Repository navigation
test(offline): repair protocol gate regressions - #164
Conversation
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4cf4111ec8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| v3_read_only_regex='^TestBrokerExperimentV3(ReadOnlyPreflightRejectsBeforeWriteMint|StopsWhenReadOnlyTokenRevocationIsUncertain|RevokedRecordSyncFailureStopsBeforeWriteMint|DoubleRevocationJournalSyncFailureBlocksLaterInspect|LostReadTokenMintResponseBlocksLaterInspect|RevokesTokenFromRejectedReadIssuance|DoesNotRevokeVerificationTokenCollision)$' | ||
| v3_provenance_regex='^TestBrokerExperimentV3(LostWorkflowProvenanceResponseBlocksLaterInspect|WorkflowProvenancePreRequestFailureRecordsNoDispatchForLaterInspect|HistoricalWorkflowProvenanceClaimReplayBinding|LegacyIncompleteClaimWithoutManagementLifecycleBlocksLaterInspect|PreRequestFailureRecordsNoDispatchForLaterInspect|RepeatsCalleeFenceAfterWritePreflight)$' | ||
| paired_process_regex='^TestBrokerPaired' | ||
| g02_non_paired_skip_regex='^TestPaired|^TestBrokerPaired|^TestBrokerExperimentV3|^Test(LegacyControllerEntryRejectsMalformedInputBeforeAdmission|LegacyPairedEntryRejectsMalformedInputBeforeAdmission|BrokerControllerClaimsAttemptBeforeProvenanceSideEffects)$' |
There was a problem hiding this comment.
The G02 offline gate now skips TestBrokerExperimentV3SelectionRejectsMissingStateBeforePipeOwnership entirely: it matches this blanket exclusion, but none of the explicit partition selectors include it. Previously it ran in the complement. This silently removes coverage for rejecting missing state before consuming credential pipes and for rejecting mismatched callee, group, and run policies. Local go help testflag confirms that -skip runs only tests “that do not match the regular expression.” Add this test to a partition or restrict the complement exclusion to the names actually routed elsewhere.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Summary
Part of #1. This PR does not close issue #1; its live canary acceptance remains open.
Verification
OFFLINE_EXPERIMENT_MODULE=experiments/g01-scaleset OFFLINE_EXPERIMENT_PROFILE=core bash scripts/check-offline-experiments.sh— passed with Go 1.27.3, race checks, and vet.OFFLINE_EXPERIMENT_MODULE=experiments/g02-auth bash scripts/check-offline-experiments.sh— passed with Go 1.27.3, race checks, and vet; offline only.go test -count=1 -timeout=600s -run '^TestToolingDefaultG02PartitionsRun$' ./scripts— passed (282.924s).git diff --check,bash -n scripts/check-offline-experiments.sh, andgofmt -don changed Go files — passed.Go module/build caches and temporary files were directed to an external work volume. No live canary, Scale Set, runner, credential, or host operation was performed.
Exact-head follow-up — 2026-11-04
Candidate:
3c56bc6e6a536c4daefd397f621176c6f93938e6, based on325effa8408f87ca51769d683b0a0862623d1ea5.The two follow-up commits route the G02 workflow-provenance timeout and selection sentinel into bounded partitions, and make the G01 subprocess fixtures assert the workflow authorization and token revocation lifecycle.
Local evidence on this candidate:
Independent
gpt-5.6-luna/ max exact-head delta review: APPROVE; no P0/P1 defect found. The reviewer raised four P2/P3 fixture-coverage notes. They are triaged as nonblocking and closed without follow-up: RS256 signature verification is exercised by the focused adapter/ACK fixture; full query/header/body assertions remain owned by adapter-level tests while this process fixture checks authority and sequence; broker and admission journals each assert their own record order alongside the exact request order; and the V3 transport's referenced-workflow injection is fixture-only provider shaping. None identifies a production behavior defect in this delta.Fresh
@codex reviewwas requested for this exact head. Hosted PR quick check is running. The prior Public CI run on base325effa8408f87ca51769d683b0a0862623d1ea5failed in G01 process fixtures and the G02 offline partition; this candidate contains the corresponding fixture and partition corrections, with integration status to be recorded separately.Issue #1 remains OPEN / Project #2 In progress. Production provenance and trust-root custody, broker-only execution, server-side conditional cleanup, runtime/isolation/resource qualification, protected-canary configuration, and the separately authorized Linux ARM64/JIT canary remain open.
Review and exact-head gate — 2026-11-04
3c56bc6e6a536c4daefd397f621176c6f93938e6: run 41719670811.4cf4111is resolved:TestBrokerExperimentV3SelectionRejectsMissingStateBeforePipeOwnershipis now in the G02 read-only/pre-effect selector, and the tooling regression verifies both that the selected test runs and that a failing selected test fails its partition.Issue #1 remains OPEN / Project #2 In progress while its live gates remain.