XCSV-REFACTOR-TOOLS-001: repository guardrails and CI audits - #43
Conversation
x-cessive
left a comment
x-cessive
left a comment
There was a problem hiding this comment.
Independent review — CHANGES REQUIRED BEFORE MERGE
The candidate branch is preserved and the audit architecture is directionally good, but PR #43 is not merge-safe yet because the CI wiring does not currently enforce the guardrails it claims to enforce.
- CI checkout does not initialize member submodules.
.github/workflows/ai-contract-drift.yml uses actions/checkout with submodules: false, while xcsv-repository-guardrails.ps1 requires verified addons, catalogue, and guard sources before running registry completeness, CfgExileCustomCode, network, XM8, init/event/scheduler, trader/economy, and mirror-drift checks.
With uninitialized submodules those member observations become non-verified, $sourceReady becomes false, and the core audits are skipped. The workflow can therefore report success while never evaluating the real XCSV member-source constellation.
- CI-safe audit does not fail the job on deterministic FAIL findings.
The workflow invokes xcsv-repository-guardrails.ps1 -Mode CI_SAFE_SOURCE_CHECK -Json but omits -FailOnFindings.
The script exits non-zero only when -FailOnFindings is supplied. Therefore deterministic FAIL findings can still yield exit code 0 and a green GitHub Actions job.
Required correction:
- initialize the exact member submodules needed by the CI-safe audit, or otherwise provide a reproducible verified source constellation;
- run the audit in enforcement mode so deterministic FAIL findings fail CI;
- preserve WARN / UNKNOWN as non-fatal where the contract permits them;
- add a regression proving a prepared FAIL causes non-zero process exit / failed enforcement, while UNKNOWN live-only evidence does not;
- prove the CI-safe path actually executes the member-dependent audit families rather than skipping them because source verification failed.
Cold rehydration note: the current implementation validates a supplied transcript but does not itself launch/anchor a genuinely fresh worker. That is useful validation logic, but it does not yet satisfy the full harness objective from issue #37. Either add an explicit repository-anchored fresh-worker launcher where the admitted environment supports it, or report the launcher portion UNKNOWN/BLOCKED while retaining the transcript validator as a component of the harness. Do not claim end-to-end cold-rehydration PASS from fixture text alone.
Do not merge. Preserve the existing good audit functions/tests and make this a narrow CI/harness correction.
|
XCSV-REFACTOR-TOOLS-001 CI-enforcement/cold-harness correction receipt. Candidate SHA: Implemented correction:
Enforced local audit proof:
Source observations:
Validation:
Runtime/deployment/DB/BattlEye/boot/player evidence remains PR body update via |
|
XCSV-REFACTOR-TOOLS-001 follow-up receipt after CI-enforcement correction. Latest candidate SHA: Additional correction after run
Latest GitHub Actions run:
Failure evidence:
This is now an explicit CI configuration blocker, not a false PASS. The workflow no longer skips member-dependent audits or reports healthy CI without member sources. Local validation after final correction:
Cold rehydration remains split:
Runtime/deployment/DB/BattlEye/boot/player evidence remains Stop condition: PR #43 is not merge-ready while Actions lacks the required member repository read token. No merge performed. |
|
XCSV-REFACTOR-TOOLS-001 audit signal-precision correction receipt. Candidate SHA: Implemented only the requested precision correction:
False positives removed / precision proof:
Real enforced CI-safe audit on candidate:
GitHub Actions:
Validation matrix:
Preserved controls:
COMPLETION_IMPACT: v1.0.0 Stop condition: pushed and verified for independent review. PR #43 not merged. |
x-cessive
left a comment
x-cessive
left a comment
There was a problem hiding this comment.
INDEPENDENT CONTROL REVIEW — CHANGES REQUIRED BEFORE MERGE
Candidate reviewed: da4dd81
GitHub Actions run 32456383941 is green and the real member-source audit executes correctly. The false-positive precision correction is accepted.
Three remaining CI/control blockers:
-
TRIGGER COVERAGE GAP
The workflow path filters do not currently include the member gitlink paths (addons,catalogue,guard) or.gitmodules, so a future member-pointer change can bypass the repository guardrails entirely. The stale-doc audit scans README and all currentwiki/*.md, but the workflow does not trigger onREADME.mdor generalwiki/**; edits such aswiki/Runbook.mdcan therefore bypass the audit. The permanent guardrail must run when its authoritative inputs change. -
PRIVATE TOKEN HYGIENE
The member checkout step writesXCSV_MEMBER_REPO_TOKENinto a global Git URL rewrite and leaves that credential-bearing rewrite in Git configuration while PR-controlled PowerShell tests/audit code executes. Even though the token is read-only/scoped and logs mask secrets, later PR code must not be able to recover the credential from Git config. Limit credential lifetime to the member checkout operation, remove/scrub the rewrite immediately afterward, and assert no credential-bearing rewrite remains before executing repository scripts. -
#31 DOCUMENTATION GUARDRAILS NOT ACTUALLY WIRED INTO CI
Issue #37 explicitly owns permanent enforcement of the already-proven documentation controls. The current workflow does not executetools/build-docs.ps1,tools/check-doc-links.ps1, ortools/check-docs-generated.ps1as CI gates. Static AI-contract assertions are not equivalent. CI must detect canonical wiki -> generated docs drift, broken internal links, and missing/generated-marker drift using the existing tools, not a new framework.
Preserve the current sourceReady/member-gitlink enforcement, -RequireMemberSources, -FailOnFindings, warning precision, mirror findings, and UNKNOWN live/cold-launcher boundaries. Do not merge yet.
5dcff9c to
996a926
Compare
996a926 to
8bbf1db
Compare
|
XCSV-REFACTOR-TOOLS-001 CI/control correction receipt. Candidate SHA: Implemented only the three accepted CI/control corrections:
Important CI correction note:
Final GitHub Actions evidence:
CI source evidence:
Local validation matrix:
Preserved accepted behavior:
COMPLETION_IMPACT: v1.0.0 Stop condition: pushed and verified for independent review. PR #43 not merged. |
x-cessive
left a comment
x-cessive
left a comment
There was a problem hiding this comment.
Independent review of final CI/control correction: the requested trigger expansion, member-credential scrub, private-member gitlink verification, fail-closed enforcement, and #31 documentation checks are all implemented and the GitHub Actions run is green. One remaining trigger gap blocks merge: the workflow does not include docs/wiki/** in push/pull_request path filters. Because docs/wiki is the generated projection that check-docs-generated.ps1 is meant to protect, a direct/manual edit to a non-AI generated page (for example docs/wiki/Architecture.md) can currently bypass this workflow entirely. Add docs/wiki/** to both path-filter sets and cover it in the workflow-contract regression/static assertion. Do not change the guardrail logic otherwise. Then rerun Actions and stop for final review.
|
XCSV-REFACTOR-TOOLS-001 final trigger-gap correction receipt. Candidate SHA: Implemented only the accepted final gap:
Reason preserved:
Local validation:
GitHub Actions:
Preserved controls:
Stop condition: pushed and verified for independent review. PR #43 not merged. |
x-cessive
left a comment
x-cessive
left a comment
There was a problem hiding this comment.
INDEPENDENT CONTROL REVIEW — PASS_REFACTOR_GUARDRAILS_CANDIDATE
Accepted candidate: 9eab5d7
Verified:
- PR #43 remains open/draft/unmerged and mergeable.
- GitHub Actions run 32533081982 = SUCCESS on the exact candidate head.
docs/wiki/**now triggers both push/main and pull_request workflow paths.- Static workflow-contract regression requires
docs/wiki/**in both trigger sets. - Required member submodules are checked out at exact XCSV gitlinks.
- credential-bearing member-repo rewrite is scrubbed before repository-controlled scripts execute.
- sourceReady/RequireMemberSources/FailOnFindings enforcement remains active.
- member-dependent audit families execute.
- existing documentation generated-drift/marker/link guardrails execute in CI.
- runtime/deployment/DB/BattlEye/RPT/player truth remains UNKNOWN / NOT_REVERIFIED.
- cold-rehydration fresh-worker launcher remains UNKNOWN_BLOCKED; no PASS is fabricated.
Verdict: PASS_REFACTOR_GUARDRAILS_CANDIDATE.
Next authorized action is the bounded merge/post-merge reconciliation transaction. Do not broaden into gameplay/runtime or member-repository mutation.
|
FINAL MERGE / PUBLICATION / RECONCILIATION RECEIPT XCSV-REFACTOR-TOOLS-001 / issue #37 Accepted candidate:
PR metadata:
Pre-merge gate:
Merge:
Post-merge validation checkout:
Local validation matrix:
Enforced CI-safe repository audit from merged main:
Main-branch CI:
Documentation publication:
GitHub Pages:
Canonical
Post-finalization freshness / observation truth:
Completion impact:
STOPPING for independent review. |
1 participant
XCSV-REFACTOR-TOOLS-001 / Issue #37
Mode: TOOL / TEST / CI.
Candidate branch:
tools/xcsv-refactor-tools-001-issue37Final accepted candidate SHA:
9eab5d708f12e3d44c3460982103f5a312512af3This PR was opened by the independent control-plane reviewer because the Codex execution token successfully pushed the candidate branch but lacked initial
createPullRequest/ issue-comment permission. That tooling limitation is preserved as historical trajectory evidence; it is not represented as an implementation failure.Historical trajectory preserved
The initial candidate body recorded an older candidate (
425a427a84cd1fd1057f54dcc9c2806828481bc1) and broad guardrail/tooling scope. Subsequent review corrections established CI enforcement, source provenance, credential scrubbing, audit precision, documentation enforcement, and trigger coverage. Final acceptance is for9eab5d708f12e3d44c3460982103f5a312512af3.Final established controls
addons/ XCSV_ADDONS:1481d6492524f0c9ecefaf8e48c3ae94e3c2f504catalogue/ Exile:64f5dff61059bdad2c1d608b60dcd00e583defa3guard/ XCSV_GUARD:af497d0dc6fb60dcf1bccbafcc531c7038d64f0cXCSV_MEMBER_REPO_TOKENread-only member access for private member checkout.RequireMemberSourcesenforcement.FailOnFindingsenforcement: deterministicFAILfindings fail CI;WARNand live-onlyUNKNOWN / NOT_REVERIFIEDremain reported honestly.sourceReadyenforcement for member-dependent audits.docs/wiki/**trigger coverage so direct generated-doc edits cannot bypass drift enforcement.Item*, documentationexecVM, XM8 app source mapping, stale paths, and mirror-drift summaries.Cold rehydration truth
TRANSCRIPT_VALIDATOR = VERIFIEDFRESH_WORKER_LAUNCHER = UNKNOWN_BLOCKEDEND_TO_END_COLD_REHYDRATION_PASS = NOT_ESTABLISHEDNo end-to-end cold-rehydration PASS is claimed.
Accepted validation
GitHub Actions workflow:
XCSV AI contract driftRun:
32533081982Result:
SUCCESSPassed jobs:
Verify XCSV-AI-CONTRACT 1.0.0Sync policy regression suiteRepository fabric guardrailsCI-safe guardrail audit evidence from the accepted run:
sourceReady = truePASS=4,WARN=60,FAIL=0,UNKNOWN=4Inventory observation
Candidate-generated inventory reports:
SOURCE_WIRED: 35PARTIAL_SOURCE_VERIFIEDThis change does NOT establish live deployment/runtime truth. Live Arma server, deployed PBOs, database, BattlEye, RPT/boot, player behavior, and full fresh-worker cold rehydration remain
UNKNOWN / NOT_REVERIFIEDunless separately inspected.Review posture
Independently accepted as
PASS_REFACTOR_GUARDRAILS_CANDIDATE. Merge/publication/reconciliation must still preserve normal repository history and avoid member-repository/runtime mutation.