. No unique executable or machine-checkable requirement remains only in #152.
Current #187 exact head
826db8d549ee34d04c387bf538fb0ebfbbe7cfb3has hosted CI31548466643GREEN, including Python 3.14, full pytest/coverage, Ruff, product guard, compileall, wheel/sdist verification, and installed-wheel smoke. This is replacement evidence only; it does not transfer to this closed branch.Closure
Close this Draft as proven superseded. Do not merge or revive this divergent branch. Continue issue #120 only through the live #158 -> #182 -> #187 reconstruction chain, subject to its own exact-head/live-base review, security, dependency-review and governance evidence.