[jdx]

Summary

• validate remote manifest keys, formats, output roots, and mandatory artifact checksums before local promotion
• reject corrupt downloaded artifacts as cache misses without poisoning the local cache
• require HTTPS for remote services while retaining loopback HTTP for local development
• document the transport and integrity requirements in protocol version 1

Tests

• cargo test task_cache_store::tests
• cargo test remote_entries_require_artifact_checksums
• cargo clippy --workspace --all-features --all-targets -- -D warnings
• mise run lint-fix

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Medium Risk
Changes affect remote cache restore and URL validation on a security-sensitive path; corrupt data should miss rather than poison local cache, but misconfiguration or stricter HTTPS rules could break existing setups.

Overview
Remote task cache reads now treat transport and content integrity as part of the contract, so bad or tampered CAS payloads fail verification instead of being trusted.

HTTP blob downloads (in-memory and streamed-to-file) are checked against the declared blake3/sha256 digest and size; mismatches surface as errors (covered by a new mock test for substituted blob bodies). Remote action-result assembly still computes the manifest artifact checksum after materializing the output tree, then returns a serialized manifest entry. Remote URL validation now explicitly rejects non-HTTP(S) schemes such as ftp:// in tests, alongside the existing HTTPS / loopback-HTTP rules.

The parity tracker marks “Verify remote artifact integrity and authenticity” as complete.

^{Reviewed by Cursor Bugbot for commit c4e8828. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 026659ec-d18f-4b19-8fbf-46c434175045

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR adds focused tests for CAS blob digest rejection and URL-scheme validation, marks remote artifact integrity and authenticity complete in the parity tracker, and makes a behavior-preserving manifest serialization refactor.

• Tests corrupted blob responses against their requested BLAKE3 digest.
• Tests rejection of loopback FTP URLs.
• Marks the remote integrity/authenticity parity item complete.

Confidence Score: 4/5

The PR does not appear safe to merge until remote artifacts are checked against an independently trusted expected checksum before local promotion.

The current remote read path still computes the manifest checksum from the artifact it just downloaded, so a substituted output tree can satisfy the later checksum comparison and be promoted into the local cache; the new test only proves that an individual CAS response is rejected when it differs from its caller-provided digest.

Files Needing Attention: src/task/task_cache_store.rs

Important Files Changed

Filename	Overview
src/task/task_cache_store.rs	Adds lower-level CAS corruption and URL validation tests plus a manifest serialization refactor; the previously reported higher-level artifact verification issue remains.
TASK_CACHE_PARITY.md	Marks remote artifact integrity and authenticity verification complete.

_{Reviews (12): Last reviewed commit: "fix(task): accept reordered remote cache..." | Re-trigger Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▂▄▂▁▁▁▄▃▃█	80,074,952 → 80,197,305	+0.15%	17.64 → 18.63ms	+5.62%
hook-env	▅▅▁▃▂▂▃▃▄█	82,190,914 → 82,335,121	+0.18%	18.34 → 18.03ms	-1.68%
ls	▄▃▁▁▁▅▅▅▅█	73,127,800 → 73,236,949	+0.15%	15.71 → 15.87ms	+1.01%
registry	▁▁▂▂▃▆▆█▂▇	49,102,713 → 49,169,314	+0.14%	11.64 → 11.79ms	+1.26%
startup	▃▃▁▂▂▁▁▂▂█	15,784,751 → 15,846,569	+0.39%	9.04 → 8.85ms	-2.12%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{c4e88287db99 vs e5230aa14775 · measured on the runner, not pushed to the history.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 954d751. Configure here.}