Repository navigation
Conversation
…mands createDepartment, createTeam, and createFieldOfStudy take OrganizationAdministratorEvidence instead of the OrganizationActor union. requireOrganizationAdministrator is its only constructor, so a forged or member actor no longer type checks, and the adapter's runtime re-check (decodeOrganizationActor, authorizeOrganizationActor) is deleted. The unused resolveActor option and organizationActorFrom are removed. The stored actor_json keeps its shape, and the authorization-rules proof observes the same tags. Pilot of docs/specs/authz-evidence.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
Flatten the evidence tests: Stryker 10 with Vitest 5 misses failures of tests nested in describe, and killed 18 of 18 mutants once they were top level. The authorization evidence spec records the falsifier results, and STATE.md records the helpers still trusted by convention. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
…ands Add requireDepartmentReach, the only constructor of DepartmentReach<C>, which proves a capability over one department. Three commands whose only barrier was a check at their HTTP caller now take it: - commandOnboarding takes the coordinator's admissions.outcomes reach and reads its department and audited actor from it. - recordAdmissionOutcome takes the decider's reach and denies evidence for another department on the locked application, a check it lacked. - Placements.execute takes a coordinator's placements.coordinate reach for board and coverage-board changes; own affiliation and coverage still act as the person. Property tests show the evidence agrees with reaches, with department administration, with canManagePlacements, and with the outcome Decide permission, so the replaced handler checks keep their answers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
Four commands authorized before replay and then authorized again inside the command, each resolving current authority twice in one transaction. Their authorize step now returns branded evidence, and the command runs from it without resolving authority again: - Schools: SchoolCommandAuthorization carries the decoded command and the locked school and departments; executeCommand takes only it. - Recruitment maintenance: RecruitmentMaintenanceAuthorization carries the decoded command; maintainRecruitment takes only it. - Certificates: authorizeCertificateCommand and CertificateCommandTarget give way to DaysServedConfirmationAuthorization and CertificateIssueAuthorization; the scope, the assistant, the department row, and the issuer's seat come from the evidence. - Team applications: authorize returns TeamApplicationAuthorization for the action; delete and revise take their application or team from it. Schools and maintenance resolved authority at DateTime.now twice; they now resolve it once. Each evidence is valid only in the transaction that resolved it, which is the transaction the command runs in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
listTeamInterestRegistrations took a filter of authorized departments and teams that its HTTP caller computed, so it read whatever scope a caller named. requireTeamInterestScope now computes that scope from the resolved authority, as the handler did, and is the only constructor of TeamInterestReadScope, which the listing requires. The unused departmentId filter is gone; the semester stays an argument. A property test checks that the scope holds only departments and teams that team-interest.read reaches, inside the requested department, and that it denies exactly where nothing is readable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
SocialEvents.create took the creator's person id and trusted its caller to have evaluated the create AccessSpec. requireSocialEventCreation now builds SocialEventCreation from the same candidate grants, and create takes it: the audited actor comes from the evidence, and a request for another department than the evidence names is a defect. A property test states the rule independently of the grants: an active global administrator creates anywhere, an active appointment creates in its department. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
Bun's node:http destroy() emits close but no error, so a probe attempt that timed out never resumed, and waitForHttp outlived its deadline. The golden team-application journey hung for 25 minutes before its first page when the homepage's first request was slow. A probe against a silent listener with a one-second deadline hung past 8 s before this change and fails at 4.1 s after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KmXVLTGJH6D28NK4jkdy3e
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Worker Previews
Previews are frontend-only: pages that read the API show their unavailable state. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Related issue
Checklist