Repository navigation
Harden security checks and separate K9/DEED governance evidence - #243
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 20 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Fork governance
🟣 critical · commit
Hypatia scan: 131 finding(s)
panic-attack assail: 17 finding(s)
pons asinorum: 1 finding(s)
rhodibot (RSR compliance): not_run — enrolled, but no report-back was received
panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received
echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received
seambot (integration health: API routes): not_run — enrolled, but no report-back was received
finishingbot (release readiness): not_run — enrolled, but no report-back was received
accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received
glambot (presentation quality): not_run — enrolled, but no report-back was received
cipherbot: not_applicable — no cryptography is implemented in this repository
sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)
Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. 🟢 conformant · commit
K9 live corpus (L0–L2): 1 finding(s) / scope notes
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. |
|
Hosted checks exposed two upstream-wrapper issues, fixed in the latest commit: (1) K9 rendered its valid grid but a terminal optional corpus-log copy returned 1 for the empty corpus; the local wrapper now uses an explicit conditional, preserving canonical validation/ratchets, with three regression cases. Failed jobs also take precedence over a rendered green status in the summary. (2) Gitleaks 8.18.4 flagged historical biological data and JS schema labels. Reproducing its legacy rules found 211,428 matches, dominated by low-entropy DNA/FASTQ. The wrapper now uses upstream Gitleaks 8.30.1 with its release-asset SHA256, retaining the same standards baseline and all history/working-tree/shell checks. No local suppressions or history exclusions were added. Current local history/tree scans pass; a synthetic AWS credential still fails under the expected detector, and that sensitivity test is now in CI. Hosted scans are rerunning. Governance contract now has 39 passing checks. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1fdb6e830
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 similar comment
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Follow-up: addressed all four Codex scanner findings and resolved the review threads, with tests for redaction, deleted historical shell credentials and AsciiDoc error handling. The first custom history run also caught a variable-reference test fixture; matching exemptions per assignment fixes that without letting a harmless variable hide a literal credential later on the same line. The latest completed scanner run (39988118383) passed all working-tree/history/AsciiDoc/shell/Rust checks. Sonar then flagged Bash conditional/default-case practices and HTTPS redirects; those have now been corrected and checks rerun. Full integration CI is still required on the newest commit; this PR remains unmerged. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 similar comment
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…ntials Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…ical test fixtures Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
1be406d to
2b62def
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Landing update and CI repair#243 is now merged as I have opened #247 from the same session branch, based on the merged main, containing only removal of the duplicate three-line timeout block. No security, application, test, licensing or frontend changes are reverted. The single 90-minute limit remains. Main currently fails to load CI; #247 restores valid YAML and its hosted CI jobs now start. Local final-head checks: 8 unique-key workflow parses, 84 embedded Bash parses, 39 governance assertions, 8 rejected weakening mutations, all 4 producer/logger exit combinations, and git diff checks pass. New Julia/R integration remains pending; no old-head success is substituted for final-head validation. #247 must land before this CI defect is considered repaired on main. |
…I workflow - Read req.body non-destructively in _statistics_body via copy(req.body), enforce MAX_STATISTICS_REQUEST_BYTES using UTF-8 byte length (ncodeunits) when req.body is already an AbstractString, and accept generic AbstractString payloads (e.g. SubString). - Add regression tests in test_validated_statistics.jl covering repeated reads of the same HTTP.Request, multibyte UTF-8 size limits, and SubString payloads. - Remove the duplicate timeout-minutes key in .github/workflows/ci.yml introduced by the PR #242/#243 merge, run validated_statistics first within the fast pre-flight CI step, and SHA-pin actions/checkout in .github/workflows/doi.yml. Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Main moved while this branch was in review: #242 made tree path building linear in `TreeShapes.tsx`, and #243 taught the cladistics builder the node-local subtree-PD convention. Both are the fixes this branch carried, so the merge keeps main's implementation and drops the duplicates rather than shipping two spellings of the same change. What remains branch-specific is what main does not have yet: the `_request_json` guard for malformed bodies (and its Oxygen serializer hook), the report-backs directory the deed declares, and the two type-only test assertions panic-attack flagged. Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
## Fix Remove the second `timeout-minutes` key from the Julia job in `.github/workflows/ci.yml`. Retain the explicit 90-minute budget and all existing tests, relevance gates, and required context names. #243 merged as `a9fb609` with overlapping 90- and 60-minute YAML keys. Main workflow run `39990718300` consequently failed before jobs could start. This is a focused three-line repair, not a waiver of CI. This carries the exact tree of #247 (`46665dd`) onto the current session branch with the repository-required DCO signoff; #247's commit has no `Signed-off-by:`. The commit parent is current main `a9fb609`, with no merge commit and no other file changes. Duplicate replacement #252 was closed after #243 merged. ## Verification on the exact tree - Governance contract: **39/39 passed**; all **8 weakening mutations rejected** - CI producer/logger exit combinations: **4/4 passed**; K9 optional-log cases: **3/3 passed** - Scanner boundaries: working-tree and deleted-history shell credentials blocked without disclosure; Rust findings redacted; all six clean/error/finding AsciiDoc cases passed - Unique-key YAML parsing passed for **11 files**; `bash -n` passed for **84 embedded run blocks** - Equivalent local clone: full-history custom shell scan and real Gitleaks 8.30.1 working-tree/history scans clean - `git diff --check` passed - Post-#243 default-branch Scorecard run `39990720761` succeeded through analysis, SARIF upload, and artifact upload Julia/R execution requires hosted CI; no local runtime pass is claimed. #247's hosted run `39990855274` is testing the same tree, but this commit will also retain its own fresh checks. ## Scope - [x] Current-main ordinary commit with `Signed-off-by:` (DCO) - [x] Only `.github/workflows/ci.yml` changed - [x] No application, dependency, licence, generated, or vendored-file changes Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
#243 merged a ci.yml with two `timeout-minutes` keys on the Julia job, so the workflow failed before any job started (run 39992746854 on this branch had zero jobs). #254 removes the duplicate; the merge carries it so the suite can actually run. Signed-off-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Post-merge reconciliation and validation are complete. #243 merged as Final main-branch evidence at |
Scope
Security/governance follow-up to #227. All four Codex findings on that old PR already landed in #229/#234 and follow-ups; I answered/resolved its threads and closed it as superseded, rather than merging a conflicting branch that could undo newer fixes. CodeRabbit's remaining notices are account limits/billing, not code questions.
