B2.1: preserve mapping declarations and guard execution by omry · Pull Request #258 · omry/reploy

omry · 2026-10-20T08:25:07Z

Add strict optional blueprint identity mappings with typed unresolved values and canonical persistence. Preserve required markers and original variable types through portable staging and explicit builds.

Reject payload execution and installation for complete or unresolved mapping declarations before runtime preparation or launch. Reuse the existing operation lock and admission boundaries, including autonomous system-service startup and rechecks after admission waits. Effective overrides and mapped runtime admission remain in later slices.

Validation: complete Go/Python checks, Docker CLI smoke, release and documentation builds, focused race/coverage checks, and fresh independent full review.

omry · 2026-10-20T08:40:30Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{"approval":{"candidate_revision_fingerprint":"sha256:abf5b023a4502517621f31a9219c3c5a67c778bd874e08f0262ceac84372b0e2","evidence":{"attestations":[{"baseline_identity":"sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a","closure_identity":"sha256:23f636439676801c303eca1ddd10baa6fbaaacd590cf96d99f1c0ca4527331fa","document_identity":"sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3","sidecar_identity":"sha256:910ae8592f9403854e0c50729d98debd2191e6eee0485737e794b5943f41fd96"},{"baseline_identity":"sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a","closure_identity":"sha256:23f636439676801c303eca1ddd10baa6fbaaacd590cf96d99f1c0ca4527331fa","document_identity":"sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3","sidecar_identity":"sha256:924d3f1f4fb4456c599058b4211f40761550a7339ec45a758a3aad6b56d9c817"},{"closure_identity":"sha256:23f636439676801c303eca1ddd10baa6fbaaacd590cf96d99f1c0ca4527331fa","document_identity":"sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a","sidecar_identity":"sha256:3cffe0cc33f4d844e020bd417a724ad0a1b03f9598b00e0934cd6ce39a8a9c6f"}],"candidate_revision_fingerprint":"sha256:abf5b023a4502517621f31a9219c3c5a67c778bd874e08f0262ceac84372b0e2","check_conclusions":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118639542875},{"conclusion":"SUCCESS","name":"Gitar","run_id":118631449664},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118631472405},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118631473038},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118631472748},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118631472995},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118631472519},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118631472687},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118631472650}],"delivery_deferral_ledger_digest":"sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","finding_dispositions_digest":"sha256:7826340d35b200a35426887c15d8750e7643e89c7b2005aed3a6fff3e626f132","operation_identity":"sha256:722d446018001760dde0314e26aa987038661a696857fea3f01466504860ffae","review_request":{"body_digest":"sha256:a2cd4711393b9ef74e3fbad26e39f4b47e14b25a64373a0a9f3510079c6f7cac","id":6291183653},"review_result":{"body_digest":"sha256:b3e27642e249c3d6b3ae63a1fc734731e985cf4a85182e544405ca84efac79aa","id":6291261342}},"evidence_fingerprint":"sha256:0004ee270a0bb962aa0f84015e22b15994ae53b42530ef231d07179118130fa9","head_sha":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","operation_identity":"sha256:722d446018001760dde0314e26aa987038661a696857fea3f01466504860ffae","review_request_id":6291183653,"review_result_id":6291261342,"status":"approved-evidence-recorded"},"candidate_revision_fingerprint":"sha256:abf5b023a4502517621f31a9219c3c5a67c778bd874e08f0262ceac84372b0e2","check_conclusions":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118639542875},{"conclusion":"SUCCESS","name":"Gitar","run_id":118631449664},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118631472405},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118631473038},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118631472748},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118631472995},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118631472519},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118631472687},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118631472650}],"check_observations":[{"checks":[{"conclusion":"SKIPPED","name":"Bash native evidence checks","run_id":118536866790,"run_status":"completed","status":"failure","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118536866790"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118529639090,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118529639090"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118529630692,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630692"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118529630919,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630919"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118529630746,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630746"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118529630583,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630583"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118529630752,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630752"},{"conclusion":"FAILURE","name":"Windows host smoke (windows-amd64)","run_id":118529630463,"run_status":"completed","status":"failure","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630463"},{"conclusion":"FAILURE","name":"Windows host smoke (windows-arm64)","run_id":118529630772,"run_status":"completed","status":"failure","url":"https://github.com/omry/reploy/actions/runs/39393255648/job/118529630772"}],"head_sha":"9cdaffeea376401a10d977dc181255b3e0a713e5","id":"sha256:1c7dc429ef412a7bdee78ab83ed504f9ff4b69d5f11e97f6ede19cfbcd9be3a5","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"failure"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118576456598,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118576456598"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118569718994,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118569718994"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118569736964,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569736964"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118569737396,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737396"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118569737126,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737126"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118569737162,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737162"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118569737289,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737289"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118569737452,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737452"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118569737170,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39405324680/job/118569737170"}],"head_sha":"0f8828056a37fd846ece157766f22820fab63b6e","id":"sha256:3b9b9f4a61c1625ca19dde4237ac69c641ea9b26142a05b77d55db8804a10a3b","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118639542875,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118639542875"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118631449664,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118631449664"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118631472405,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472405"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118631473038,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631473038"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118631472748,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472748"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118631472995,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472995"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118631472519,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472519"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118631472687,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472687"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118631472650,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39423901498/job/118631472650"}],"head_sha":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","id":"sha256:76dc2fd56724d2bc0e9a411aea290290fb55c034ead3cbbd98bf6780032a6769","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118619849638,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118619849638"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118612008176,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118612008176"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118612022679,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612022679"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118612023075,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612023075"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118612023080,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612023080"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118612022846,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612022846"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118612023016,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612023016"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118612022982,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612022982"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118612022851,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39418118583/job/118612022851"}],"head_sha":"23aae88fae53f93e8b4e43bc7277ff5c71563d36","id":"sha256:8300cf57069c8cfb06dcf951a361b3866158c3e2597438825893c385b35a78da","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118589968553,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118589968553"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118584880607,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118584880607"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118584890452,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890452"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118584890833,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890833"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118584890919,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890919"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118584890811,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890811"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118584890799,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890799"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118584890743,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890743"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118584890809,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39409927119/job/118584890809"}],"head_sha":"49ba58d2292ab042c04e530102854f683c474dc2","id":"sha256:d856a5e464d74baa6a3c2f13a1b66827ef0b8683180670bc6a0d449c68811410","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118603876800,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118603876800"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118598251074,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118598251074"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118598261621,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598261621"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118598262009,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598262009"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118598262160,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598262160"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118598262189,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598262189"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118598261960,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598261960"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118598262007,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598262007"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118598262042,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39413945009/job/118598262042"}],"head_sha":"6278b68a6cfc73c6d01b73829f929022db08a77f","id":"sha256:f40691d59d53335af0eb98893cb736725dcab4c8115afdcd479ff3150f7a2702","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"},{"checks":[{"conclusion":"SUCCESS","name":"Bash