Skip to content

fix(release): preserve historical repair policy - #24

Merged
myagentdojo merged 11 commits into
mainfrom
codex/fix-historical-release-repair
Aug 9, 2026
Merged

myagentdojo merged 11 commits into
mainfrom
codex/fix-historical-release-repair

Conversation

@myagentdojo

@myagentdojo myagentdojo commented Aug 9, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • execute historical repair admission with the trusted pre-release base parent's projection policy
  • keep current publication admission on the current strict allowlist
  • prove checkout follows complete tag, PR, SHA, and merge-shape provenance checks
  • release the Codex status gate only from an explicit clean verdict bound to the current head
  • match Codex's stable clean-verdict sentence instead of changing celebratory copy

Why

The v0.1.1 repair was blocked after Bun-only runtime custody removed legacy generated paths from today's projection policy. Review also exposed that candidate-owned historical validators would cross a trust boundary, and that any Codex review event could previously mark the gate green even when it contained findings.

Validation

  • bun test (524 pass, 3 explicit manual/hosted skips, 0 fail; 2264 expectations)
  • actionlint on both changed workflows
  • git diff --check

Hosted follow-up

After merge, rerun repair for v0.1.1, verify PR #18 has autorelease: tagged and not autorelease: pending, then run maintenance to open the next Release Please PR.

Summary by CodeRabbit

  • Release Process

    • Improved release validation by checking the exact candidate revision before final admission checks.
    • Added safeguards requiring valid provenance and parent history before validation proceeds.
  • Quality Improvements

    • Strengthened automated checks for release and review-gate behavior.
    • Replaced review-event completion with an authorized approval comment tied to the current commit.
    • Prevented approval when clean-review confirmation is missing or unresolved findings remain.
  • Documentation

    • Clarified how to resolve findings, push fixes, request another review, and enable the required code-review integration.

@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 01:59 — with GitHub Actions Inactive
@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@myagentdojo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 19 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8099a963-a257-44de-a23e-69ae793e3012

📥 Commits

Reviewing files that changed from the base of the PR and between 578be4c and 0cc7bda.

📒 Files selected for processing (3)
  • .github/workflows/codex-review-gate.yml
  • README.md
  • scripts/codex-review-gate.test.ts
📝 Walkthrough

Walkthrough

The release repair flow now checks out the immutable candidate SHA before projection validation. The Codex review gate now uses authorized issue-comment approval for the current commit. Tests and documentation cover the updated workflows.

Changes

Release repair validation

Layer / File(s) Summary
Candidate checkout before projection validation
.github/workflows/release.yml, scripts/release-validate.test.ts
The repair flow checks provenance and parent-count guards, checks out the candidate SHA, and reruns projection validation. Tests verify this order.

Codex review gate

Layer / File(s) Summary
Authorized current-commit approval
.github/workflows/codex-review-gate.yml
The workflow replaces pull_request_review handling with an authorized @codex-gate approve <commit-prefix> issue-comment flow. It validates the commenter permission, current commit, and clean Codex marker.
Finding checks and status update
.github/workflows/codex-review-gate.yml
The workflow rejects Codex review objects and inline findings before it marks the current commit successful.
Approval workflow coverage and instructions
scripts/codex-review-gate.test.ts, README.md
Tests cover current and stale approvals, missing markers, permissions, review findings, and inline findings. The README documents exact-commit review and re-review after fixes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the primary release change: preserving the historical repair policy.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/fix-historical-release-repair

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/release-validate.test.ts`:
- Around line 293-296: Harden the assertions for the release validation script
in the test around historicalPolicyCheckout and historicalPolicyExecution:
require non-negative positions for the complete provenance guard, parent_count
guard, checkout command, and projection execution marker before comparing order.
Verify checkout follows both provenance checks, and projection execution follows
checkout, so removing any required marker cannot make the test pass.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bbd0d601-d7d1-4433-8e6d-43ad774eb6ea

📥 Commits

Reviewing files that changed from the base of the PR and between d3f9bc7 and b7b2d28.

📒 Files selected for processing (2)
  • .github/workflows/release.yml
  • scripts/release-validate.test.ts

Comment thread scripts/release-validate.test.ts Outdated
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: b7b2d28ca0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:04 — with GitHub Actions Inactive

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f7d8c7e3fe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Owner Author

@codex review

@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:13 — with GitHub Actions Inactive

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 21a91a5bee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/release.yml Outdated
@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:20 — with GitHub Actions Inactive

Copy link
Copy Markdown
Owner Author

@codex review

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ba5444f84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/codex-review-gate.yml Outdated
@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:25 — with GitHub Actions Inactive

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: c327641f57

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:51 — with GitHub Actions Inactive
@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b6022f917

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/codex-review-gate.yml Outdated
@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 02:59 — with GitHub Actions Inactive

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Copy link
Copy Markdown
Owner Author

@codex review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 578be4ceb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codex-review-gate.yml:
- Around line 107-119: Update the clean-attestation filtering in
.github/workflows/codex-review-gate.yml lines 107-119 to require the complete
comment payload to match the allowlisted clean verdict and reviewed-commit
marker, rejecting comments that also contain findings or contradictory verdicts.
Add a fixture and assertion in scripts/codex-review-gate.test.ts lines 130-156
verifying that such a comment does not post a success status.

In `@scripts/codex-review-gate.test.ts`:
- Around line 130-156: Extend the runApproval test helper to accept a raw Codex
comment body, then add a test covering a comment that includes the valid clean
marker alongside a finding or contradictory verdict. Assert this mixed payload
produces no status update, while preserving the existing missing-marker and
finding-object cases.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a4a6cc3-014f-4805-a191-a0eb5ee719e7

📥 Commits

Reviewing files that changed from the base of the PR and between f8741a1 and 578be4c.

📒 Files selected for processing (3)
  • .github/workflows/codex-review-gate.yml
  • README.md
  • scripts/codex-review-gate.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • README.md

Comment thread .github/workflows/codex-review-gate.yml Outdated
Comment thread scripts/codex-review-gate.test.ts
@myagentdojo
myagentdojo temporarily deployed to hosted-canary-qualification August 9, 2026 03:09 — with GitHub Actions Inactive

Copy link
Copy Markdown
Owner Author

@codex review

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 0cc7bdac04

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 9, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Owner Author

@codex-gate approve 0cc7bda 5229527641

@chatgpt-codex-connector

Copy link
Copy Markdown

To use Codex here, create an environment for this repo.

@myagentdojo
myagentdojo merged commit 06f8454 into main Aug 9, 2026
19 checks passed
This was referenced Aug 9, 2026

This branch was previously deployed

1 inactive deployment
hosted-canary-qualification — 0cc7bdac Deployed Aug 9, 2026 by myagentdojo via Qualify immutable hosted candidates #92
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants