Skip to content

B2.2: resolve typed deployment mapping overrides - #259

Open
omry wants to merge 1 commit into
pr258from
pr259
Open

omry wants to merge 1 commit into
pr258from
pr259

Conversation

@omry

@omry omry commented Oct 20, 2026 •

Copy link
Copy Markdown
Owner

Preserve sparse identity mapping overrides through the existing deployment sidecar, stage and package editor. Apply scalar and complete interval-array overrides before resolving original blueprint variables. Report unresolved consumer paths without changing portable blueprint or build identity.

Keep operation-specific resolution read-only under the selected staging lock. Reject undeclared mappings and malformed input. Mapped execution remains inhibited; durable mapping state and configuration commands follow in B3–B5.

Validation: complete Go, Python/package, Docker CLI smoke, release-build smoke and docs-build passed on the exact candidate. Tests cover typed persistence, override snapshots, stage updates, editor saves/conflicts, installed-input isolation and unchanged build digests.


@omry
omry changed the base branch from main to pr258 October 20, 2026 14:47
@omry
omry added this pull request to stack #238 October 20, 2026 14:48
@omry

omry commented Oct 20, 2026 •

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:092c7a0fb432474cd2c7b3078e81904c7f23e4bcef619281a4a7623c63f3fb6a",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:0543cc1b6579555a5c104ef021e91b6978e57a4b9279a750c76aea6ae811a987",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:910ae8592f9403854e0c50729d98debd2191e6eee0485737e794b5943f41fd96"
        },
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:0543cc1b6579555a5c104ef021e91b6978e57a4b9279a750c76aea6ae811a987",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:924d3f1f4fb4456c599058b4211f40761550a7339ec45a758a3aad6b56d9c817"
        },
        {
          "closure_identity": "sha256:0543cc1b6579555a5c104ef021e91b6978e57a4b9279a750c76aea6ae811a987",
          "document_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "sidecar_identity": "sha256:3cffe0cc33f4d844e020bd417a724ad0a1b03f9598b00e0934cd6ce39a8a9c6f"
        }
      ],
      "candidate_revision_fingerprint": "sha256:092c7a0fb432474cd2c7b3078e81904c7f23e4bcef619281a4a7623c63f3fb6a",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 118727036825
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118717915817
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118717934656
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118717935008
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118717934769
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118717935330
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118717935078
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118717934818
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118717934778
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:56c10eedf2624d84e98d1d89afe4020aa45871cd43c3d5dcd2e6d9a711180af1",
      "operation_identity": "sha256:7d8f281c968c066f7b6bfe8e29b49cc05f5986599537bc6b6b17ffd60e6e3720",
      "review_request": {
        "body_digest": "sha256:567fb00d8c0e5c6183f1b8428d13f575d027e0eb6bd1b13897916333c4fc5f7c",
        "id": 6294855258
      },
      "review_result": {
        "body_digest": "sha256:cd68836285dc0202345b132ae1f0d1bf2f094257667b6c798c61a45db2e370ab",
        "id": 6294911689
      }
    },
    "evidence_fingerprint": "sha256:5ae9c82a9382b15da40d15e5b74fef70458a810ded7671ba0a02b3729883923c",
    "head_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
    "operation_identity": "sha256:7d8f281c968c066f7b6bfe8e29b49cc05f5986599537bc6b6b17ffd60e6e3720",
    "review_request_id": 6294855258,
    "review_result_id": 6294911689,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:092c7a0fb432474cd2c7b3078e81904c7f23e4bcef619281a4a7623c63f3fb6a",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 118727036825
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 118717915817
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 118717934656
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 118717935008
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 118717934769
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 118717935330
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 118717935078
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 118717934818
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 118717934778
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 118727036825,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118727036825"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118717915817,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118717915817"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118717934656,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934656"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118717935008,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717935008"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118717934769,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934769"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118717935330,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717935330"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118717935078,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717935078"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118717934818,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934818"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118717934778,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934778"
        }
      ],
      "head_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "id": "sha256:15cc2b154ca18c3a52c038fe2a814891348cb78678f3e2d117c8a48bba5fb499",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "name": "Bash native evidence checks",
          "reason": "missing",
          "status": "pending"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118695762587,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118695762587"
        },
        {
          "name": "Linux CI checks",
          "run_id": 118695744330,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695744330"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118695743969,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695743969"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118695743112,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695743112"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118695744122,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695744122"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118695743793,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695743793"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118695744065,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695744065"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118695743877,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39442502469/job/118695743877"
        }
      ],
      "head_sha": "cdfbebb9ee85b3ea3c90626e0446e1210886caec",
      "id": "sha256:7cd53a274add2fe1d8b5baabccd3df182f6a12b6cc5ae92db12a1021e63920c8",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "disposition": "Truth fix verified in 771263cb4cc2: fixture injection handles CRLF and LF, original raw control remains unchanged; both fresh exact-head Windows jobs and full local profile pass.",
      "evidence": [
        "https://github.com/omry/reploy/actions/runs/39442502469/job/118695744065",
        "https://github.com/omry/reploy/actions/runs/39442502469/job/118695743877",
        "https://github.com/omry/reploy/commit/771263cb4cc2b63893332848ae701bd21ab93c78",
        "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934818",
        "https://github.com/omry/reploy/actions/runs/39448849423/job/118717934778"
      ],
      "id": "B22-CI01-WINDOWS-CRLF",
      "invariant": "The real staging/import regression must run with LF and CRLF repository fixture text on every supported host.",
      "path": "internal/dockerdeploy/identity_mapping_input_test.go",
      "rationale": "Both Windows jobs fail because line-based declaration injection matches LF against a CRLF checkout. Normalize only fixture text for injection and compare against that normalized text; keep original bytes for the undeclared control. No production change or weaker assertions.",
      "status": "resolved"
    }
  ],
  "pr": {
    "base_ref": "pr258",
    "base_sha": "adbaae2ff80cf8db7dbcd51ae576e2d2b09399be",
    "body_digest": "sha256:03fcc5d12d0ca2d2b9d1bc83cee41e14c8c20a5499a663703d818918c1866291",
    "diff_digest": "sha256:72d7dfcd29ee0d6ee46857f93ed90189c861c98d725c300dcfd9ce10299f77a2",
    "head_ref": "pr259",
    "head_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
    "pr": 259,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:7a1e2cb93f4520c6fffee4a59c75752ced2122d80b5a6449f486bc041772028d",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:6a488c15200d8d9cf56286855c2480cea4f78141f74584b2914ee23327174f16",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      },
      {
        "digest": "sha256:ebe0056f710b463b04662bf97917d26f3a8fafc5864b75079bf7077e2c91bdae",
        "path": "tools/conformance/multiidentity/READINESS.md"
      }
    ],
    "title_digest": "sha256:cb54f53e0949d8c62245efa8ce814ea04876c5437acb97e07c0b1cdd4247c29d"
  },
  "record_version": 7,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-20T14:47:48Z",
      "base_ref": "pr258",
      "base_sha": "adbaae2ff80cf8db7dbcd51ae576e2d2b09399be",
      "body_digest": "sha256:a78a10346cf346e5d039603baed7ee1a3d39930e8271dfd3bdfd2e7cf9f6df33",
      "created_at": "2026-10-20T15:00:26Z",
      "head_sha": "cdfbebb9ee85b3ea3c90626e0446e1210886caec",
      "id": 6293930256,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-20T14:47:48Z",
      "base_ref": "pr258",
      "base_sha": "adbaae2ff80cf8db7dbcd51ae576e2d2b09399be",
      "body_digest": "sha256:567fb00d8c0e5c6183f1b8428d13f575d027e0eb6bd1b13897916333c4fc5f7c",
      "created_at": "2026-10-20T15:43:15Z",
