feat: 统一证据查询第 5 源（tickets）+ self-cloud-pool entry 注记 W2-C1 落地（IR-0006 W2-C1 / ADR-0103） - #444
Merged
Conversation
… W2-C1 / ADR-0103） - evidence-query.sh：源 5 = cnb-bridge @ tickets-ledger tickets.jsonl（内网调度器 短票据 grant/revoke，AC-5b 统一账本；404=源缺席非红，链断=fail-closed exit 3） - providers.yaml：self-cloud-pool entry 注记 v0 落位（cnb-bridge/selfcloud） - .gitignore：.scratch/（工作区独立克隆，防 gitlink 误提交坏 CI checkout） - 实测：五源查询 #412 by_source tickets=2（Go 发射器产出，跨语言验链绿） Card: #412
PR Summary by QodoUnify tickets ledger into evidence queries and register W2-C1 entry
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChanges新增 治理证据集成
工作区文件隔离
Suggested labels: Merge Risk: ⚪ Minimal · up to This PR adds the tickets evidence source, updates the provider annotation, and ignores workspace scratch files; no actionable merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 1 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (1 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| DRILL_OK=0; fetch_file "Cloudbird-Software/.github" "drill-ledger" "governance/drill/shadow-evidence.jsonl" "$TMP/drill.jsonl" && DRILL_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| BUTLER_OK=0; fetch_file "Cloudbird-Software/.github" "butler-ledger" "governance/butler/shadow-evidence.jsonl" "$TMP/butler.jsonl" && BUTLER_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| ELEV_OK=0; fetch_file "Cloudbird-Software/.github" "elevation-ledger" "governance/elevation/shadow-evidence.jsonl" "$TMP/elev.jsonl" && ELEV_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| TICKET_OK=0; fetch_file "Cloudbird-Software/cnb-bridge" "tickets-ledger" "tickets.jsonl" "$TMP/tickets.jsonl" && TICKET_OK=1 || [[ $? -eq 1 ]] || exit 2 |
There was a problem hiding this comment.
1. tickets fetch bypasses app identity 📘 Rule violation ⛨ Security
The added tickets-ledger fetch executes a GitHub API operation through gh while the script accepts an arbitrary ambient GH_TOKEN, explicitly including PATs, rather than obtaining a GitHub App token through scripts/ghcb. This extends the non-standard credential path to Cloudbird-Software/cnb-bridge.
Agent Prompt
## Issue description
The new `tickets` source uses the script's caller-provided `GH_TOKEN`/PAT path instead of the repository-standard GitHub App identity.
## Issue Context
Compliance rule 2778539 requires scripts performing GitHub API calls to obtain tokens through `scripts/ghcb` or `scripts/gh-app-token.sh`. Because the query reads multiple private repositories, mint and use an appropriately repository-scoped App token for each fetch rather than accepting an arbitrary PAT.
## Fix Focus Areas
- governance/evidence-query.sh[18-40]
- governance/evidence-query.sh[73-76]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| DRILL_OK=0; fetch_file "Cloudbird-Software/.github" "drill-ledger" "governance/drill/shadow-evidence.jsonl" "$TMP/drill.jsonl" && DRILL_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| BUTLER_OK=0; fetch_file "Cloudbird-Software/.github" "butler-ledger" "governance/butler/shadow-evidence.jsonl" "$TMP/butler.jsonl" && BUTLER_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| ELEV_OK=0; fetch_file "Cloudbird-Software/.github" "elevation-ledger" "governance/elevation/shadow-evidence.jsonl" "$TMP/elev.jsonl" && ELEV_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| TICKET_OK=0; fetch_file "Cloudbird-Software/cnb-bridge" "tickets-ledger" "tickets.jsonl" "$TMP/tickets.jsonl" && TICKET_OK=1 || [[ $? -eq 1 ]] || exit 2 |
There was a problem hiding this comment.
3. 权限失败伪装源缺席 🐞 Bug ⛨ Security
新增 cnb-bridge 仓未纳入脚本仍声明的“两仓可读”令牌契约，而 fetch_file 把所有 HTTP 404 都视为合法源缺席。GitHub 对无权访问的私有资源也返回 404，因此符合现有文档的细粒度 PAT 可让查询以 rc=0 成功却完全漏掉 tickets。
Agent Prompt
## Issue description
无法区分 tickets 文件缺席与调用者无权读取 cnb-bridge，权限错误会被静默放行。
## Issue Context
先对三个预期仓执行可见性/权限探测并 fail closed，再仅把已确认可见仓中的账本路径或 ref 404 当作过渡期缺席；同时更新 GH_TOKEN 契约和错误文案。
## Fix Focus Areas
- governance/evidence-query.sh[18-18]
- governance/evidence-query.sh[33-33]
- governance/evidence-query.sh[38-55]
- governance/evidence-query.sh[73-76]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| DRILL_OK=0; fetch_file "Cloudbird-Software/.github" "drill-ledger" "governance/drill/shadow-evidence.jsonl" "$TMP/drill.jsonl" && DRILL_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| BUTLER_OK=0; fetch_file "Cloudbird-Software/.github" "butler-ledger" "governance/butler/shadow-evidence.jsonl" "$TMP/butler.jsonl" && BUTLER_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| ELEV_OK=0; fetch_file "Cloudbird-Software/.github" "elevation-ledger" "governance/elevation/shadow-evidence.jsonl" "$TMP/elev.jsonl" && ELEV_OK=1 || [[ $? -eq 1 ]] || exit 2 | ||
| TICKET_OK=0; fetch_file "Cloudbird-Software/cnb-bridge" "tickets-ledger" "tickets.jsonl" "$TMP/tickets.jsonl" && TICKET_OK=1 || [[ $? -eq 1 ]] || exit 2 |
There was a problem hiding this comment.