native evidence checks","run_id":118558669765,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118558669765"},{"conclusion":"SUCCESS","name":"Gitar","run_id":118551600498,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/runs/118551600498"},{"conclusion":"SUCCESS","name":"Linux CI checks","run_id":118551613279,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613279"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-amd64)","run_id":118551613447,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613447"},{"conclusion":"SUCCESS","name":"Target smoke (darwin-arm64)","run_id":118551613399,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613399"},{"conclusion":"SUCCESS","name":"Target smoke (linux-amd64)","run_id":118551613290,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613290"},{"conclusion":"SUCCESS","name":"Target smoke (linux-arm64)","run_id":118551613245,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613245"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-amd64)","run_id":118551613433,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613433"},{"conclusion":"SUCCESS","name":"Windows host smoke (windows-arm64)","run_id":118551613244,"run_status":"completed","status":"success","url":"https://github.com/omry/reploy/actions/runs/39399867314/job/118551613244"}],"head_sha":"6d5318b9a097258bd6633e24542c96724fde3a02","id":"sha256:f924814648c742aac0830ce740cdb966e6d76925d22c2a340d183b9e8e04526a","required_checks":["Bash native evidence checks","Gitar","Linux CI checks","Target smoke (darwin-amd64)","Target smoke (darwin-arm64)","Target smoke (linux-amd64)","Target smoke (linux-arm64)","Windows host smoke (windows-amd64)","Windows host smoke (windows-arm64)"],"status":"success"}],"delivery_deferral_ledger_digest":"sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","delivery_deferrals":[],"findings":[{"disposition":"Fully literal source and wire ordering are fixed in49ba58d229; direct encoder/digest and tamper tests plus current validation/CI pass. Partial host/count-unresolved ordering is separately accepted as4324172530.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4323238694","https://github.com/omry/reploy/commit/6d5318b9a097258bd6633e24542c96724fde3a02","https://github.com/omry/reploy/actions/runs/39399867314/job/118558669765","https://github.com/omry/reploy/runs/118551600498","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613279","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613447","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613399","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613290","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613245","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613433","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613244","https://github.com/omry/reploy/pull/258#discussion_r4323875722","https://github.com/omry/reploy/commit/49ba58d2292ab042c04e530102854f683c474dc2","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round04-bound-local-validation.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round04-required-checks-result.json"],"id":"4323238694","invariant":"Complete literal maps have canonical interval order independent of source order.","path":"internal/blueprint/identity_mapping.go","rationale":"Normalize each fully literal UID/GID list by container_start; retain symbolic leaves unchanged until their operation resolves them.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uQ46O"},{"disposition":"Truth fix in0f8828056a: only staging cleanup is exempt, payload/install guards remain, and complete validation plus all exact-head CI jobs pass.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4323534716","https://github.com/omry/reploy/commit/0f8828056a37fd846ece157766f22820fab63b6e","https://github.com/omry/reploy/actions/runs/39405324680/job/118576456598","https://github.com/omry/reploy/runs/118569718994","https://github.com/omry/reploy/actions/runs/39405324680/job/118569736964","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737396","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737126","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737162","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737289","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737452","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737170"],"id":"4323534716","invariant":"Portable mapped staging can be removed or replaced by exact-owned cleanup without allowing payload, install or application-hook execution.","path":"internal/dockerdeploy/control_admission_modes.go","rationale":"Permit only ControlOperationStageV1 through the current declaration-only shared guard. Keep every payload/install guard and queue/ownership checks. B4 adds retained-identity authority guards independently. Test real removal and serialized force replacement for complete/unresolved declarations.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uRlqo"},{"disposition":"Fully literal source and wire ordering are fixed in49ba58d229; direct encoder/digest and tamper tests plus current validation/CI pass. Partial host/count-unresolved ordering is separately accepted as4324172530.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4323875722","https://github.com/omry/reploy/commit/49ba58d2292ab042c04e530102854f683c474dc2","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round04-bound-local-validation.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round04-required-checks-result.json"],"id":"4323875722","invariant":"Canonical wire bytes and digests must be independent of literal UID/GID interval ordering for every encoder caller; reordered wire input must reject.","path":"internal/blueprint/resolved_document_v1.go","rationale":"Reuse one pure sorted mapping copy at source resolution and the common encoder. Preserve caller data and unresolved values. Add direct encoder/digest equality and surgical wire-order tamper tests for both map arrays.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uSZKR"},{"disposition":"Truth fix in6278b68a6c: numeric container-key ordering no longer depends on host/count resolution. Source/wire/digest/tamper regressions and complete validation plus exact-head CI pass. Expression-bound key ordering and positive-count lower-bound overlap are separately accepted in round05.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4324172530","https://github.com/omry/reploy/commit/6278b68a6cfc73c6d01b73829f929022db08a77f","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round05-bound-local-validation.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round05-required-checks-result.json"],"id":"4324172530","invariant":"Canonical interval order depends on known container IDs, not on host/count resolution. Known-invalid duplicate starts cannot create ambiguous canonical order.","path":"internal/blueprint/identity_mapping.go","rationale":"Use the shared normalizer whenever container starts are literal; preserve unresolved host/count values. Reject known duplicate starts with eventual positive counts. Exercise source, encoder, digest and surgical wire-order rejection.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uTGMv"},{"disposition":"Truth fix in23aae88fae: positive-count lower bounds reject definite overlap and one comparator covers literal/bound/mixed/unresolved keys while preserving source expressions. Full invariant matrix, complete validation and every exact-head CI job pass.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4324422256","https://github.com/omry/reploy/commit/23aae88fae53f93e8b4e43bc7277ff5c71563d36","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-bound-local-validation.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-required-checks-result.json"],"id":"4324422256","invariant":"Known starts necessarily inside another positive interval reject even when their counts are unresolved.","path":"internal/blueprint/identity_mapping.go","rationale":"Reuse the existing interval checker with minimum valid unknown count1 and remove the redundant duplicate-start map.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uTsGI"},{"disposition":"Truth fix in23aae88fae: positive-count lower bounds reject definite overlap and one comparator covers literal/bound/mixed/unresolved keys while preserving source expressions. Full invariant matrix, complete validation and every exact-head CI job pass.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4324422262","https://github.com/omry/reploy/commit/23aae88fae53f93e8b4e43bc7277ff5c71563d36","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-bound-local-validation.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-required-checks-result.json"],"id":"4324422262","invariant":"Canonical ordering includes saved integer expression bindings while preserving original expressions; source order cannot change unordered mapping intent authority.","path":"internal/blueprint/identity_mapping.go","rationale":"Populate original type bindings before source normalization, use them only as numeric sort keys, and use original typed scalars as deterministic fallback for unknown keys or ties. Do not substitute values or grant effective admission.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uTsGN"},{"evidence":["https://github.com/omry/reploy/pull/258#discussion_r4324727971","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-verified-correction-bundle.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round06-correction-apply-result.json","/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr258-cdd910439a13de5a9ab48c4a782d4f72dc4e231cc8f3a18281d6cc1af5897af7/round07-bound-local-validation.json","https://github.com/omry/reploy/pull/258#discussion_r4325024879"],"id":"4324727971","invariant":"Persisted original-variable bindings have complete coverage and values consistent with Environment.Vars; original scalar kinds remain explicit digest-bound authority.","path":"internal/blueprint/identity_mapping.go","rationale":"Persist all original variable type bindings, reject missing/extra/value-inconsistent or noncanonical bindings at the common encoder, and preserve integer-vs-float kinds rather than infer them from lossy JSON. Complete original provenance is already needed by B2.2; no effective overrides or runtime capability enters B2.1.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uUaV9"},{"disposition":"Truth fix in6d5318b9a0; current complete validation and every exact-head CI check pass.","evidence":["https://github.com/omry/reploy/actions/runs/39393255648/job/118536866790","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630463","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630772","https://github.com/omry/reploy/commit/6d5318b9a097258bd6633e24542c96724fde3a02","https://github.com/omry/reploy/actions/runs/39399867314/job/118558669765","https://github.com/omry/reploy/runs/118551600498","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613279","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613447","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613399","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613290","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613245","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613433","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613244"],"id":"B21-LOCAL-WINDOWS-001","invariant":"All