You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): keep PCC standalone after adding provenance workspace - #177
Adding the provenance workspace caused the existing cargo build --locked --release --manifest-path tools/pcc/Cargo.toml gate to reject PCC as an undeclared member. Explicitly exclude the independently locked tool. Its existing locked release build now passes (three existing dead-code warnings).
Also record the exact nested Rust toolchain/cache revisions admitted by the repository's selected-actions policy. SHA pinning remains required. This corrects the hosted failure observed after #175; no check is bypassed.
Clarified which approved workflow revisions and sources are recognised for CI admission checks. Documented that toolchain and cache commits are checked against the specified workflow revision; existing action allowances and SHA-pinning requirements remain unchanged.
Chores
Excluded the pcc tool from Cargo workspace membership and builds.
The change adds tools/pcc to the Cargo workspace exclusions. It also updates the provenance exhibit with details about the frozen Rust reusable workflow revision and admission checks.
Changes: Cargo workspace membership
Layer / File(s)
Summary
Exclude tools/pcc from the workspace Cargo.toml
The Cargo workspace exclusions now include tools/pcc.
The description identifies the frozen Rust reusable workflow revision, specifies that lockfile admissions use the canonical Kyaml parser, and states that toolchain and cache commits were checked against that revision.
The exclusion preserves PCC's independently locked build configuration, with no concrete regression identified. The hosted action-admission policy remains unconfirmed, but there is no evidence of a missing admission. Mergeable subject to normal checks.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title clearly describes the PCC workspace exclusion.
Description check
The description covers the PCC workspace exclusion and the selected-actions policy documentation.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Tip
🎯 Customize your risk assessments
Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.
✅ Automatic approvals, with your rules
Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
🟢 no graded findings (job: success) · advisory in grid scope: 🔵 blue (0 critical, 0 high, not grading)
same run
Scope: the three lanes below are static checks at the named commit. A
green row means every applicable check in its declared scope passed;
orange means evidence is missing, not that nothing was found. The
Hypatia verdict covers GATING rows only; advisory reporters are listed
in its grid and their severity counts are limited to the grid scope.
A blocking gate may inspect findings outside the delta grid’s grade; open
the linked run and check annotations for the failing step and, where
applicable, the finding. No row is a security certification.
K9 live corpus (L0–L2): 1 finding(s) / scope notes
coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.
Hypatia verdict grid
🟢 clean · commit 86aee6badb8e · run 42225598886 · scope: this change (2 file(s)) · excludes 9-archive/
Advisory: 2 row(s), worst 🔵 minor (0 critical, 0 high in grid scope) — reported, never grading the change.
Unique graded findings across gating and advisory rows: 1 (1 reporter observations; 1 without sufficient identity to corroborate). Row counts remain per reporter; unique totals do not change gating.
Raw Hypatia alert-derived observations: 31 (code-scanning, Dependabot and secret-scanning; some may also be in SARIF; not an extra total).
Reporter
Gate
Status
Critical
High
Medium
Minor
Since previous revision
Hypatia scan
gating
🟢 clean
0
0
0
0
— no comparable baseline (no prior PR grid or unreadable snapshot)
panic-attack assail
advisory
🔵 minor
0
0
0
1
— no comparable baseline (no prior PR grid or unreadable snapshot)
pons asinorum
advisory
🟢 clean
0
0
0
0
— no comparable baseline (no prior PR grid or unreadable snapshot)
Hypatia scan: 57 finding(s)
57 further finding(s) in files this change does not touch: reported, not graded (7 critical, 4 high).
panic-attack assail: 59 finding(s)
lowMutationGap — Cargo.toml — Rust project has test infrastructure but no mutation-test configuration (cargo-mutants/.cargo-mutants.toml) — add `cargo mutants` to verify test suite kills mutations
58 further finding(s) in files this change does not touch: reported, not graded (4 critical, 0 high).
pons asinorum: 9 finding(s)
9 further finding(s) in files this change does not touch: reported, not graded (0 critical, 0 high).
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.
The reason will be displayed to describe this comment to others. Learn more.
Additional comments: 1
docs/PROVENANCE-EXHIBIT-B.adoc: 1
116-117: Minor · Potential issue · Low value
Unverified finding
We couldn't verify this from the code. It is shown for review, not as a verified issue.
The exhibit says third-party commits in the frozen Rust workflow were admitted, but the supplied context does not show the selected-actions policy or the workflow's nested action references. A nested action revision may be missing from the policy.
The admission description is misleading, and the hosted Rust workflow may still be rejected.
This can occur when: The frozen Rust workflow references a third-party action at a revision not admitted by the selected-actions policy.
Review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 07cf4239-ce46-4ae9-93c2-173104e22069
Commits
Reviewing files that changed from the base of the PR and between d7fe9db and 86aee6b.
Files selected for processing: 2
Cargo.toml
docs/PROVENANCE-EXHIBIT-B.adoc
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Review details
Context from checks skipped due to timeout: 5
GitHub Check: rust-ci / Cargo test
GitHub Check: CodeRabbit
GitHub Check: Rust Backend — Build + Check
GitHub Check: panel-clades-abi
GitHub Check: semgrep-cloud-platform/scan
Additional context used
Code guidelines: 1
.windsurfrules — auto-discovered
Path-based instructions: 1
Source excerpt: **Rule:** Do not introduce Tauri references or dependencies — Gossamer is the desktop backend Source excerpt: **Rule:** All state management uses TEA (Model -> Msg -> Update -> View) — no MVC, Redux, hooks, or other patterns...
)
PanLL's proof guidance still deferred Rust verification to ordinary
tests and did not name the default first-party Rust toolset. Allocate
concrete provenance and IPC/PCC obligations to Creusot with Pearlite and
Verus under standards §1.2, keeping unexecuted implementation proofs
OPEN and dependency behavior ASSUMED.
The ledger separates implementation evidence from cryptographic
hardness, civil identity approval, independent witnesses and checkpoint
operation. No proof is claimed by this documentation change.
Reconciliation evidence: the existing markerless-worktree example test
was explicitly rerun on current main with `cargo test --manifest-path
Cargo.toml -p panll-provenance --example record --locked`: 1 passed, 0
failed. The old #175 thread now links the merged fix and this receipt
and is resolved. Current-main Build Validation 42247456170 and Rust CI
42247457884 pass after #177/#178. Documentation whitespace check passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Adding the provenance workspace caused the existing
cargo build --locked --release --manifest-path tools/pcc/Cargo.tomlgate to reject PCC as an undeclared member. Explicitly exclude the independently locked tool. Its existing locked release build now passes (three existing dead-code warnings).Also record the exact nested Rust toolchain/cache revisions admitted by the repository's selected-actions policy. SHA pinning remains required. This corrects the hosted failure observed after #175; no check is bypassed.