fix(evaos): expose Mac-control canary blockers - #711
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
evaOS review status: completedPR: #711 - fix(evaos): expose Mac-control canary blockers evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #711 Review URL: #711 (review) |
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #711 - fix(evaos): expose Mac-control canary blockers
Head: 3d6d4b92064a74e600a3613991753179a9532509 into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~68 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-live-canary-proof.yml |
modified | +7/-1 | Changed file | Low |
scripts/evaosBrokerLiveCanary.js |
modified | +165/-8 | Changed file | Moderate: validated P2 finding |
scripts/evaosLiveCanaryReadiness.js |
modified | +2/-0 | Changed file | Low |
scripts/evaosProvisionLiveCanaryFixtures.js |
modified | +33/-2 | Changed file | Low |
scripts/evaosScanMacControlProofs.js |
modified | +91/-0 | Changed file | Low |
tests/unit/evaos/evaosBrokerLiveCanary.test.ts |
modified | +322/-24 | Test coverage | Elevated: large change |
tests/unit/evaos/evaosLiveCanaryReadiness.test.ts |
modified | +3/-0 | Test coverage | Low |
tests/unit/evaos/evaosLiveCanaryWorkflow.test.ts |
modified | +64/-0 | Test coverage | Low |
tests/unit/evaos/evaosProvisionLiveCanaryFixtures.test.ts |
modified | +57/-3 | Test coverage | Low |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 1, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Proof gap: 1
- Runtime correctness: 1
- Security boundary: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #480.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d6d4b9206
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
evaOS review status: completedPR: #711 - fix(evaos): expose Mac-control canary blockers evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #711 Review URL: #711 (review) |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #711 - fix(evaos): expose Mac-control canary blockers
Head: 6d47115ea5955b66e616b3c9d4dbdf2fd98b84ef into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~68 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-live-canary-proof.yml |
modified | +7/-1 | Changed file | Low |
scripts/evaosBrokerLiveCanary.js |
modified | +166/-8 | Changed file | Low |
scripts/evaosLiveCanaryReadiness.js |
modified | +2/-0 | Changed file | Low |
scripts/evaosProvisionLiveCanaryFixtures.js |
modified | +32/-2 | Changed file | Low |
scripts/evaosScanMacControlProofs.js |
modified | +91/-0 | Changed file | Low |
tests/unit/evaos/evaosBrokerLiveCanary.test.ts |
modified | +330/-24 | Test coverage | Elevated: large change |
tests/unit/evaos/evaosLiveCanaryReadiness.test.ts |
modified | +3/-0 | Test coverage | Low |
tests/unit/evaos/evaosLiveCanaryWorkflow.test.ts |
modified | +64/-0 | Test coverage | Low |
tests/unit/evaos/evaosProvisionLiveCanaryFixtures.test.ts |
modified | +70/-3 | Test coverage | Low |
Review Signal
No validated inline findings.
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
No finding categories.
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #480.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
Durable v2.1.36 / Mac Access handoffCanonical GUI lineage:
Changed paths are limited to:
Connector contracts future Mac Access must inherit:
Server dependencies:
Proof state:
Mac Access #699/#707 may safely refresh from |
v2.1.36 beta.1 signed-artifact checkpointThis is artifact evidence only. Publication remains disabled; no runtime or customer-readiness claim is made.
Final SHA-256:
Updater metadata names the exact ZIP and its declared size Still fail-closed: no approved organization-controlled pristine/staging Mac is currently available for clean onboarding, canonical enrollment/binding, selected-binding callback/direct-control receipt, or installed interactive proof. RC/live canaries and public distribution remain pending. The stale original |
1 participant
Description
Related Issues
Type of Change
fix- Bug fix (non-breaking change which fixes an issue)feat- New feature (non-breaking change which adds functionality)perf- Performance improvementrefactor- Code restructuring (no behavior change)docs- Documentation updateAtomic PR Checklist (Rule 1)
<type>(<scope>): <subject>in EnglishLocal Checks (Rule 2)
bun run formatorbunx oxfmt --check <changed files>- formatting passesbun run lintor targetedbunx oxlint <changed files>- no lint errorsbunx tsc --noEmit- no type errorsbunx vitest runor focusedbun run test -- <files>- 301 files passed, 1 skipped; 2,820 tests passed, 3 skippedbun run i18n:types+node scripts/check-i18n.js)git diff --check- no whitespace errorsRuntime Verification
Source validation is complete. This PR does not claim a live selected-binding callback, direct Mac-control receipt, signed/notarized installed-app proof, or customer readiness.
Agent Handoff
100yenadmin/evaOS-GUIget_private_network_readinessexact request/response and freshness bounds;evaos.mac_control.live_canary_failure.v1; strict-vs-partial proof separation; cleanup temp-to-final publicationcustomer-mac-controlanddesktop-runtime-sessioncontracts on currentorigin/main; canonical beta base0cf0c3092587ecbaa301cc9fbd18408ca8e0a664actionlint; four-lane adversarial review of the full PR plus an independent 98% exact-delta review at the final head; repositoryjust pushgate with 2,820 passing testsScreenshots
N/A — release-canary and proof-contract change only.
Additional Context
Exact head:
6d47115ea5955b66e616b3c9d4dbdf2fd98b84ef.The existing isolated-staging Mac fixture is not yet a truthful live connector: its enrollment/grant lineage and Headscale node are stale. That remains an explicit post-merge runtime gate; this PR makes the next run fail with exact safe evidence instead of collapsing to
invalid_responseor losing the artifact.