supported host CI jobs run the same guard assertions with portable fixtures.","path":"internal/dockerdeploy/identity_mapping_admission_test.go","rationale":"New installed-service positive control hardcodes /usr/bin/docker, which is not an absolute Windows path. Both Windows CI jobs fail before ordinary missing-build control.","status":"resolved"},{"disposition":"Truth fix in6d5318b9a0; current complete validation and every exact-head CI check pass.","evidence":["https://github.com/omry/reploy/actions/runs/39393255648/job/118536866790","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630463","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630772","https://github.com/omry/reploy/commit/6d5318b9a097258bd6633e24542c96724fde3a02","https://github.com/omry/reploy/actions/runs/39399867314/job/118558669765","https://github.com/omry/reploy/runs/118551600498","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613279","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613447","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613399","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613290","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613245","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613433","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613244"],"id":"B21-LOCAL-WINDOWS-002","invariant":"All supported host CI jobs run the same guard assertions with portable fixtures.","path":"internal/dockerdeploy/identity_mapping_admission_test.go","rationale":"Direct-install fixture fails to insert mapping on Windows. Source text replacement must handle fixture line endings and assert successful declaration insertion.","status":"resolved"},{"disposition":"Truth fix in6d5318b9a0; current complete validation and every exact-head CI check pass.","evidence":["https://github.com/omry/reploy/actions/runs/39393255648/job/118536866790","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630463","https://github.com/omry/reploy/actions/runs/39393255648/job/118529630772","https://github.com/omry/reploy/commit/6d5318b9a097258bd6633e24542c96724fde3a02","https://github.com/omry/reploy/actions/runs/39399867314/job/118558669765","https://github.com/omry/reploy/runs/118551600498","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613279","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613447","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613399","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613290","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613245","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613433","https://github.com/omry/reploy/actions/runs/39399867314/job/118551613244"],"id":"B21-LOCAL-WINDOWS-003","invariant":"All supported host CI jobs run the same guard assertions with portable fixtures.","path":"internal/dockerdeploy/identity_mapping_guard_test.go","rationale":"Snapshot helper reads exclusively locked operation/lease files on Windows. Snapshot non-lock deployment evidence while asserting lock/queue ownership separately; preserve actual guard assertions.","status":"resolved"},{"disposition":"Truth fix in0f8828056a: only staging cleanup is exempt, payload/install guards remain, and complete validation plus all exact-head CI jobs pass.","evidence":["https://github.com/omry/reploy/pull/258#discussion_r4322963478","https://github.com/omry/reploy/blob/9cdaffeea376401a10d977dc181255b3e0a713e5/docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md#required-values-and-deployment-overrides","https://github.com/omry/reploy/pull/258#discussion_r4323534716","https://github.com/omry/reploy/commit/0f8828056a37fd846ece157766f22820fab63b6e","https://github.com/omry/reploy/actions/runs/39405324680/job/118576456598","https://github.com/omry/reploy/runs/118569718994","https://github.com/omry/reploy/actions/runs/39405324680/job/118569736964","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737396","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737126","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737162","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737289","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737452","https://github.com/omry/reploy/actions/runs/39405324680/job/118569737170"],"id":"gitar-4322963478","invariant":"No declared mapped workload can pass shared admission before generic-launch.","path":"internal/dockerdeploy/control_admission_modes.go","rationale":"B2.1 intentionally inhibits all shared control admission to prevent payload/hooks/recovery bypass. The design permits exact-owned cleanup without hooks but does not require an exemption. B4 explicitly requires destructive authority transitions to reject until H4 checked release. Removing shared guards would violate the approved intermediate safety boundary. Ordinary absent-declaration behavior is unchanged.","status":"resolved","thread_id":"PRRT_kwDOTFQCkM6uQPOh"}],"pr":{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:fdb6c52a7a6efdf498034819659c5281975c15e32209be85dd89bd42f4848ccd","diff_digest":"sha256:a01e5d8222302425102cca0872ade9a7aa39037e7fc3a08c1f097f71fc3065c2","head_ref":"pr258","head_sha":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","pr":258,"repository":"omry/reploy","scope_authority":[{"digest":"sha256:7a1e2cb93f4520c6fffee4a59c75752ced2122d80b5a6449f486bc041772028d","path":"docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"},{"digest":"sha256:6a488c15200d8d9cf56286855c2480cea4f78141f74584b2914ee23327174f16","path":"docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"},{"digest":"sha256:ebe0056f710b463b04662bf97917d26f3a8fafc5864b75079bf7077e2c91bdae","path":"tools/conformance/multiidentity/READINESS.md"}],"title_digest":"sha256:8ff18f8ea831750f19908b162d9464e58ed90ca5b875b52eb37aae1d87f3e075"},"record_version":22,"review_observations":[],"review_requests":[{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:eaa1201450198e26de555b939a51a62520ab3ca03ed3e514197d0c94819499df","created_at":"2026-10-20T08:56:52Z","head_sha":