4. 大账本被静默清空 🐞 Bug ☼ Reliability
tickets 是持续追加的单一 tickets.jsonl，但新增拉取沿用默认 Contents API JSON 响应；文件超过 1 MB 后 GitHub 会返回空 content 和 encoding: none。当前解码会写出空文件，随后查询跳过它并返回成功，造成整个 tickets 源静默消失。
Agent Prompt
## Issue description
默认 Contents API 响应无法承载超过 1 MB 的持续增长 tickets 账本，查询会把其误读为空源。
## Issue Context
使用 GitHub raw media type 直接下载账本内容，检查响应形态，并为超过 1 MB 的 fixture/响应增加回归测试。
## Fix Focus Areas
- governance/evidence-query.sh[38-47]
- governance/evidence-query.sh[73-76]
- governance/evidence-query.sh[93-99]
- governance/tests/test-evidence-shadow.sh[152-215]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "butler": [butler_f] if os.environ.get("BUTLER_OK") == "1" else [], | ||
| "elevation": [elev_f] if os.environ.get("ELEV_OK") == "1" else []} | ||
| "elevation": [elev_f] if os.environ.get("ELEV_OK") == "1" else [], | ||
| "tickets": [tickets_f] if os.environ.get("TICKET_OK") == "1" else []} |
There was a problem hiding this comment.
5. Tickets 绕过完整模式校验 🐞 Bug ≡ Correctness
新增 tickets 文件只经过 verify_file()，该函数不校验 schema v1 必需的 ts、kind、action、verdict、actor 或禁止额外字段。于是哈希链正确但 schema 非法的 Go 发射记录仍会被统一查询输出并计入证据统计。
Agent Prompt
## Issue description
统一查询仅复算 tickets 哈希链，没有验证记录满足 evidence schema v1，非法记录可被当作正式证据输出。
## Issue Context
让只读验证路径对每条已带链字段的记录执行完整 schema 校验，并以错误列表而非直接退出方式报告；至少覆盖 required、类型、枚举、时间格式和 additionalProperties。
## Fix Focus Areas
- governance/evidence-query.sh[91-104]
- governance/evidence_shadow.py[57-81]
- governance/evidence_shadow.py[97-119]
- standards/evidence/record.schema.yaml[17-38]
- standards/evidence/record.schema.yaml[59-69]
- standards/evidence/record.schema.yaml[119-128]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| "butler": [butler_f] if os.environ.get("BUTLER_OK") == "1" else [], | ||
| "elevation": [elev_f] if os.environ.get("ELEV_OK") == "1" else []} | ||
| "elevation": [elev_f] if os.environ.get("ELEV_OK") == "1" else [], | ||
| "tickets": [tickets_f] if os.environ.get("TICKET_OK") == "1" else []} |
There was a problem hiding this comment.
6. 畸形票据返回错误码 🐞 Bug ☼ Reliability
当 tickets 中存在畸形 JSON 时，verify_file() 会记录链错误，但查询随即再次对同一行执行未捕获的 json.loads，在检查 errs 前抛出异常。命令因此返回 Python 的 exit 1 和 traceback，而不是脚本契约规定的链断 exit 3。
Agent Prompt
## Issue description
畸形 tickets JSON 在统一错误处理前被二次解析并抛异常，破坏 exit 3 契约。
## Issue Context
先完成所有源验证；存在任何错误时统一打印并 exit 3，只有验证成功后才解析聚合，或让 verifier 返回已解析记录以避免二次解析。
## Fix Focus Areas
- governance/evidence-query.sh[93-104]
- governance/evidence_shadow.py[97-119]
- governance/tests/test-evidence-shadow.sh[238-251]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Card: #412
ADR-0103（决策 4：云内网入图/可删除执行层）
摘要（W2-C1 治理面接缝，承 cnb-bridge PR #6）
Cloudbird-Software/cnb-bridge @ tickets-ledger tickets.jsonl——内网调度器短票据 grant/revoke 事件（AC-5b：短票据签发/收回事件按 schema v1 进统一账本）。同款纪律：HTTP 404=源缺席（过渡期合法非红）；链断=fail-closed exit 3。self-cloud-pool.entry注记 W2-C1 v0 落位（cnb-bridge 仓selfcloud/），承接卡 blastRadius.github: providers.yaml 条目注记。.scratch/（工作区独立克隆目录；防 gitlink 误提交坏 CI checkout——fix: 移除误提交的工作区 gitlink，修复 main CI checkout #438 同类事故预防）。实测证据
tickets 源事件由 Go 发射器产出（
selfcloud emit-ledger），链形态与evidence_shadow.py逐字节兼容（金向量锚定）；本仓 Python 验链器直接验链通过。INV 纪律
C1 路径：本 PR 为治理接缝变更（evidence-query/providers.yaml），引用 ADR-0103；owner review 后合并。
Summary by CodeRabbit