construction: add GitHub connector publisher gate - #192
Conversation
Codex reviewer (cross-vendor, read-only)Reviewed-head: 0328f40 Posted verbatim by The publisher gate does not enforce the construction mode's append-only restore-manifest invariant. It can therefore authorize changes that weaken the repository's backup guarantees. Review comment:
|
Deploying ystack with
|
| Latest commit: |
8e90fe1
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://af9ca5c4.fabrica-6yx.pages.dev |
| Branch Preview URL: | https://codex-construction-native-pu.fabrica-6yx.pages.dev |
Formal review response — comment 5468570616New exact head: The P1 restore-manifest finding is fixed at the root. Preflight now reads New regressions remove a post-mode ingress entry and duplicate it. Both reach the intended manifest rail and fail closed. Publisher proof is now 118/118. Exact-head proof:
All CI and review evidence on |
…nstruction-native-publisher # Conflicts: # ci/required-files.txt
Exact-base refreshThe default branch advanced while the P1 fix was being verified.
The only conflict was the append-only restore manifest. Resolution keeps the new profile-graph entries from main, then appends the two publisher entries. Relative to the new base, the candidate still changes exactly the same three allowed paths. Fresh exact-head proof:
Every earlier CI and review is stale. Fresh CI and formal independent review must bind this exact head/base. |
Codex reviewer (cross-vendor, read-only)Reviewed-head: 72068c8 Posted verbatim by Postflight can issue an authoritative-looking completed receipt from a well-formed but fabricated preflight record. This undermines the gate's core review and CI evidence guarantees. Review comment:
|
Formal review response — comment 5468659263New exact head: The P1 receipt-authentication finding is fixed at the trust boundary. Postflight now requires the original Before any completed receipt, it then re-reads and validates from GitHub:
Only then does it re-read the head tree, squash parent/tree, and main. Any mismatch produces New regressions cover a well-formed forged CI run ID, matching forged request+review evidence, matching forged request+path evidence, divergent ancestry, and moved PR #183. Publisher proof is now 130/130. Exact-head proof:
All CI and review evidence on |
Codex reviewer (cross-vendor, read-only)Reviewed-head: 1be38f2 Posted verbatim by The publisher gate treats a moving property of frozen PR #183 as immutable. This prevents normal preflight after Review comment:
|
Review response — comment 5468742253The proposed After main advanced to
still returned:
That is exactly the mode's frozen tuple even though current main is now several commits ahead. The moving target-branch tip is checked separately through No code changes were made for this finding. Separately, main moved during the review, so the review is stale regardless of this disagreement. The branch will now merge exact main |
…nstruction-native-publisher
Exact-base refresh — construction authority policyThe parent construction pipeline merged policy PR #194 while the prior review was running.
The new policy explicitly says the active identity-matching ystack-self construction overlay is the sole narrow merge exception and authorizes only its named publisher after exact gates pass. No publisher code changed during this refresh. Fresh exact-head proof:
The review on base |
Codex reviewer (cross-vendor, read-only)Reviewed-head: 8e90fe1 Posted verbatim by The frozen-PR validation treats normal movement of Review comment:
|
Codex reviewer (cross-vendor, read-only)Reviewed-head: 8e90fe1 完成 Bugs、Security、Compliance 三轮只读审查。
无 unresolved Important。 重复的 PR #183 |
1 participant
Concern
Add one construction-only GitHub publisher boundary for yihanzhu/ystack. It closes the current gap where the repository authorizes the active construction session, GitHub no longer requires an approval, but the Codex shell host correctly blocks generic merge commands.
Exact candidate:
94afa6a925c203051133f3017589f1848ee580c88e90fe120aab0a5cb378ca8bd9f3ed8451684815codex/construction-native-publisherFiles
scripts/construction-publisher-gate.sh.ci/required-files.txt.No workflow, mode record, no-merge guard, existing merge helper, review harness, accepted artifact, live yshifu path, external target, frozen PR #183 state, or preserved portable-core state changes.
Boundary
The repository script is read-only. It never merges, pushes, updates a ref, posts a comment, calls a model, or executes candidate code.
It must run by absolute path from an installed trusted main worktree whose HEAD equals the reviewed base. It binds that local gate and test to the same blobs on GitHub. It pins github.com, repository ID 1270665750, the exact active mode blob, Roadmap and north-star blobs, ruleset 21500323, squash-only settings, allowed paths, restore entries, the complete reviewed-base restore manifest, and frozen PR #183.
The active construction session must first read the complete independent review and observe the purpose-built connector identity. The natural-language review has no machine verdict. The request says this plainly with
machine_verdict_available:false; the current mode-authorized session supplies the semantic no-Important decision, bound to the exact comment ID, body SHA-256, head, and base. The P0-P2 scan is only an added fail-closed check.CI must be the unique latest successful
cicheck from app 15368 on the exact head. Ruleset, review, CI, PR, and main are read again late. The final preflight read is main. The emitted write is fixed to the first-classgithub_merge_pull_requestconnector withexpected_head_shaandmerge_method:squash. If that connector is refused or unavailable, the session stops; there is no gh, REST, GraphQL, auto-merge, update-ref, or other fallback.GitHub has no base-SHA CAS in this merge API. The output records
atomic_base_cas:false. The late base read, exact head precondition, strict required-check ruleset, and no-bypass identity close the practical race. Postflight takes the original request, revalidates every authorization fact from GitHub, then re-reads the head tree, PR merge record, squash commit, its single parent, tree, and main. It emits a hashed canonical receipt only when all match. An uncertain connector response is reconciled read-only. A refusal followed by an out-of-band merge never receives a completed receipt, and every failed reconciliation says not to retry blindly.Proof on exact head
bash scripts/test/run-all.sh: all 12 test scripts passed.git diff --check: clean.The 2,004-line diff exceeds the soft size signal because this is one security boundary with explicit input schemas, exact GitHub state checks, post-write reconciliation, and 118 hermetic cases. Product code is 1,181 lines; the 819-line fake-GitHub proof and four manifest lines make up the rest. Splitting the proof from the gate would make the fixed CI runner review only part of the boundary.
Inactivity
This PR does not install or activate a live profile, workflow, credential, release, deployment, or target integration. The connector call is an existing host capability, not code in this branch. This candidate cannot publish itself and must not be merged by this task. After an operator merges it, a later construction session may use the installed trusted-base copy for another exact PR.
PR #183 remains open at its frozen tuple. The portable-core implementation worktree remains untouched. The dirty parent-plan worktree remains dirty only at its pre-existing plan file.