"9cdaffeea376401a10d977dc181255b3e0a713e5","id":6287300121,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:9ccf26b39a6466d8aca656d699477d992457148777c00cc2c46c757491622adc","created_at":"2026-10-20T09:31:25Z","head_sha":"6d5318b9a097258bd6633e24542c96724fde3a02","id":6287906530,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:7a78f2a725b5905d9a4d7babd3868d5d05bbc73d806a9f7f895c1be7a05b107f","created_at":"2026-10-20T10:13:46Z","head_sha":"0f8828056a37fd846ece157766f22820fab63b6e","id":6288614843,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:a954035f6a39589057e560065cf307e50028faca0142f3ab7684d4b58c063b32","created_at":"2026-10-20T10:53:01Z","head_sha":"49ba58d2292ab042c04e530102854f683c474dc2","id":6289246917,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:d7b7868b4fc6a5bca6ae9384a2b6abbbaebe22e3e58f41e187c385abaaa484f6","created_at":"2026-10-20T11:25:47Z","head_sha":"6278b68a6cfc73c6d01b73829f929022db08a77f","id":6289781089,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:03e1d3e857501d67946225bca92688544d9d259fde9c2894c1554aeb87e911d6","created_at":"2026-10-20T12:02:53Z","head_sha":"23aae88fae53f93e8b4e43bc7277ff5c71563d36","id":6290392955,"kind":"regular-review"},{"base_established_at":"2026-10-20T08:25:09Z","base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:a2cd4711393b9ef74e3fbad26e39f4b47e14b25a64373a0a9f3510079c6f7cac","created_at":"2026-10-20T12:47:16Z","head_sha":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","id":6291183653,"kind":"regular-review"}],"review_results":[{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:47a28fd663eda1a6f90686c62a50e85cd9646ac2289708287b831a51c930c2a4","commit_id":"9cdaffeea376401a10d977dc181255b3e0a713e5","id":5582928734,"inline_message_ids":[4323238694],"request_comment_id":6287300121,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T09:00:10Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uQ46O","PRRT_kwDOTFQCkM6uQPOh"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:b0c5f7806ac73b29cf23f4a9d5140d7bd18cf2535c5299f68116d7f08be9c6ff","commit_id":"6d5318b9a097258bd6633e24542c96724fde3a02","id":5583301056,"inline_message_ids":[4323534716],"request_comment_id":6287906530,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T09:35:14Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uRlqo"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:c3dbccd172331173ee4d1ce4910b183df39c2979c2f1dc1eb81bd52d05019225","commit_id":"0f8828056a37fd846ece157766f22820fab63b6e","id":5583716767,"inline_message_ids":[4323875722],"request_comment_id":6288614843,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T10:17:09Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uSZKR"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:5603992e48114fc02e8613fdc9fd167ec85466d1b2876f3af24b13754d523fbb","commit_id":"49ba58d2292ab042c04e530102854f683c474dc2","id":5584071656,"inline_message_ids":[4324172530],"request_comment_id":6289246917,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T10:55:52Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uTGMv"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:bfdb499f912955da4ec2e880177785023d41a723454a66b637529e1f3d089cf0","commit_id":"6278b68a6cfc73c6d01b73829f929022db08a77f","id":5584370984,"inline_message_ids":[4324422256,4324422262],"request_comment_id":6289781089,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T11:28:03Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uTsGI","PRRT_kwDOTFQCkM6uTsGN"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:a5b294835526fd01f244ebc17e0233bacdf38a2d30a116db215b6cd65cdf5f6f","commit_id":"23aae88fae53f93e8b4e43bc7277ff5c71563d36","id":5584741681,"inline_message_ids":[4324727971],"request_comment_id":6290392955,"result_kind":"findings","status":"result","submitted_at":"2026-10-20T12:06:36Z","unresolved_thread_ids":["PRRT_kwDOTFQCkM6uUaV9"]},{"base_ref":"pr256","base_sha":"10d271bad6c2146b0323baf1c41b7b128c890770","body_digest":"sha256:b3e27642e249c3d6b3ae63a1fc734731e985cf4a85182e544405ca84efac79aa","commit_id":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","id":6291261342,"inline_message_ids":[],"request_comment_id":6291183653,"result_kind":"clean","status":"result","submitted_at":"2026-10-20T12:51:26Z","unresolved_thread_ids":[]}],"revision_fingerprint":"sha256:abf5b023a4502517621f31a9219c3c5a67c778bd874e08f0262ceac84372b0e2","rounds":[{"applied_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go","internal/dockerdeploy/identity_mapping_admission_test.go","internal/dockerdeploy/identity_mapping_guard_test.go"],"disposition_changes":["4323238694","B21-LOCAL-WINDOWS-001","B21-LOCAL-WINDOWS-002","B21-LOCAL-WINDOWS-003","gitar-4322963478"],"effective_diff_digest":"sha256:623d39ca9ea9008ee3713af9e29bc06a084bb6a3b1c11323d1e9f3ba482de3d3","finding_ids":["4323238694","B21-LOCAL-WINDOWS-001","B21-LOCAL-WINDOWS-002","B21-LOCAL-WINDOWS-003","gitar-4322963478"],"invariants":["Canonical ordering for fully literal UID/GID maps","Portable supported-host guard fixtures with unchanged no-effect assertions","Conservative declaration inhibition until reviewed runtime admission"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go","internal/dockerdeploy/identity_mapping_admission_test.go","internal/dockerdeploy/identity_mapping_guard_test.go"],"resulting_head":"6d5318b9a097258bd6633e24542c96724fde3a02","review_observation_id":null,"review_request_id":6287300121,"review_result_id":5582928734,"reviewed_head":"9cdaffeea376401a10d977dc181255b3e0a713e5","root_cause":"Literal mapping arrays retained source order. Three new guard tests assumed Unix executable paths, LF checkout text and readable held locks on Windows.","round":1,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":["internal/dockerdeploy/identity_mapping_guard.go","internal/dockerdeploy/control_admission.go","internal/dockerdeploy/control_admission_modes.go","internal/dockerdeploy/identity_mapping_admission_test.go",".changes/unreleased/+multi-identity-mapping-declarations.yaml"],"disposition_changes":["4323534716","gitar-4322963478"],"effective_diff_digest":"sha256:d1d3b17cae8bb6d6902e736c281aa055d8d6691316423052d8067a6c6e2cd1c8","finding_ids":["4323534716","gitar-4322963478"],"invariants":["Non-executing