      "head_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "id": 6294855258,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr258",
      "base_sha": "adbaae2ff80cf8db7dbcd51ae576e2d2b09399be",
      "body_digest": "sha256:cc2343cf86de4e63f5604dbe049e383a0e2e55b87d1168b4d369d9b2ec835b8b",
      "commit_id": "cdfbebb9ee85b3ea3c90626e0446e1210886caec",
      "id": 6294004930,
      "inline_message_ids": [],
      "request_comment_id": 6293930256,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T15:03:56Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr258",
      "base_sha": "adbaae2ff80cf8db7dbcd51ae576e2d2b09399be",
      "body_digest": "sha256:cd68836285dc0202345b132ae1f0d1bf2f094257667b6c798c61a45db2e370ab",
      "commit_id": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "id": 6294911689,
      "inline_message_ids": [],
      "request_comment_id": 6294855258,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T15:46:00Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:092c7a0fb432474cd2c7b3078e81904c7f23e4bcef619281a4a7623c63f3fb6a",
  "rounds": [
    {
      "applied_fix_paths": [
        "internal/dockerdeploy/identity_mapping_input_test.go"
      ],
      "disposition_changes": [
        "B22-CI01-WINDOWS-CRLF"
      ],
      "effective_diff_digest": "sha256:72d7dfcd29ee0d6ee46857f93ed90189c861c98d725c300dcfd9ce10299f77a2",
      "finding_ids": [
        "B22-CI01-WINDOWS-CRLF"
      ],
      "invariants": [
        "Real stage/import regression remains valid under LF and CRLF repository checkouts.",
        "Original blueprint/build authority and mapped execution inhibition remain unchanged."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/dockerdeploy/identity_mapping_input_test.go"
      ],
      "resulting_head": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "review_observation_id": null,
      "review_request_id": 6293930256,
      "review_result_id": 6294004930,
      "reviewed_head": "cdfbebb9ee85b3ea3c90626e0446e1210886caec",
      "root_cause": "The new test injected a declaration by matching an entire LF-terminated line against a Windows CRLF checkout fixture.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        "B22-CI01-WINDOWS-CRLF"
      ],
      "effective_diff_digest": "sha256:72d7dfcd29ee0d6ee46857f93ed90189c861c98d725c300dcfd9ce10299f77a2",
      "finding_ids": [],
      "invariants": [
        "Sparse typed deployment overrides preserve original blueprint/build authority and never admit mapped execution.",
        "Real stage/import regression works with LF and CRLF checkouts."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "review_observation_id": null,
      "review_request_id": 6294855258,
      "review_result_id": 6294911689,
      "reviewed_head": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "root_cause": "No current defect. The prior fixture portability defect is truth-fixed and both fresh Windows jobs pass.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 20, 2026 14:57
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-20T15:46:02.539366Z 771263c Manual request
🔒 Security Review ✅ Completed 2026-10-20T15:00:17.055285Z cdfbebb Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 20, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review cdfbebb

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: cdfbebb9ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Preserve sparse identity mapping overrides through the existing deployment sidecar, stage and package editor. Apply scalar and complete interval-array overrides before resolving original blueprint variables. Report unresolved consumer paths without changing portable blueprint or build identity.

Keep operation-specific resolution read-only under the selected staging lock. Reject undeclared mappings and malformed input. Mapped execution remains inhibited; durable mapping state and configuration commands follow in B3–B5.

Validation: complete Go, Python/package, Docker CLI smoke, release-build smoke and docs-build passed on the exact candidate. Tests cover typed persistence, override snapshots, stage updates, editor saves/conflicts, installed-input isolation and unchanged build digests.
@gitar-bot

gitar-bot Bot commented Oct 20, 2026

Copy link
Copy Markdown
Code Review ✅ Approved

🟡 Medium risk · Persisting and resolving sparse UID/GID deployment overrides could select incorrect host identity ranges, though mapped execution remains unavailable in this change.

Preserves sparse identity mapping overrides through the deployment sidecar, stage and package editor, applying scalar and interval-array overrides before resolving blueprint variables while keeping mapped execution inhibited. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Oct 20, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review 771263c

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 771263cb4c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved PR reviewed and approved

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant