B3: validate mapping geometry and protect retained assignments by omry · Pull Request #260 · omry/reploy

omry · 2026-10-20T17:18:03Z

Validate and canonicalize explicit exact and bounded UID/GID intervals without expanding represented IDs. Compare candidates with retained reservations, preserve omitted assignments, and reject reassignment or host-ID reuse.

Resolve typed deployment overrides into numeric geometry through the existing locked staging input path. Keep persistent identity state, allocation, admission and mapped execution in later slices.

Validation: complete local Go, Python/package, Docker CLI smoke, release smoke and docs checks passed; fresh independent full review found no actionable defects.

Validate and canonicalize explicit exact and bounded UID/GID intervals without expanding represented IDs. Compare candidates with retained reservations, preserve omitted assignments, and reject reassignment or host-ID reuse. Resolve typed deployment overrides into numeric geometry through the existing locked staging input path. Keep persistent identity state, allocation, admission and mapped execution in later slices. Validation: complete local Go, Python/package, Docker CLI smoke, release smoke and docs checks passed; fresh independent full review found no actionable defects.

gitar-bot · 2026-10-20T17:19:04Z

Code Review ✅ Approved

🟡 Medium risk · Validating and retaining UID/GID mapping geometry changes accepted deployment inputs; conflicting mappings could block deployments, while execution admission remains deferred.

