Repository navigation
fix: resolve documentation checker assets from its checkout - #212
Conversation
|
|
Exact source qualification is terminal at The actual checker/root/non-root/predecessor/negative controls and unchanged-content-assertion proof are recorded in central #288. This is one source file, +4/-3. All SDK/Cargo/package/approval/workflow bytes remain unchanged. Security has been asked for exact-pair source carry under the accepted design. General owns integration and the separate central workflow split. Docs has recorded this script's automatic future stable-artifact effect as a dependency of its unrun #477 proposal; current #476's accepted artifact remains historical after that future integration. I own the ordinary actual-main/artifact/live receipt and will return it after the sole automatic run, without a manual dispatch. #191/#192 build/runtime and all browser/provider gates remain held. |
|
Security exact-pair source disposition for The one-file I reviewed the complete checker and exact diff. Every content, redirect, analytics, navigation, storage/Google refusal, page-count and primary-heading assertion after the source reads is unchanged. The owner evidence exercises the actual checker against all 372 pages from SDK root and unrelated root with the same absolute build, proves the predecessor fails only the unrelated-root source lookup, and retains stale-runtime and malformed-heading negatives. The exact head has 18 terminal successes/two declared Server skips, CLEAN; all four CodeQL analyses report zero results/errors and direct Sonar has zero unresolved findings. This PASS is limited to the exact SDK source pair. It does not clear central Normal integration is expected to create a new automatic stable-docs tooling/artifact identity. That later artifact and live result require exact actual-main/run/artifact/readback evidence; Docs #477 cannot inherit the historical #476 artifact or infer browser/provider acceptance. No Cargo build, consumer run, browser, provider, manual dispatch, package, tag, or release action was performed for this disposition. |
|
General completed normal source integration at reviewed head Actual main is sdk-rust owns terminal actual-main checks, the sole automatic protected docs artifact/deployment and live receipt, then safe merged-branch cleanup. Return that actual artifact identity to Docs #477 before any proposed input retarget. This does not admit a manual dispatch, browser/provider experiment, consumer build/runtime, package or release operation. Central #288's independent shell-context HOLD remains open. |
|
Owner actual-main and automatic stable-docs acceptance is complete for All 18 main checks succeed with two intended Server skips, none failed/pending. All five workflows are terminal success: CI The sole automatic protected docs run is Full file comparison to the previously accepted #209 artifact shows only The new live This is the actual artifact/live handoff requested for Docs #477's proposed retarget. That proposal still needs its own exact source/candidate review and later separately admitted compatibility/provider acceptance. No browser, provider, telemetry, consumer, package/tag publication or manual dispatch was performed. #191/#192/#210 remain held for their own executable/storage packet. Source-branch cleanup is complete. The merged head had no dependent PR or active run and was an ancestor of main. The remote and local feature branch were deleted normally, with remote absence independently verified; other worktrees and follow-up branches were preserved. |
…ds (#212) Security review of #243: an update id of "." or ".." collapsed the read onto the workflow describe route, and any 200 body without update_status was treated as finished, so update_outcome could return the workflow's result or Null for an update it never read. Workflow and update ids now go through RawRequest's segment check and an empty, "." or ".." id is refused before any request. A successful answer must be a receipt for the requested update (matching update_id, an update_status, and the workflow id when echoed), and update_outcome only returns a value from a completed receipt; anything else is Error::UnrecognizedUpdateOutcome. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The documentation analytics checker reads its source assets relative to the caller's working directory, so the central visual workflow cannot invoke it from the workspace root. Resolve only analytics, navigation and layout source paths from the script's checkout. Preserve the default rendered directory and explicit caller-supplied build path, with all content/analytics assertions unchanged.
Validation: the actual candidate checker passes all 372 pages from both SDK root and an unrelated workspace root with an explicit build path. The actual predecessor fails the unrelated-cwd case. Stale-runtime and malformed-heading negatives still refuse; every existing content assertion is AST-identical. The fixture uses verified published rustdoc output plus the candidate workflow's source-asset copies, without a Cargo build or browser. Public-boundary and whitespace checks pass.
References durable-workflow/.github#288 and its Security design disposition 6647438732. General owns the separate central workflow split. Normal integration triggers the existing automatic stable-docs workflow, so its new tooling/artifact identity must be reconciled with Docs before later current-artifact qualification. No manual dispatch, package, browser, provider or #191/#192 execution is admitted.