Changes
Verification
Bun 1.3.10: frozen install, TypeScript checking, 72 frontend tests / 200 assertions, production build, and high/critical audit pass. Full audit reduced from 31 advisories (1 critical, 13 high, 14 moderate, 3 low) to 2 moderate Router advisories. This is not a zero-vulnerability claim.
Canonical pinned DEED lint, all 39 governance contract checks, 8 weakening mutations, 4 pipeline-exit combinations, unique-key YAML parsing, all embedded shell syntax, Sonar reliability lint, proof axiom audit (7 modules), and git diff checks pass locally.
Julia/R/Agda/Nickel are not installed in this sandbox; hosted CI must supply those results. No local runtime/semantic pass is claimed.
Hosted wrapper fixes
The first run found two issues in the pinned standards wrappers. Fork-local copies retain the same immutable standards validator/renderer/config sources and all gates, but fix the terminal optional-log copy for an empty K9 corpus and upgrade Gitleaks from 8.18.4 to 8.30.1 (upstream release-asset digest). The old rules falsely matched historical DNA/FASTQ and schema labels; no history exclusions or local rule suppressions were added. A synthetic AWS credential must still fail in CI. Three K9 copy cases and a credential-sensitivity test also pass locally. Hosted checks are rerunning.
Remaining / intentionally not done
See
docs/release-notes/2026-10-23-governance-security.mdfor the source Hypatia run and complete triage. Two moderate React Router advisories need a v7 migration review. Estate language bans conflict with the settled React/TS stack and independent Python reference oracles; W3C SVG namespace URIs are not HTTP requests. Do not fix those by rewriting the architecture or breaking namespaces. No configured mirror target exists. Existing upstream licensing headers remain protected. Fleet bots without report-backs remain not_run. No fake conformance reports have been added.The integration returns 403 for code-scanning/Dependabot alert listing and the sandbox blocks Actions artifact/log storage hosts; no alerts have been dismissed. Published grids/check APIs are still readable. Scorecard's default-branch publication can only be verified after landing; K9 has no committed contracts and therefore cannot claim substantive contract coverage yet.
PR #228 security follow-up (
1be406d)Independent verification found that the recorded conflict-resolution tree for #228 is identical to main; #228 is being closed as superseded, not conflict-merged. Its valid leaf-PD finding is already implemented in unmerged #242/#244 and is not duplicated here. #242's integration run 39986326202 passed all six jobs; #244's Julia validation remains pending at review time.
The R-evaluation warning was not dismissed as a language-detector false positive. This follow-up validates metadata column identifiers before they enter PERMANOVA's parsed R formula and validates package names before provenance interpolates them into R source. Expressions, quotes/escapes, controls and reserved formula terms are covered by regression cases. Plain identifiers preserve the existing formula and scientific tests; non-identifier metadata columns must be renamed, as documented in the function contract.
Local verification for the new commit: 39 governance assertions, 8 weakening mutations, 3 K9 copy cases, 4 CI logging cases, scanner-boundary tests, complete working-tree/history shell scanning, git diff checks and syntax parsing of all four changed Julia files pass. Syntax parsing is not execution: the new Julia/R regressions await hosted CI. This does not certify all remaining R call sites or dismiss outstanding advisory findings.
Main advanced during review
#242 has now merged as
b656d2a99e53267108d51ad87d7eaee13222d368(16:46:42 UTC), after its full integration suite passed. The leaf-PD fix is therefore on main. #228 is confirmed closed/unmerged. This PR (#243) now has conflicts with the newly updated main and is not merge-ready; no main-merge commit or unrequested history rewrite has been made. The new R-boundary/scanner tests are running at1be406d; earlier passing checks must not be mistaken for validation of a future rebased head.