exact-owned staging cleanup remains available","Payload and installation admission stays inhibited","Existing queue serialization and resource ownership are preserved"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/dockerdeploy/identity_mapping_guard.go","internal/dockerdeploy/control_admission.go","internal/dockerdeploy/control_admission_modes.go","internal/dockerdeploy/identity_mapping_admission_test.go",".changes/unreleased/+multi-identity-mapping-declarations.yaml"],"resulting_head":"0f8828056a37fd846ece157766f22820fab63b6e","review_observation_id":null,"review_request_id":6287906530,"review_result_id":5583301056,"reviewed_head":"6d5318b9a097258bd6633e24542c96724fde3a02","root_cause":"The declaration guard was unconditional in shared control admission and incorrectly treated staging cleanup as payload admission.","round":2,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/resolved_document_v1.go","internal/blueprint/identity_mapping_test.go"],"disposition_changes":["4323875722","4323238694"],"effective_diff_digest":"sha256:4d4f2c8f6535efd8a1bf38acd4f1398e99a613d70bc3d810e2e37907c3ad2275","finding_ids":["4323875722","4323238694"],"invariants":["One canonical wire and digest authority for literal mapping geometry","Canonical decode rejects reordered wire arrays","Encoding does not mutate caller-owned mapping data"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/resolved_document_v1.go","internal/blueprint/identity_mapping_test.go"],"resulting_head":"49ba58d2292ab042c04e530102854f683c474dc2","review_observation_id":null,"review_request_id":6288614843,"review_result_id":5583716767,"reviewed_head":"0f8828056a37fd846ece157766f22820fab63b6e","root_cause":"Source preparation normalized literal intervals, but the common wire encoder validated and marshaled caller order without normalization.","round":3,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go"],"disposition_changes":["4324172530"],"effective_diff_digest":"sha256:ab4b508bbe359c5e6820013eefabb2654c069230f579e2ed9b97b5d6f4c5a3bb","finding_ids":["4324172530"],"invariants":["Canonical order whenever container keys are known","Known duplicate starts reject under positive-count geometry","Source and wire encoding preserve caller data"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go"],"resulting_head":"6278b68a6cfc73c6d01b73829f929022db08a77f","review_observation_id":null,"review_request_id":6289246917,"review_result_id":5584071656,"reviewed_head":"49ba58d2292ab042c04e530102854f683c474dc2","root_cause":"Shared normalization required every host/count scalar to be literal, though only known container starts determine order.","round":4,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go"],"disposition_changes":["4324422256","4324422262"],"effective_diff_digest":"sha256:ce55a73068234e0f8fe355c2b4810bad6cec4a9ad85ce29eb42b0f229a26e900","finding_ids":["4324422256","4324422262"],"invariants":["Known starts necessarily inside positive intervals reject even with unresolved counts","Canonical mapping intent is independent of source order across literal/bound/mixed/unresolved keys","Original expressions, type bindings and caller data remain unchanged"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/identity_mapping_test.go"],"resulting_head":"23aae88fae53f93e8b4e43bc7277ff5c71563d36","review_observation_id":null,"review_request_id":6289781089,"review_result_id":5584370984,"reviewed_head":"6278b68a6cfc73c6d01b73829f929022db08a77f","root_cause":"Unknown counts were omitted from known-start overlap checks; normalization skipped expression-bound or unknown container keys and ran before source type-binding capture.","round":5,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/resolved_document_v1.go","internal/blueprint/identity_mapping_test.go"],"disposition_changes":["4324727971"],"effective_diff_digest":"sha256:a01e5d8222302425102cca0872ade9a7aa39037e7fc3a08c1f097f71fc3065c2","finding_ids":["4324727971"],"invariants":["Original variable bindings cover exactly Environment.Vars and retain original scalar types","Canonical persistence rejects binding key/value inconsistency without inferring lost numeric source kinds"],"outcome":"corrected-head-needs-review","proposed_fix_paths":["internal/blueprint/identity_mapping.go","internal/blueprint/resolved_document_v1.go","internal/blueprint/identity_mapping_test.go"],"resulting_head":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","review_observation_id":null,"review_request_id":6290392955,"review_result_id":5584741681,"reviewed_head":"23aae88fae53f93e8b4e43bc7277ff5c71563d36","root_cause":"Bindings were individually validated but incomplete; key coverage and value consistency against the resolved environment were not checked.","round":6,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0},{"applied_fix_paths":[],"disposition_changes":["4324727971"],"effective_diff_digest":"sha256:a01e5d8222302425102cca0872ade9a7aa39037e7fc3a08c1f097f71fc3065c2","finding_ids":[],"invariants":["Strict portable declaration and complete original-type provenance","Canonical immutable source persistence and fail-closed payload/install admission","All original review defects corrected and current local/remote review clean"],"outcome":"clean","proposed_fix_paths":[],"resulting_head":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","review_observation_id":null,"review_request_id":6291183653,"review_result_id":6291261342,"reviewed_head":"adbaae2ff80cf8db7dbcd51ae576e2d2b09399be","root_cause":"No current defect. Original reviewed corrections now pass fresh regular review, complete local validation and every exact-head required CI job.","round":7,"unresolved_current_slice_findings":0,"unresolved_design_blockers":0}],"schema":"awd:swe:pr-cycle-state","version":2}

