Proof: seal shared source materializer - #510
Closed
lemone112 wants to merge 5 commits into
Closed
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughОбщий provenance materializer повторно проверяет допущенные source archive и возвращает канонические файлы. Arb pipeline использует этот API вместо локальной распаковки. Добавлены проверки capability, TAR-содержимого, identity и интеграционных контрактов. ChangesМатериализация допущенных исходников
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ArbPipeline
participant Provenance
participant SourceArchive
ArbPipeline->>Provenance: materialize_admitted_source_files_v1
Provenance->>SourceArchive: повторно допустить capability и replay TAR
SourceArchive-->>Provenance: проверенный TAR-поток
Provenance-->>ArbPipeline: отсортированные regular files
ArbPipeline->>ArbPipeline: сформировать sealed build input bundle
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Collaborator
Author
|
@coderabbitai review Проверь exact head |
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@proof/region/v1/tests/test_source_lock.py`:
- Around line 522-532: В блоке finally теста вокруг
materialize_admitted_source_files_v1 всегда удаляйте ключ identity из
lock.__dict__, затем восстанавливайте cached_identity только если исходное
значение действительно существовало; сохраните восстановление original_role без
изменений.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6c957745-50a2-49bd-a420-289351fae2f8
📒 Files selected for processing (9)
proof/region/v1/PROTOCOL.mdproof/region/v1/arb/pipeline.pyproof/region/v1/arb/tests/gate.pyproof/region/v1/arb/tests/test_pipeline.pyproof/region/v1/arb/tests/test_transport.pyproof/region/v1/provenance.pyproof/region/v1/tests/test_build.pyproof/region/v1/tests/test_mpfi_source_lock.pyproof/region/v1/tests/test_source_lock.py
Collaborator
Author
|
@coderabbitai review Исправлен единственный актуальный замеченный defect fixture cleanup в exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== Exact commits ==='
git show -s --format='a35d0eb %H%n%s%n%n4346501 %H%n%s' a35d0eb 4346501
echo '=== Files changed after a35d0eb ==='
git diff --name-status a35d0eb..4346501
echo '=== Full range diff ==='
git diff --find-renames --find-copies --no-ext-diff a35d0eb..4346501 -- .
echo '=== Python structure of changed files ==='
git diff --name-only a35d0eb..4346501 -- '*.py' | while IFS= read -r file; do
echo "--- $file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
done
echo '=== Cache/identity restoration references in changed Python files ==='
git diff --name-only a35d0eb..4346501 -- '*.py' | while IFS= read -r file; do
echo "--- $file"
rg -n -C 5 -i 'cache|restore|identity|fixture|patch|mock' "$file" || true
doneLength of output: 22102
Не нашёл замечаний в указанном scope.
✅ Action performedReview finished.
|
lemone112
force-pushed
the
agent/mpfi-observer-placement
branch
from
August 1, 2026 08:02
b950f3e to
c63b3d5
Compare
lemone112
force-pushed
the
agent/mpfi-source-materialization
branch
from
August 1, 2026 08:04
4346501 to
57c4817
Compare
Collaborator
Author
|
@coderabbitai review Stack rebased safely onto #509/#508; exact new head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit="57c4817"
previous_head="4346501"
original_head="a35d0eb"
echo '=== Exact commit identities ==='
git show -s --format='%H%n%P%n%s%n%ad' --date=iso-strict "$head_commit" "$previous_head" "$original_head"
echo '=== Requested head status ==='
git status --short
git rev-parse HEAD
git merge-base "$head_commit" "$previous_head" || true
git merge-base "$head_commit" "$original_head" || true
echo '=== Changed files: prior reviewed head to requested head ==='
git diff --name-status --find-renames --find-copies "$previous_head..$head_commit"
echo '=== Changed files: original materializer head to requested head ==='
git diff --name-status --find-renames --find-copies "$original_head..$head_commit"
echo '=== Scoped production and test diff, excluding workflow/runner ==='
git diff --find-renames --find-copies --no-ext-diff "$original_head..$head_commit" -- \
'proof/region/v1/provenance.py' \
'proof/region/v1/arb/pipeline.py' \
