docs(devlog): drop remote home-path citations the privacy scanner flags - #3197
Conversation
Roadmap unit for landing the adaptive-effort PR after the privacy-scan citation on origin/dev is anonymized. Docs-only; no production change.
Fold the PLAN-VERIFIER-REAL-01 audit blocker into the roadmap with live privacy:scan and gh exit evidence. Docs-only.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
added
the
documentation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea412aa46f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 4. Focused checks only: `bun x tsc --noEmit`; `cd gui && bun x tsc --noEmit` if GUI files changed; `bun test tests/codex-catalog.test.ts tests/openai-chat-hardening.test.ts tests/combo-management-api.test.ts tests/combo-workspace-data.test.ts tests/combos.test.ts tests/management-provider-validation.test.ts` if those files still exist after rebase; `bun run privacy:scan`. | ||
| 5. Push `--no-verify`. Refresh #3190 (or open the carry). Fill the template. | ||
| 6. Wait for exact-head Cross-platform CI on the new SHA. Record the run id. `gates` Privacy scan must be SUCCESS. Known macOS websocket flake: rerun that job, compare against #3128, do not rewrite unrelated code. | ||
| 7. Admin squash merge: `gh pr merge <n> --squash --admin --delete-branch` with comment naming the bypass (owner-authored, CI green on exact head, no security-boundary). |
There was a problem hiding this comment.
If another push updates the PR after step 6 checks the head but before this command runs, --admin can merge that new, unverified revision because the merge is not bound to the SHA whose CI was inspected. The installed gh pr merge --help explicitly provides --match-head-commit SHA for ensuring that “the pull request head must match to allow merge”; pass the verified headRefOid through that option so a concurrent update aborts rather than bypassing exact-head CI. This repository also resets readiness whenever the head changes, so the merge step must preserve that invariant.
AGENTS.md reference: AGENTS.md:L296-L299
Useful? React with 👍 / 👎.
…gs (lidge-jun#3197) * docs(devlog): plan the admin merge train for 3190 Roadmap unit for landing the adaptive-effort PR after the privacy-scan citation on origin/dev is anonymized. Docs-only; no production change. * docs(devlog): record verifier one-liners for the 3190 train Fold the PLAN-VERIFIER-REAL-01 audit blocker into the roadmap with live privacy:scan and gh exit evidence. Docs-only. * docs(devlog): drop remote home-path citations the privacy scanner flags --------- Co-authored-by: jun <jun@lidge.dev>
…gs (lidge-jun#3197) * docs(devlog): plan the admin merge train for 3190 Roadmap unit for landing the adaptive-effort PR after the privacy-scan citation on origin/dev is anonymized. Docs-only; no production change. * docs(devlog): record verifier one-liners for the 3190 train Fold the PLAN-VERIFIER-REAL-01 audit blocker into the roadmap with live privacy:scan and gh exit evidence. Docs-only. * docs(devlog): drop remote home-path citations the privacy scanner flags --------- Co-authored-by: jun <jun@lidge.dev>
1 participant
Summary
privacy:scanmatches the macOS home-path shape and fails any username that is not the maintainer account or the small allowlist. After docs(devlog): close the multiplatform QA and GUI unit #3181, the closeout note for the multiplatform QA unit quoted two remote macOS homes as the example of what the scanner caught. That citation re-introduces the same shape, so every later PR whose GitHub merge commit includes currentdevfails Cross-platform CIgates/ Privacy scan. This is why feat(combo): adapt reasoning effort to target capabilities (#2731) #3190 is red even though feat(combo): adapt reasoning effort to target capabilities (#2731) #3190 itself does not contain that file.Verification
bun run privacy:scan— exit 0 on this head (ea412aa46).devlog/_plan/260902_multiplatform_qa_and_gui/091_wp6_merge_outcome.md:13.scripts/privacy-scan.tsis unchanged.Checklist