feat(sensitive): record credential-free handle lifecycle evidence - #45
feat(sensitive): record credential-free handle lifecycle evidence#45seonghobae wants to merge 30 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough민감 핸들의 발급, 만료, 사용량, 해지 상태를 기록하는 증거 타입을 추가했다. 입력 검증과 상태 조회 API를 제공한다. 식별자와 수명주기 범위 오류 및 민감값 비노출을 테스트한다. Changes민감 핸들 수명주기 증거
Estimated code review effort: 3 (Moderate) | ~20 minutes Mergeability Score: ⚪ Minimal · up to This localized evidence-only change is merge-ready after normal checks and review; no actionable merge-blocking risk remains. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b. -
Head SHA:
6e615ecb9b946943f2e360a4ba4fe3ed8003ce6b -
Workflow run: 31695895087
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (6 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (6 files)"]
R1 --> V1["required checks"]
|
|
Fresh exact-head review requested for |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Dismissed as predecessor-head infrastructure evidence after fresh exact-head revalidation. The review evaluated head 6e615ec and requested changes solely because coverage-evidence failed. Current PR head is dbd2342; its coverage-evidence check 95236160868 and opencode-review check 95238407732 both completed successfully. This dismissal does not create or substitute for the independent current-head/latest-push APPROVED review required by live organization ruleset 18156473.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headdbd23423ac4eb1f5ffb8a9e4d81861d09bb0c2a0. -
Head SHA:
dbd23423ac4eb1f5ffb8a9e4d81861d09bb0c2a0 -
Workflow run: 32042551936
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head604ed74ba5b3a54c2aa7155bf1379c8f10245a9f. -
Head SHA:
604ed74ba5b3a54c2aa7155bf1379c8f10245a9f -
Workflow run: 32796079389
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (6 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (6 files)"]
R1 --> V1["required checks"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head4b1a99a0e0373fd232f8ebb5dc77e0e144642312. -
Head SHA:
4b1a99a0e0373fd232f8ebb5dc77e0e144642312 -
Workflow run: 32966308213
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (6 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (6 files)"]
R1 --> V1["required checks"]
Partial implementation of #10.
Buyer/security gap
The lifecycle value must remain inseparable from the exact credential-free
SensitiveAccessEvidencereceipt that authorized opaque-handle use, and derived handle authority must not outlive an explicit retention deadline on that receipt. Review also exposed the audit-boundary case where revocation at the exact expiry second must remain recordable without extending authority.Implemented boundary
The current branch:
SensitiveAccessEvidencereceipt in lifecycle input/evidence;OpaqueHandleOnlyaccess decision;resolution_count <= maximum_uses;retention_deadline_epoch_seconds, requires handle expiry to be at or before that deadline so derived opaque authority cannot outlive its governing receipt;Test-first lineage
The access-receipt binding repair was established with formatted RED head
8f6dd06cc5c585c82bd80e5db63c96b92f078ae2and CI32733942382/ Rust job97452317960, which failed at the missing production API boundary before the receipt-binding implementation landed.The exact-expiry revocation regression was established at test-only head
6643516aae6574d0b780d0ff4d255d6ba6d38bd9; CI32741131834/ Rust job97475604577reached the intended RED withInvalidLifecycle. Current code acceptsissued <= revoked <= expiresonly as lifecycle/audit evidence; values after expiry remain fail closed.The later retention-boundary review was resolved by changing production behavior rather than by treating receipt and handle lifetimes as independent: current code caps
expires_epoch_secondsat the receipt retention deadline when one exists. The current informational review confirms revocation remains transitively inside that deadline because revocation is bounded by handle expiry.Exact-current state and evidence
Protected
mainis exactb05d5acca82b9d916ada2c8e82f59f92a89817e1. Current unchanged contributor head is exact4b1a99a0e0373fd232f8ebb5dc77e0e144642312; GitHub reports the PR open, Ready, and mergeable against that live base.On this exact head:
32813260113: success;97696578001: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success;97696577660: success, including exact owned-production function/line/region/branch enforcement;9550566160,exact-coverage-4b1a99a0e0373fd232f8ebb5dc77e0e144642312, digestsha256:893f0e0099306cb2b55a1c865488d856c646c0b34ba043b2805e7adcfad7a5f6;32813260146: success;32813260152: success; andThe skipped nightly materializer is not passing evidence. Formal review history contains automated comments and predecessor-head OpenCode change requests; there is no qualifying independent current-head
APPROVEDreview. No predecessor, skipped, cancelled, absent, stale, synthetic, status-only, or model-only evidence is promoted.Explicit non-scope
This remains credential-free evidence, not the trusted broker. It does not implement opaque-handle token storage, protected-value storage/encryption/KMS, protected-value resolution/fill, durable/cross-process transactionality, authenticated workload identity, atomic reservation/enforcement, model/provider/region disclosure policy, or durable hash-chained audit persistence. Those controls remain open under #10.
Protected-main
AGENTS.mdprohibits this scheduled writer from merging, self-approving, altering workflows, adding secrets, weakening checks, force-pushing, destructively rebasing, tagging, or publishing. This PR must not close #10 or be called shipped before protected integration and all applicable unchanged-head gates pass together.