'proof/region/v1/arb/tests/test_pipeline.py' \
'proof/region/v1/arb/tests/test_transport.py' \
'proof/region/v1/tests/test_source_lock.py' \
'proof/region/v1/tests/test_build.py' \
'proof/region/v1/tests/test_mpfi_source_lock.py' \
'proof/region/v1/arb/tests/gate.py' \
'proof/region/v1/PROTOCOL.md'
echo '=== Structure of candidate implementation and tests ==='
for file in \
proof/region/v1/provenance.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/arb/tests/test_transport.py \
proof/region/v1/tests/test_mpfi_source_lock.py
do
if test -f "$file"; then
echo "--- $file"
ast-grep outline "$file" --items all --type function,class || true
fi
done
echo '=== Shared materializer, replay, error mapping, and consumer references ==='
rg -n -C 5 \
'materialize_admitted_source_files_v1|replay_admitted_source_archive_v1|source_archive_replay_coordinates_v1|ProvenanceErrorV1|FOREIGN_BINDING|CONTRACT_VIOLATION|_normalized_source_entries_v1' \
proof/region/v1/provenance.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/arb/tests/test_transport.py \
proof/region/v1/tests/test_mpfi_source_lock.py \
2>/dev/null || true
echo '=== Inventory and gate pin references ==='
rg -n -C 4 \
'sha256|SHA-256|inventory|test.*count|172|173|gate' \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/tests/test_build.py \
2>/dev/null || true
echo '=== Engine leakage check: provenance must not import Arb or engine-specific code ==='
rg -n -i -C 3 \
'(^|\s)(import|from)\s+.*\barb\b|arb\.|pipeline|ustar|build' \
proof/region/v1/provenance.py || trueLength of output: 3329 🏁 Script executed: #!/bin/bash
set -u
head_commit="57c4817"
echo '=== Requested commit ==='
if ! git rev-parse --verify "${head_commit}^{commit}" >/dev/null 2>&1; then
echo "ERROR: requested commit ${head_commit} is unavailable"
exit 1
fi
git show -s --format='commit=%H%nparents=%P%nsubject=%s%nauthor-date=%ad' --date=iso-strict "$head_commit"
parent_commit="$(git rev-parse "${head_commit}^")"
echo "parent=${parent_commit}"
echo "checked-out=$(git rev-parse HEAD)"
echo '=== Files changed by requested commit ==='
git diff-tree --no-commit-id --name-status -r --find-renames --find-copies "$head_commit"
echo '=== Full scoped diff against direct parent ==='
git diff --find-renames --find-copies --no-ext-diff "${parent_commit}..${head_commit}" -- \
'proof/region/v1/provenance.py' \
'proof/region/v1/arb/pipeline.py' \
'proof/region/v1/arb/tests/test_pipeline.py' \
'proof/region/v1/arb/tests/test_transport.py' \
'proof/region/v1/tests/test_source_lock.py' \
'proof/region/v1/tests/test_build.py' \
'proof/region/v1/tests/test_mpfi_source_lock.py' \
'proof/region/v1/arb/tests/gate.py' \
'proof/region/v1/PROTOCOL.md'
echo '=== Locate relevant files ==='
fd -t f -a '^(provenance|pipeline|test_source_lock|test_build|test_mpfi_source_lock|test_transport|gate)\.py$' proof/region/v1 2>/dev/null || true
echo '=== Structures ==='
for file in \
proof/region/v1/provenance.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/arb/tests/test_transport.py \
proof/region/v1/tests/test_mpfi_source_lock.py
do
if test -f "$file"; then
echo "--- $file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
fi
done
echo '=== Materializer and public-error flow ==='
rg -n -C 7 \
'materialize_admitted_source_files_v1|replay_admitted_source_archive_v1|source_archive_replay_coordinates_v1|class ProvenanceErrorV1|FOREIGN_BINDING|CONTRACT_VIOLATION|BuildRejectedV1|_normalized_source_entries_v1' \
proof/region/v1 2>/dev/null || true
echo '=== Relevant implementation excerpts ==='
for file in proof/region/v1/provenance.py proof/region/v1/arb/pipeline.py; do
if test -f "$file"; then
echo "--- $file"
rg -n -A 150 -B 12 \
'^(def materialize_admitted_source_files_v1|def replay_admitted_source_archive_v1|def source_archive_replay_coordinates_v1|def _seal_build_input_bundle_v1|class ProvenanceErrorV1)' \
"$file" || true
fi
done
echo '=== Inventory pin and anti-vacuum assertions ==='
rg -n -C 6 \
'sha256|SHA-256|inventory|test.*count|materialize_admitted_source_files_v1|forged|duplicate|missing|permut|mode|digest|coordinate' \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_mpfi_source_lock.py \
