fix: elevation sweep revoke payload 序列化（W2-C4 实测缺陷） - #443
Conversation
…测缺陷） 实测（run 33246847376/33246848965）两缺陷： - org 仓 owner 的 author_association 呈 MEMBER 而非 OWNER（一人公司语境 MEMBER 即 owner 本人）→ 正向请求被误判 role=none 而拒； - 裁决 role=none 直写影子账本 actor.role → 枚举校验 exit 3（合法集 owner/agent/bot/human），deny 记录落账失败。 修复：OWNER/MEMBER→owner；none→human（事实身份）入账。 Card: #415
实测（run 33247268672）：sweep 到期 grant 补 revoke 时 payload 以对象形态 构造 → evidence_shadow 枚举校验 exit 3（schema v1 要求 payload=字符串或 null）。改 |tojson（与 adjudicate job 同款）。 Card: #415
PR Summary by QodoFix elevation role mapping and revoke payload serialization
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review. 📝 WalkthroughWalkthrough变更概述更新 ChangesElevation 工作流
Suggested labels: Merge Risk: ⚪ Minimal · up to This localized workflow change has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 1 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (1 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Review by Qodo
1. Members gain owner authorization
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| # role 判定锚点机械（INV-01）：OWNER/MEMBER→owner（org 仓 owner 的 | ||
| # author_association 呈 MEMBER——一人公司语境 MEMBER 即 owner 本人， | ||
| # 2026-08-29 实测）；cloudbrid-agent App→agent；其余→none | ||
| if [[ "$AUTHOR_ASSOC" == "OWNER" || "$AUTHOR_ASSOC" == "MEMBER" ]]; then ROLE=owner |
There was a problem hiding this comment.
1. Members gain owner authorization 🐞 Bug ⛨ Security
Mapping every MEMBER comment author to ROLE=owner gives all organization members the owner-only elevation permissions, regardless of their repository or organization privileges. GitHub defines MEMBER as any member of the owning organization, and the adjudicator directly grants owner capabilities from this value.
Agent Prompt
## Issue description
`author_association=MEMBER` identifies any organization member, not specifically an organization owner, so treating it as `owner` widens elevation authorization.
## Issue Context
Organization-owned repositories do not provide sufficient owner privilege information through this association alone. Resolve the requester against an explicit trusted-owner allowlist or a GitHub API check that verifies organization-owner status before passing `role=owner`; otherwise use `none`.
## Fix Focus Areas
- .github/workflows/elevation.yml[66-74]
- governance/policy/elevation.yaml[20-34]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| else ROLE=none; fi | ||
| # 影子账本 actor.role 枚举（owner/agent/bot/human）：裁决 role=none 的 | ||
| # 请求方按事实身份记 human（none 非法枚举——实测 exit 3） | ||
| if [[ "$ROLE" == "none" ]]; then AROLE=human; else AROLE=$ROLE; fi |
There was a problem hiding this comment.
2. Bot requesters recorded human 🐞 Bug ◔ Observability
The new none → human conversion records every unrecognized automation account as a human, because bots other than cloudbrid-agent[bot] also receive ROLE=none. This corrupts the actor-role field of deny events in the evidence ledger and makes machine-originated requests appear human-originated.
Agent Prompt
## Issue description
Audit-role normalization currently converts all unauthorized requesters to `human`, including GitHub App and bot accounts.
## Issue Context
Keep authorization role (`owner/agent/none`) separate from evidence actor type. Derive the audit role from `github.event.comment.user.type` or an equivalent reliable bot indicator, using `bot` for automation and `human` only for users.
## Fix Focus Areas
- .github/workflows/elevation.yml[69-75]
- .github/workflows/elevation.yml[111-116]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Card: #415
摘要（W2-C4 实测缺陷修复 #2）
AC-9d TTL 收回实测（run 33247268672）：sweep 到期 grant 补 revoke 事件时 payload 以 JSON 对象形态构造 → schema v1 校验（payload 须字符串或 null）exit 3，revoke 落账失败（fail-closed 红，无静默）。修复：
|tojson序列化（与 adjudicate job 同款）。ADR
Summary by CodeRabbit