Repository navigation
fix: confine compare-evidence output to the successor private artifact root - #178
Merged
Merged
Conversation
…t root compare-runs and compare-targets already reject outputs outside the after-run artifact root, but compare-evidence wrote wherever --output pointed. Apply the same check after both runs validate, so a rejected output no longer creates parent directories first. The saved-evidence example and the usage line now use a path inside the after-run artifact root. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
compare-evidencewrote its result wherever--outputpointed; it only checked that the path was new. Its siblingscompare-runsandcompare-targetsconfine the output to the successor run's private artifact root. The comparison is derived from private run evidence, so it should not land outside that root.Change
compare-audit-evidence.mjsnow applies the sameinsidePrivateRootcheck as the siblings (same error text), rooted at the validated--afterrun's artifact root. The check runs after both runs validate, so a rejected path no longer creates parent directories first. The new-file-only guarantee and the post-validation stability re-checks are unchanged. There are now three copies of this small helper; they were left separate on purpose rather than refactoring the siblings here.saved-evidence.mdexample and the command usage line incli-command-registry.mjsuse a path inside the after-run artifact root;docs/cli-reference.mdis regenerated.tests/run-evidence.test.mjs: the comparison test writes inside the artifact root and checks that it does not overwrite; a new test covers three outside paths and checks that nothing is written.--output.Verification
node --test tests/run-evidence.test.mjs tests/cli-reference.test.mjs: 13 pass, 0 failnode scripts/build-cli-reference.mjs --check: PASS (30 commands)node scripts/verify-all.mjspassed on the combined branch of all four fixes (95 test files, Windows / Node.js 24.19.0); remote CI runs it heresync-distributions --writefollowed by--checkis cleanCompatibility
compare-evidence --outputoutside the--afterrun's private artifact root; point it inside that rootSecurity and privacy
Issue
Part of the 2026-10-19 review fixes (P10 in the internal review). Closes no issue.
🤖 Generated with Claude Code