Repository navigation
Promote main back into dev after coordination release - #159
Merged
Merged
Conversation
…-6de6a8b05219 Promote coordination plane from dev to main
Reviewer's GuideThis promotion reconciles main into dev and carries the coordinated release’s security and robustness changes: bounded and fail-closed file/JSON processing, explicit origin-to-project authorization, relationship-aware sync validation, lock-stable kickoff export, recoverable projection publication, stricter schema and credential checks, and isolated conformance fixtures. No new product behavior is introduced beyond the commits already merged to main by PR #158. Sequence diagram for lock-stable kickoff exportsequenceDiagram
participant CLI
participant Kickoff as open_kickoff_pack
participant Snapshot as authorized_coordination_snapshot
participant Renderer as render_kickoff_prompt
participant Stdout
CLI->>Kickoff: open_kickoff_pack(vault, project, repo_root)
Kickoff->>Snapshot: authorized_coordination_snapshot(vault)
Snapshot-->>Kickoff: authorized snapshot and lock
Kickoff-->>CLI: kickoff pack
CLI->>Renderer: render_kickoff_prompt(pack)
Renderer-->>CLI: prompt or JSON receipt
CLI->>Stdout: print and flush output
CLI-->>Snapshot: release authorization lock
Sequence diagram for relationship-aware pull validationsequenceDiagram
participant Hub
participant Client
participant Validator
participant Storage
Hub->>Client: pull response with TaskPackets and WorkReceipts
Client->>Validator: _validate_pull_record_relationships(by_pair)
Validator->>Validator: current_coordination_task_leaves(tasks)
Validator-->>Client: validated exact task, project, label, and writer relationships
Client->>Storage: apply_pull_response(response)
Storage-->>Client: advance sync state
Flow diagram for bounded fail-closed coordination readsflowchart TD
A[Read local coordination artifact] --> B{Regular file and within byte limit?}
B -- No --> C[Reject with typed validation failure]
B -- Yes --> D[Check JSON nesting depth]
D --> E{Depth supported?}
E -- No --> C
E -- Yes --> F[Decode and validate JSON]
F --> G{Valid canonical artifact?}
G -- No --> C
G -- Yes --> H[Use artifact without advancing state on failure]
Flow diagram for recoverable projection publicationflowchart TD
A[Push local coordination pairs] --> B[Write receipt and membership manifest]
B --> C{Both projection files durable?}
C -- No --> D[Ignore incomplete historical projection]
D --> A
C -- Yes --> E[Acknowledge admitted pairs]
E --> F[Advance current sync marker]
C -- Unsafe or oversized --> G[Fail closed without advancing state]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary by QodoReconcile the reviewed coordination release from main into dev
AI Description
Diagram
High-Level Assessment
Files changed (29)
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Fixed security issues:
- Command injection from untrusted input passed to OS command execution (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="artifact_memory/coordination_sync.py" line_range="2651-2670" />
<code_context>
+ record
</code_context>
<issue_to_address>
**Valid receipts fail without task visibility**
When a principal has permission to sync WorkReceipts but not TaskPackets, and the pull contains an authorized WorkReceipt whose task is therefore absent, `_validate_pull_record_relationships` requires every WorkReceipt’s exact TaskPacket to appear in the pulled membership. A label can grant `syncWorkReceipts` without granting `syncTaskPackets`, so an otherwise authorized receipt-only response is rejected and the caller cannot complete sync.
Either require the TaskPacket grant whenever WorkReceipt sync is granted, or validate receipts without requiring the caller to receive a task it is not authorized to access.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and this changes the authorization and trust-boundary logic for coordination-record admission, including server-owned origin-to-project mapping and read-permission checks. If that policy is wrong, records may be admitted or exposed incorrectly from the moment it ships, and reverting would not undo immutable records or projections already created.
Blocking findings: artifact_memory/coordination_sync.py:2670
Code Review by Qodo
1. Reconfiguring a hub silently drops its origin policy
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Source-bound promotion
origin/main5e7b5ca9778fa420be8ad09bb72cab48015e0ec7dev6de6a8b052199bc45f12882b9aa69503c7f73b88devis a strict ancestor of the source snapshot; this PR is a fast-forward-equivalent reconciliation through the protected branch lane.This branch is pinned to the merged
mainsnapshot above. Latermaincommits are not included automatically.No new product changes are introduced beyond the commits already merged to
mainby PR #158.Summary by Sourcery
Harden coordination synchronization and onboarding against unsafe, oversized, inconsistent, or unauthorized state while preserving recoverable exports and typed failures.
New Features:
Bug Fixes:
Enhancements:
Documentation:
Tests: