feat(release): require exact canary evidence - #40
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0702650f18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "canary", | ||
| `${prepared.artifact.packageVersion}.json`, | ||
| ); | ||
| await writeImmutable(path, Buffer.from(canonicalJson(record))); |
There was a problem hiding this comment.
When the documented prepare → record → qualify flow is followed, this writes the canary into the repository after prepareCanary captured its ArtifactIdentity; the session/transcript files are written there as well. The subsequent qualification rebuild calls inspectArtifact, whose source digest includes tracked and untracked repository files, so it rejects the canary as belonging to a different artifact, and committing these records also changes the sourceCommit checked by the tag workflow. Consequently no canary produced by this command can satisfy the new strict release gate; the artifact identity must remain reproducible after evidence is persisted.
Useful? React with 👍 / 👎.
| return mapStrings(normalized, (text) => | ||
| scrubSecrets(text).replace( | ||
| /\b(?:ses_[A-Za-z0-9]+|(?:session|review):[A-Za-z0-9-]+)\b/g, | ||
| "<redacted-id>", | ||
| ), |
There was a problem hiding this comment.
When exported session or transcript JSON contains an opaque credential under a sensitive key, such as { "password": "correct-horse-battery-staple" }, this maps and scrubs each key and value independently, so scrubSecrets never sees the key/value association and the value does not match any token-prefix pattern. The plaintext is then written to the committed canary artifact despite being described as sanitized; use field-aware recursive redaction in addition to string-pattern scrubbing.
Useful? React with 👍 / 👎.
2 participants
Summary
Verification
Manual stop gate
The maintainer-run OpenCode canary and resulting canary-bound VERIFIED decision are intentionally not fabricated. Phase 9 release readiness remains INCONCLUSIVE until those reviewed files are committed. No tag or release is requested.