fix(ci): seed patch-validator cache from protected main - #558
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (16)
📝 WalkthroughWalkthrough패치 검증 이미지 워크플로에 Changes런타임 권위 및 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
20 tasks
docs: reconcile protected runtime and commercial gap authority
This was referenced Sep 8, 2026
seonghobae
added
bug
ChatGPT Codex Connector
This was referenced Sep 8, 2026
seonghobae
marked this pull request as ready for review
September 8, 2026 02:23
seonghobae
added a commit
that referenced
this pull request
Sep 8, 2026
This was referenced Sep 8, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 9, 2026
* test(docs): expose post-547 commercial authority drift * test(docs): require current active commercial lanes * docs: refresh commercial gap authority after #547 * test: advance patch-validator candidate authority * test: reject superseded patch-validator candidate * docs: refresh patch-validator exact authority * test: require current #535 commercial authority * docs: repair current commercial authority after hosted RED * test(docs): require live post-558 commercial authority Require the documentation lane to reflect protected #558 integration, the newly converged #535 exact head, and the newly observed #556 stacked head before production baseline text is repaired. * docs(gap): repair post-558 live commercial authority Bring #559's owned baseline in line with protected #558 integration, exact #535 convergence, and the newly observed #556 stack while preserving canonical owner boundaries and release-evidence discipline. * test(docs): require latest observed #556 authority Advance the documentation contract to the live #556 successor after its hosted release-test RED, while rejecting the superseded observation. Production baseline text follows in the causal repair commit. * docs(gap): record live #556 successor and hosted RED Update #559's sole documentation authority to the latest #556 exact head, preserve the observed hosted release-test failure as historical evidence, and keep the downstream stack non-authorizing until #535 reaches protected main. * test(docs): require current #535 endpoint-repair authority * docs: track current #535 gateway endpoint repair * test(docs): require #535 coverage-repair authority * docs: track #535 coverage-gate repair * test(docs): require current central control-plane snapshot * docs: refresh central control-plane snapshot * test(docs): retire stale commercial authority assertions * docs: refresh protected and claim-evidence authority * test(docs): track protected #535 integration * test(docs): track current claim-evidence head * test(docs): bind post-535 protected authority * test(docs): refresh current candidate contract * test(docs): align claim-binding authority wording * docs: refresh claim-evidence candidate authority * test(docs): match hosted run authority casing * docs: refresh live Noema commercial authority * test(docs): track current Noema feature authority * test(docs): bind commercial gap to live feature heads * test(docs): require settled external-extension authority * docs: converge commercial gap to current plugin admission * test(docs): track active policy-approval RED * docs: bind commercial gap to policy-approval RED * docs: restore durable commercial gap owners * docs: align external-extension authority after restack * test: bind documentation authority to restacked #560 * test(d(docs): require complete gap authority schema * docs: bind gap status to architecture authorities * test(docs): reject stale tool-capability candidate * docs: refresh current tool-capability evidence * docs: refresh active extension authority * docs: bind extension event chronology evidence * docs: refresh extension chronology authority * docs: bind gap baseline to hostile admission repair * test(docs): bind live candidate to admission repair * test(docs): preserve candidate ADR authority wording * docs: refresh external-extension runtime-time authority * test(docs): bind current runtime-time candidate authority * test(docs): refresh live external-extension candidate authority * docs: bind gap authority to invocation replay repair * docs: converge on public replay authority repair * docs: converge on activation revocation repair * docs: converge on admission-bound invocation authority * docs: bind commercial gap to exact admission provenance * test(docs): require exact-admission candidate authority * test(docs): bind candidate contract to exact admission * docs: track crypto-provider RED authority * test(docs): bind external-extension authority to Web Crypto repair * docs: converge external-extension Web Crypto authority * test(docs): follow current external-extension authority * test(docs): assert public receipt binding authority * test(docs): match activation revocation authority wording * docs: converge baseline after #560 protected integration * test: bind documentation authority to #560 integration * test: treat external-extension admission as protected history * test: extend protected integration history through #560 * test: move external-extension gap to lifecycle successor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
patch-validator-imageusedtype=gha,scope=noema-patch-validator-imagewhile protected source ran it only forpull_requestandworkflow_dispatch. GitHub/Docker cache visibility is branch-scoped, so a later sibling PR cannot restore a cache written only by another PR branch; it can restore current/base/default-branch cache. Live evidence matched that model: #540 image run34155490034spent about 104 minutes building the static runtime, and later sibling #547 run34165467851again paid a roughly two-hour exact image build despite the identical cache scope.Official authority:
Related: #66.
RED → causal repair
a67a5ab1f4b15ed5269497cfd1fd0c06cfc72a56: test-only deterministic RED requiring protected-main cache seeding while preservingworkflow_dispatch; workflow intentionally unchanged, so no hosted RED is fabricated.2e83e1c6ad743adf0e4528383252c681eb6638ec: minimal production repair addedpush: branches: [main].ec60444efd072afd7b58e988daa10269edea57b6: second test-only RED after review exposed that unconditional main pushes would enqueue the 150-minute image lane on unrelated protected merges.f9f1445150969de9d278a0b0ae391a2d2e3b2a13: production repair added an explicit protected-mainpathsset for the image workflow, Dockerfile, package manifests/lockfile, validator runtime/helpers and receipt verifier.f2aa8570d952cc0a371da161e651472c080e00ce: ordinary two-parent convergence after protected docs: reconcile protected runtime and commercial gap authority #547. Hosted CI34172635652, job101895784847, produced a real RED after exact checkout, live-base verification, lockfile control, install and typecheck:test/patch-validator-workflow.test.tsstill assumedpull_request:had to be immediately adjacent toworkflow_dispatch:and therefore rejected the intentionally added siblingpush:trigger. The run had 1 failed / 4121 passed tests.2f91bf8641212ecae435b5fbcc9084cc0acd6295: minimum causal test repair. It preserves the original invariant thatpull_request:is unfiltered by requiring the next non-empty event line to remain at top event indentation, without forbidding independent sibling triggers such as protected-main cache seeding. No production workflow, permission, security gate or publication boundary was weakened.Protected ancestry and exact GREEN
Fresh compare immediately before merge authorization from protected
main@699489cdbb8de3404154d9a3d6022c692ce85fd6to exact2f91bf8...is ahead-only,behind_by=0, merge-base exactly protected main. Effective changes are limited to.github/workflows/patch-validator-image.yml,test/patch-validator-image-build-cache.test.ts, andtest/patch-validator-workflow.test.ts. Fresh review-thread inventory is empty and no submitted review introduces a blocking finding.Unchanged exact-head gates are all terminal success:
34173491056: success;34173491034: success;34173491124: success;34173491077: success.This PR is therefore promoted out of Draft for normal merge. The exact head must still match
2f91bf8...at the merge mutation; no predecessor or moved-head evidence transfers.Operational effect after merge
The first repaired PR head can still pay the cold static build because the default branch has not yet run the repaired workflow. A normal merge necessarily changes
.github/workflows/patch-validator-image.yml, so the protected merge commit itself satisfies the path filter and must run full exact image verification onmain; that protected-main run is the first default-branch cache-seed/operational-acceptance candidate. Unrelated main merges do not enqueue that long lane. PR-scoped cancellation, stale-head refusal, pinned scanners/toolchain, static runtime verification, no-network/non-root smoke, SBOM/vulnerability receipts and fail-closed verification remain unchanged. No registry/release/foreign-domain authority is introduced.Do not claim cache speed improvement until a later sibling image-authority PR demonstrates actual default-branch cache restore and measured build-duration change.
Summary by CodeRabbit
새 기능
main브랜치의 관련 변경 사항에도 실행됩니다.main푸시와 수동 실행을 통해 공유 빌드 캐시를 준비할 수 있습니다.문서
테스트