[hyperpolymath]

A locally successful act job could previously earn a receipt despite ignored environment protection, deadlines or concurrency controls. The isolated configuration also omitted runner mappings and could prompt before execution.

Require hosted evidence for workflow/job concurrency, job environments and job/step timeouts, including transitive prerequisites. Supply immutable container mappings for every accepted runner label. Document that this receipt covers local step execution; ubuntu-latest maps to the pinned local Ubuntu 24.04 image and does not certify GitHub runner parity.

Add a real noninteractive act regression (successful changed input and a failing script) to hosted CI, with a checksum-pinned act v0.2.97 installation. Preserve credential isolation and existing hosted-only restrictions.

Validation: 29 focused tests passed, including the canonical baseline helper; the real act integration passed against rootless Podman 5.4.2. Formatting and git diff whitespace checks passed. Hosted checks pending.

Addresses the four post-merge findings on #1019. This does not close the remaining #1009 deployment work or #971 reader migration. Scheduled estate jobs still report invalid credentials; Merge Orchestrate still lacks a qualified observation batch.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 553b2899-f82a-4596-9106-acb0722d69c6

Commits

Reviewing files that changed from the base of the PR and between fa49a0b and c9405a6.

Files selected for processing: 7

• .github/workflows/ci.yml
• docs/REVIEW-GAP-LEDGER-1009.adoc
• lib/hypatia/ci_changed.ex
• test/ci_changed_act_test.exs
• test/ci_changed_receipt_test.exs
• test/ci_changed_test.exs
• test/test_helper.exs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T19:36:48.471231Z	c9405a6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.