Validates and canonicalizes explicit exact and bounded UID/GID intervals without expanding represented IDs, compares candidates against retained reservations, and resolves typed deployment overrides into numeric geometry through the existing locked staging path. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-20T17:26:17Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:aab3796450a3c292a543f41d06d30c960f3e16e785a8e18dd3a6c94038aee4f7",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:3a3b7f890d0cc0400a2ba7d259ba8ffd52270de91a578f042aaad3d2b5ffe69d",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:910ae8592f9403854e0c50729d98debd2191e6eee0485737e794b5943f41fd96"
        },
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:3a3b7f890d0cc0400a2ba7d259ba8ffd52270de91a578f042aaad3d2b5ffe69d",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:924d3f1f4fb4456c599058b4211f40761550a7339ec45a758a3aad6b56d9c817"
        },
        {
          "closure_identity": "sha256:3a3b7f890d0cc0400a2ba7d259ba8ffd52270de91a578f042aaad3d2b5ffe69d",
          "document_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "sidecar_identity": "sha256:3cffe0cc33f4d844e020bd417a724ad0a1b03f9598b00e0934cd6ce39a8a9c6f"
        }
      ],
      "candidate_revision_fingerprint": "sha256:aab3796450a3c292a543f41d06d30c960f3e16e785a8e18dd3a6c94038aee4f7",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 118782388009
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118773518653
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118773524938
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118773525324
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118773525188
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118773525397
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118773525758
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118773525314
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118773525543
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:dea212475eddac6001c205b2cec88115b233c59e8326937628b5b64075649044",
      "review_request": {
        "body_digest": "sha256:8634efc886e7b6714c1bc9734b051361f0ec0d08461e9a7ba724ee69755c3a7d",
        "id": 6297028376
      },
      "review_result": {
        "body_digest": "sha256:2c797c1add0cfe816d22b3e4a8490c58fb26b8c0241450dc186657b2ffe47ead",
        "id": 6297062927
      }
    },
    "evidence_fingerprint": "sha256:a3f2620e26b942a3668b90db4f7d417d86db5fc037049b3011768a763ff6a934",
    "head_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
    "operation_identity": "sha256:dea212475eddac6001c205b2cec88115b233c59e8326937628b5b64075649044",
    "review_request_id": 6297028376,
    "review_result_id": 6297062927,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:aab3796450a3c292a543f41d06d30c960f3e16e785a8e18dd3a6c94038aee4f7",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 118782388009
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 118773518653
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 118773524938
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 118773525324
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 118773525188
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 118773525397
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 118773525758
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 118773525314
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 118773525543
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 118782388009,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118782388009"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118773518653,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118773518653"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118773524938,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773524938"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118773525324,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525324"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118773525188,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525188"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118773525397,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525397"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118773525758,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525758"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118773525314,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525314"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118773525543,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39464872230/job/118773525543"
        }
      ],
      "head_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "id": "sha256:93cd318540ff1af75d3dae3696e29f3ebcb78c07d79a53fb3a3b8dc5d099c538",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "pr259",
    "base_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
    "body_digest": "sha256:668be788913292ee68d99b66002f6fddbe43076be3271d2018f9ff1c58920558",
    "diff_digest": "sha256:a576aade568ec890f473fbebaa34078fe5a042bb56befa2ab99173af8d77c91f",
    "head_ref": "pr260",
    "head_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
    "pr": 260,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:7a1e2cb93f4520c6fffee4a59c75752ced2122d80b5a6449f486bc041772028d",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:6a488c15200d8d9cf56286855c2480cea4f78141f74584b2914ee23327174f16",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      },
      {
        "digest": "sha256:ebe0056f710b463b04662bf97917d26f3a8fafc5864b75079bf7077e2c91bdae",
        "path": "tools/conformance/multiidentity/READINESS.md"
      }
    ],
    "title_digest": "sha256:1a5b13d043ae713e4595127afa1b0db8d545741f87f63d8500c31d389a640552"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-20T17:18:06Z",
      "base_ref": "pr259",
      "base_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "body_digest": "sha256:8634efc886e7b6714c1bc9734b051361f0ec0d08461e9a7ba724ee69755c3a7d",
      "created_at": "2026-10-20T17:30:26Z",
      "head_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "id": 6297028376,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr259",
      "base_sha": "771263cb4cc2b63893332848ae701bd21ab93c78",
      "body_digest": "sha256:2c797c1add0cfe816d22b3e4a8490c58fb26b8c0241450dc186657b2ffe47ead",
      "commit_id": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "id": 6297062927,
      "inline_message_ids": [],
      "request_comment_id": 6297028376,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T17:32:11Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:aab3796450a3c292a543f41d06d30c960f3e16e785a8e18dd3a6c94038aee4f7",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:a576aade568ec890f473fbebaa34078fe5a042bb56befa2ab99173af8d77c91f",
      "finding_ids": [],
      "invariants": [
        "Exact/bounded numerical geometry preserves protected container-to-host assignments and rejects host reuse, retaining omitted reservations.",
        "Typed selected staging input preserves original blueprint/build authority and never grants execution admission."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "review_observation_id": null,
      "review_request_id": 6297028376,
      "review_result_id": 6297062927,
      "reviewed_head": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "root_cause": "No current source defect. Regular review clean; all exact-head checks and complete local validation pass. CLI-only metadata correction resolved in validation evidence, no source change.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-20T17:27:52Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T17:32:13.316711Z	`ba972bc`	Manual request
🔒 Security Review	✅ Completed 2026-10-20T17:29:50.519523Z	`ba972bc`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-20T17:30:26Z

@codex, regular review ba972bc

chatgpt-codex-connector · 2026-10-20T17:32:11Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: ba972bc696

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr259 October 20, 2026 17:18

omry added this pull request to stack #238 October 20, 2026 17:19

omry marked this pull request as ready for review October 20, 2026 17:27

omry added the approved PR reviewed and approved label Oct 20, 2026

This was referenced Oct 20, 2026

B4: retain deployment identity authority and guard destructive transitions #262

Open

B5: preserve pending identity mappings through checked recovery #264

Open

Navigation Menu

Repository navigation

B3: validate mapping geometry and protect retained assignments - #260

B3: validate mapping geometry and protect retained assignments#260
omry wants to merge 1 commit into
pr259from
pr260

omry commented Oct 20, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

omry commented Oct 20, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 20, 2026 •

edited

Loading

gitar-bot Bot commented Oct 20, 2026 •

edited

Loading

omry commented Oct 20, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading