Revise PR #318: the step-1 audit was reported as posted to the bus but was never posted, and its sender census sees 1 of 11 senders - #329
Conversation
census run against the live bus at taos.tailb4a2.ts.net:7900, not a local data dir. build channel has 17 distinct senders (15 before test probes). registry_url and server_token are both unconfigured on the live server, so enforcement is dormant and the bus is open, matching the verified claim. token/sub-from verification requires registry feeds_read access we do not have. audit report posted to build channel as message 3126.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 1 minute Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (5 files)
Reviewed by step-3.7-flash · Input: 77.4K · Output: 14K · Cached: 247.3K |
…st, including the fail-closed bypass (#331) Documentation only: no executable line changes under taosmd/, and zero changes to any if/return/elif/else. Comments and docstrings in config.py and registry_auth.py, plus the live-risk paragraph in the a2a-bus-auth-transition spec and a changelog entry. Every documented claim was measured on a trial merge of this branch into master, with controls in both directions, not read off the source: BLOCK A -- id IS on the revocation feed (feed loads fine) human_principal_ids=set() CONTROL rejected fetches=1 "is revoked" human_principal_ids={that id} ARM ACCEPTED fetches=0 human_principal_ids={other id} CONTROL rejected fetches=1 "is revoked" BLOCK B -- revocation feed NEVER LOADED (fail-closed path) human_principal_ids=set() CONTROL rejected fetches=1 "feed unavailable" human_principal_ids={that id} ARM ACCEPTED fetches=0 human_principal_ids={other id} CONTROL rejected fetches=1 "feed unavailable" BLOCK C -- sub/from mismatch on an exempt id claimed_from=somebody-else rejected fetches=0 HumanAuthError The two blocks reject for different stated reasons, so the probe distinguishes the revoked-membership mechanism from the fail-closed one rather than emitting a single generic failure. The third row of each block pins that the exemption is set membership on the token sub. Precedence measured with a positive control: no env var -> config file value; env set -> env wins; empty or whitespace env -> falls through to the config file (first non-empty wins). The automated REVIEW WARNING on the PR body ("card asks for tests, diff changes no test file") is a FALSE POSITIVE. Card tsk-wa2bwk says "Write NO test for this card", with the reasoning that a docstring drift guard passes on any wording, fails on a harmless rewrite, and cannot see the defect it is named after. The lane obeyed that and edited no guard, which was the card's explicit trap. Stated limitation, carried deliberately: the docstring justifies the exemption as "safe by design: the feed is agent-only". That is backed in-repo by open question 1 of the transition spec, but the same section records the boundary as still owed on the controller side -- the feed's own docs must say agent-only and list_revoked() needs a test pinning it. That is @taOS-dev's half; this card does not wait on it. The apparent removal of the a2a sender census in a diff against master is base drift, not a loss: this branch was cut at d487007, before #329 merged. Against its merge-base the true change is 4 files, +36/-5, and all census references survive the merge (service.py 3, remote.py 1, http_server.py 1, tests 9). Gates on the trial merge: no conflict markers, deleted-symbols-guard clean, normalise-handle-gate clean, witness-gate clean. Full suite 1501 passed, 12 skipped, which is exactly the master baseline -- the expected and correct result for a comment-and-docstring diff, and the third witness that no behaviour moved. Card: tsk-wa2bwk
1 participant
CARD TITLE (intent, not commit subject): Revise PR #318: the step-1 audit was reported as posted to the bus but was never posted, and its sender census sees 1 of 11 senders
Autonomous build of board card tsk-6ycnvz.
census run against the live bus at taos.tailb4a2.ts.net:7900, not a local
data dir. build channel has 17 distinct senders (15 before test probes).
registry_url and server_token are both unconfigured on the live server, so
enforcement is dormant and the bus is open, matching the verified claim.
token/sub-from verification requires registry feeds_read access we do not have.
audit report posted to build channel as message 3126.
Files:
changelog.d/tsk-6ycnvz-sender-census.md | 3 ++
taosmd/http_server.py | 6 +++
taosmd/remote.py | 5 +++
taosmd/service.py | 65 ++++++++++++++++++++++++++++++++-
tests/test_a2a_channels.py | 65 +++++++++++++++++++++++++++++++++
5 files changed, 142 insertions(+), 2 deletions(-)