Repository navigation
feat: add opt-in encrypted final report diagnostics - #59
Conversation
🤖 Comment Revalidation TestAction result: PASSED · Critical issues: 0 · Grounding: not-required PR Validation ReportSummaryThis is a test of the comment-triggered revalidation feature. The PR implements opt-in encrypted final report diagnostics for the usable-pr-validator action. An override/approval comment was detected in the PR context and is being tested for proper documentation workflow. Override Comment Test Results
The override comment requests approval for a test scenario to verify the comment revalidation feature works correctly. According to the instructions, when a user explicitly approves a deviation from standards, a memory fragment should be created to document it. Override Comment Content
Deviation Documentation AttemptStatus: Attempted to create a "Violation Exception" fragment to document the approved deviation, but encountered an access restriction. This indicates the workspace may require specific permissions for fragment creation, or the fragment type ID may need verification. Critical Violations ❌None found (test scenario - no actual code violations detected) Important Issues
|
🤖 Documentation ValidationAction result: ERROR · Critical issues: 1 · Grounding: not-required PR Validation ReportSummaryValidation infrastructure failure. Only action-generated validation metadata is published. Assistant prose, source excerpts, links, and retrieved standards are withheld. Grounding Status
Validation Outcome
|
🤖 Integration Test ValidationAction result: ERROR · Critical issues: 1 · Grounding: not-required PR Validation ReportSummaryValidation infrastructure failure. Only action-generated validation metadata is published. Assistant prose, source excerpts, links, and retrieved standards are withheld. Grounding Status
Validation Outcome
|
Confidential callers currently receive only a verdict/count and cannot inspect a finding after raw output is cleaned up. This adds opt-in encryption of the strictly validated final report before cleanup, while preserving the caller's ordinary publication policy and all grounding/verdict gates.
The caller supplies a public RSA certificate and independently pinned SHA-256 fingerprint. OpenSSL 3 encrypts with CMS AES-256-GCM and RSA-OAEP/SHA-256; only ciphertext is uploaded, with one-day retention. Invalid recipients/encryption fail closed. Private keys never enter the action. Raw transcripts are never exported, cleanup remains unconditional, and both inputs default to disabled.
Validation:
No actual hosted encrypted upload has been exercised yet. This is an unreleased draft; no consumer pin, shared alias, release or production change is included. Repository administrators must authorize encrypted export and verify recipient/run provenance before enabling it. Decrypted findings remain untrusted model output.