Repository navigation
fix: freeze review package directory inputs by receipt - #364
Conversation
Co-Authored-By: Jinni <342598851+fj-jinni[bot]@users.noreply.github.com> Co-Authored-By: Naru <342599188+fj-naru[bot]@users.noreply.github.com>
Co-Authored-By: Naru <342599188+fj-naru[bot]@users.noreply.github.com>
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce91749003
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (asArray(record.files).some(f => isObject(f) && typeof f.path === 'string' && f.path.startsWith(`${name}/`) && f.path !== bound)) { | ||
| throw new Error(`config.${ref.at}: directory input ${name} must bind only ${bound}`); |
There was a problem hiding this comment.
When a config names both assemble.occluders[0].plate: "inputs/plate" and assemble.occluders[0].image: "inputs/plate/plate.png", packageCommand copies the receipt and the explicitly named image, publishes the package, and updates project.json successfully. However, this new predicate rejects that same inventory, so the next check reports REVIEW_PACKAGE_INPUT_INVALID and handoff readers also throw. Apply the directory-inventory validation in the writer before publishing, so it cannot record a package that its checker immediately refuses. This also violates the shared writer/check validation requirement in AGENTS.md.
AGENTS.md reference: AGENTS.md:L95-L97
Useful? React with 👍 / 👎.
Co-Authored-By: Jinni <342598851+fj-jinni[bot]@users.noreply.github.com> Co-Authored-By: Naru <342599188+fj-naru[bot]@users.noreply.github.com>
|
Accepted the P1 overlap finding. The writer now runs the shared input validator before publication, explicitly named siblings remain independent config inputs, and frozen registration regeneration retains them. The exact overlap and refused-write controls reproduced 2 failures before the fix; final focused verification is 55 review-package and 40 config-input tests passing, plus typecheck/lint. No second review requested. |
A config-named occluder plate directory was rejected as a non-file by review-package. Freeze its producer receipt bytes and hash instead, resolve that receipt when reading stored packages, and keep sibling raster measurements owned by the producer. The directory identity remains the config reference resolved to its receipt in the existing files inventory.
Closes #328.
Validation: review-package 55 pass and config-inputs 40 pass; typecheck and lint exit 0. The accepted P1 overlap finding is fixed: explicitly named sibling images remain independent bound inputs, and shared writer/check validation runs before publication. Its two new controls failed before the repair and pass afterward. No second review requested. Full acceptance is PR CI.
Installed Review 2.7.0 omits occluder inputs in handoff exports. A fresh isolated Review 2.7.1 + Parts 2.36.0 probe confirms both separate and overlapping image/plate cases have all 9/9 files, versus 7/9 under 2.7.0, with four reader exits at 0. This was already fixed by rig-c/review#591; duplicate #598 is closed. This PR does not change the repository's dependency pin.