chatgpt-codex-connector · 2026-10-20T08:46:21Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T12:51:28.302435Z	`adbaae2`	Manual request
🔒 Security Review	✅ Completed 2026-10-20T08:51:32.362903Z	`9cdaffe`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-20T08:56:52Z

@codex, regular review 9cdaffe

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cdaffeea3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T09:31:25Z

@codex, regular review 6d5318b

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d5318b9a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T10:13:46Z

@codex, regular review 0f88280

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f8828056a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T10:53:01Z

@codex, regular review 49ba58d

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49ba58d229

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T11:25:47Z

@codex, regular review 6278b68

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6278b68a6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T12:02:53Z

@codex, regular review 23aae88

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23aae88fae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-20T12:47:16Z

@codex, regular review adbaae2

chatgpt-codex-connector · 2026-10-20T12:51:26Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: adbaae2ff8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Add strict optional blueprint identity mappings with typed unresolved values and canonical persistence. Preserve required markers and original variable types through portable staging and explicit builds. Reject payload execution and installation for complete or unresolved mapping declarations before runtime preparation or launch. Reuse the existing operation lock and admission boundaries, including autonomous system-service startup and rechecks after admission waits. Effective overrides and mapped runtime admission remain in later slices. Validation: complete Go/Python checks, Docker CLI smoke, release and documentation builds, focused race/coverage checks, and fresh independent full review.

gitar-bot · 2026-10-21T18:57:27Z

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Persisting identity-mapping declarations and blocking execution or installation until admission exists could prevent mapped deployments from running or being installed.

Adds strict optional blueprint identity mappings with typed unresolved values and canonical persistence, and guards payload execution and installation for incomplete mapping declarations before runtime preparation or launch. No open issues remain; one finding about admission guards blocking removal of mapped staged deployments was closed without a fix in this PR.

✅ 1 closed

Closed: Bug: Admission guard blocks removal/uninstall of mapped staged deployments

📄 internal/dockerdeploy/control_admission_modes.go:94-97 📄 internal/dockerdeploy/identity_mapping_guard.go:25-32 📄 internal/dockerdeploy/identity_mapping_admission_test.go:271-285
requireUnmappedDeploymentV1 is now called unconditionally inside admitControlOperationV1 (control_admission_modes.go:94) and again in awaitControlAdmissionV1. So it applies to every control operation, not only the ones that run a payload. The same admission path is used by staged deployment removal (staged_deployment_remove.go, ControlOperationStageV1), force replacement (desired_state_force_replace.go), uninstall (provider_uninstall_run.go, ControlOperationUninstallV1) and down/stop.

The PR says staging stays available for mapped blueprints. But once a user stages one, they can no longer remove that deployment, force-replace it with a different environment, or uninstall it. Each attempt fails with the "identity_mapping requires multi-identity runtime admission" error. The only way to recover the directory is to edit it by hand. If a mapped blueprint is restaged into a deployment whose unmapped workload is still running, down is rejected too, so that workload can't be stopped. The new tests only check that payload entries are rejected, and the all-modes test only uses ControlOperationInstallV1. None of them cover removal, replacement or uninstall.

Fix: limit the guard to operations that execute or install a payload. Either pass input.Operation to the guard and skip it for stage, uninstall and stop, or move the check out of the shared admission code into the up/restart/install callers. Then add tests showing that staged removal and uninstall still work for mapped deployments.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry changed the base branch from main to pr256 October 20, 2026 08:25

omry added this pull request to stack #238 October 20, 2026 08:26

gitar-bot Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/dockerdeploy/control_admission_modes.go Outdated

omry marked this pull request as ready for review October 20, 2026 08:46

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/blueprint/identity_mapping.go Outdated

omry force-pushed the pr258 branch from 9cdaffe to 6d5318b Compare October 20, 2026 09:19

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/dockerdeploy/control_admission_modes.go Outdated

omry force-pushed the pr258 branch from 6d5318b to 0f88280 Compare October 20, 2026 10:04

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/blueprint/resolved_document_v1.go

omry force-pushed the pr258 branch from 0f88280 to 49ba58d Compare October 20, 2026 10:43

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/blueprint/identity_mapping.go Outdated

omry force-pushed the pr258 branch from 49ba58d to 6278b68 Compare October 20, 2026 11:17

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/blueprint/identity_mapping.go Outdated

Comment thread internal/blueprint/identity_mapping.go Outdated

omry force-pushed the pr258 branch from 6278b68 to 23aae88 Compare October 20, 2026 11:52

chatgpt-codex-connector Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread internal/blueprint/identity_mapping.go

omry force-pushed the pr258 branch from 23aae88 to adbaae2 Compare October 20, 2026 12:38

omry added the approved PR reviewed and approved label Oct 20, 2026

This was referenced Oct 20, 2026

B2.2: resolve typed deployment mapping overrides #259

Open

B3: validate mapping geometry and protect retained assignments #260

Open

B4: retain deployment identity authority and guard destructive transitions #262

Open

omry mentioned this pull request Oct 21, 2026

B5: preserve pending identity mappings through checked recovery #264

Open

omry force-pushed the pr258 branch from adbaae2 to 47d40e2 Compare October 21, 2026 18:56

Conversation

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

gitar-bot Bot commented Oct 21, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 20, 2026 •

edited

Loading

omry commented Oct 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading