Repository navigation
feat(risk-fork): add durable stateless admission and local worker - #451
Conversation
jmborden1112-beep
left a comment
jmborden1112-beep
left a comment
There was a problem hiding this comment.
Owner-authorized solo-maintainer approval through the configured secondary account; both accounts belong to the maintainer, and no independent human approval is claimed. Exact head58e7fbafb4bba41329f700f49cf222d5fa607b8d. All23 hosted checks passed, including CodeQL, required validate, mandatory PostgreSQL/TLS67/67, managed-service97/97 across Node20/22/24, hosted bundle16/16 and Linux/macOS/Windows extraction. Source matches reviewed d3551c3 except a deterministic generated-inventory line-number repair; no verified blocking source finding remains in inspected coverage. Approval covers source-only/default-off functionality and docs. Production qualification, provider use, deployment, publication, spend, canary and activation remain separately gated in issue375.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58e7fbafb4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| timeout_ms: timeoutMs, | ||
| deadline_at: new Date(Date.now() + timeoutMs).toISOString(), | ||
| operation: context?.operation ?? request.phase, | ||
| authentication: context?.authentication, |
There was a problem hiding this comment.
When portable_handle_boundary is enabled and the caller supplies a bearer token or opaque credential capability in context.authentication, this new field is included in phaseContext, and executePhase() passes that same context to resolvePlan() before calling the authentication boundary. A phase-plan callback that previously logged, serialized, or delegated its harmless timing context can therefore expose or misuse the ingress credential without authenticating it. Pass authentication only to portableHandleBoundary.authorize() and give the plan resolver a credential-free context; add a test proving the resolver cannot observe the authentication capability.
Useful? React with 👍 / 👎.
Source-only stateless admission and local worker
Progresses #375, #301 and #303; closes none. Production qualification and live traffic protection remain false.
Candidate:
58e7fbafb4bba41329f700f49cf222d5fa607b8d.Source commit:
d3551c3895fa5d695f8cd8b8de64d6805618ba95.Base:
cfaa0815f1569d1931dfa5b17dd9f47cb11ba3ed(merged #450).The signed base-synchronization commit changes ancestry only: its complete tree is byte-identical to the reviewed source commit. The source tranche is 28 paths, 2,962 additions and 70 deletions. One additional generated inventory repair below makes the complete candidate 29 paths, 2,964 additions and 72 deletions.
Implemented
local_testmanaged worker using the actual controller: immediate resource journaling, bounded leases, current-scope checks around provider callbacks, ambiguity recovery by lookup rather than original-operation replay, fresh cleanup evidence and original-object prepared provenance. Successful preparation does not destroy resources twice.Local evidence before publication
These are local source/test results, not hosted CI results for this newly published head. Fresh CI must complete before approval/merge. The CI PostgreSQL job includes the new handle suite with required database/TLS flags, and managed-service CI uses disposable PostgreSQL on Node 20/22/24.
Remaining production gates
Durable worker-side secret-bearing delivery recovery, least-privilege execution/cleanup/recovery routes and roles, actual broker effect fencing, provider containment and independent cleanup qualification, full database catalog/grant and managed HA/PITR/restore/retention/rotation evidence, OAuth/edge operation, staging, hosted multi-node conformance, capped canary and explicit activation remain open in #375. MRTR, Tasks, subscriptions, Apps and authenticated child transport stay disabled.
No private Marketplace material, credentials, customer/operator evidence, generated dependency trees or local databases are included. This PR creates no standalone repository, package release, provider account, sandbox, deployment or activation.
Review and authority
The maintainer explicitly authorized publication and normal merging of completed conversation work and use of the configured secondary account. Any secondary-account approval is a transparent solo-maintainer attestation, not an independent human review. Branch protection, required CI and exact-head checks remain enforced. Source/CI success must not be described as production readiness.
Exact-head CI repair
The first published head passed Risk Fork, managed-service, PostgreSQL, hosted-bundle and demo checks, but required validate found stale repository-inventory line positions. Commit 58e7fba runs the existing deterministic generator: only two line numbers in docs/repository-rename-preflight.json change (125/129 to 134/138). File/reference counts remain 185/369, source/runtime bytes and validation policy are unchanged. Local generator/index/count/whitespace checks pass. Fresh CI on this corrected head passed; no historical CI result is reused as exact-head evidence.
Hosted exact-head evidence
Candidate 58e7fba: all23 reported checks passed, including required validate, CodeQL and Linux/macOS/Windows release-candidate extraction. Risk Fork run https://github.com/rhein1/agoragentic-integrations/actions/runs/37169526170 passed all14 jobs. Mandatory PostgreSQL/TLS suite:67/67; managed-service Node20/22/24:97/97 each; hosted bundle:16/16, all zero skips/failures. Required Validate Machine Surfaces: https://github.com/rhein1/agoragentic-integrations/actions/runs/37169526167. These are disposable hosted CI tests and retained artifacts, not provider/deployment/production qualification.