proof/region/v1/arb/tests/test_pipeline.py \
proof/region/v1/arb/tests/test_transport.py \
2>/dev/null || true
echo '=== Engine-leakage check in shared provenance ==='
rg -n -i -C 4 \
'(^|\s)(import|from)\s+.*\barb\b|arb\.|pipeline|BuildRejectedV1|aggregate|backend|transport' \
proof/region/v1/provenance.py || trueLength of output: 185607 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit="57c4817"
parent_commit="$(git rev-parse "${head_commit}^")"
echo '=== Commit metadata and direct changed files ==='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head_commit"
git diff-tree --no-commit-id --name-status -r "$head_commit"
git show --stat --oneline --summary "$head_commit"
echo '=== Verify excluded scope is unchanged in direct commit ==='
git diff-tree --no-commit-id --name-only -r "$head_commit" | \
rg -n '(^|/)(\.github|workflow|workflows|runner)(/|$)|runner\.(py|sh)$' || true
echo '=== Public mapping: materializer failure to build rejection ==='
rg -n -C 16 \
'def build\(|_seal_build_input_bundle_v1\(|ProvenanceErrorV1|BuildRejectedV1|CONTRACT_VIOLATION|backend\.|run_build' \
proof/region/v1/arb/pipeline.py \
proof/region/v1/arb/tests/test_pipeline.py
echo '=== Forged-coordinate assertion body ==='
sed -n '830,860p' proof/region/v1/arb/tests/test_pipeline.py
echo '=== Final inventory pins and independent verifier ==='
sed -n '1,55p' proof/region/v1/arb/tests/gate.py
sed -n '35,55p' proof/region/v1/tests/test_build.py
sed -n '265,286p' proof/region/v1/tests/test_build.py
echo '=== Direct diff for inventory pin files ==='
git diff --no-ext-diff "${parent_commit}..${head_commit}" -- \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/tests/test_build.py
echo '=== Materializer test methods ==='
ast-grep outline proof/region/v1/tests/test_source_lock.py \
--items all --type function --match 'test_shared_materializer|test_.*replay' || true
sed -n '475,635p' proof/region/v1/tests/test_source_lock.py
echo '=== Shared module imports ==='
sed -n '1,80p' proof/region/v1/provenance.pyLength of output: 74522
Замечаний в указанном scope нет.
Тесты не запускались. Sandbox запрещает выполнение repository code. You are interacting with an AI system. |
lemone112
force-pushed
the
agent/mpfi-source-materialization
branch
from
August 1, 2026 11:11
57c4817 to
dda9e73
Compare
lemone112
changed the title
lemone112
changed the base branch from
agent/mpfi-observer-placement
to
agent/build-transport
August 1, 2026 11:11
Collaborator
Author
|
@coderabbitai review Fresh exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit="dda9e73"
echo '=== Commit identity ==='
git rev-parse --verify "${head_commit}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head_commit"
parent_commit="$(git rev-parse "${head_commit}^")"
echo "parent=${parent_commit}"
echo "checked_out=$(git rev-parse HEAD)"
echo '=== Direct changed files ==='
git diff-tree --no-commit-id --name-status -r --find-renames --find-copies "$head_commit"
echo '=== Excluded workflow/runner paths changed by this commit ==='
git diff-tree --no-commit-id --name-only -r "$head_commit" | \
rg -n '(^|/)(\.github|workflow|workflows|runner)(/|$)|(^|/)runner\.(py|sh)$' || true
echo '=== Direct diff ==='
git diff --find-renames --find-copies --no-ext-diff "${parent_commit}..${head_commit}" -- .
echo '=== Candidate file structure ==='
for file in \
proof/region/v1/provenance.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/arb/tests/gate.py
do
if test -f "$file"; then
echo "--- $file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
fi
done
echo '=== Derived identity, cache mutation, and exception boundaries ==='
rg -n -C 12 \
'identity|cache|cached|setattr|delattr|__dict__|except\s+(Exception|BaseException)|ProvenanceErrorV1|ProvenanceReasonV1|FOREIGN_BINDING|CONTRACT_VIOLATION' \
proof/region/v1/provenance.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
2>/dev/null || true
echo '=== Shared materializer consumers and engine-leakage scan ==='
rg -n -C 8 \
'materialize_admitted_source_files_v1|replay_admitted_source_archive_v1|source_archive_replay_coordinates_v1|(^|\s)(import|from)\s+.*\barb\b|arb\.|pipeline|BuildRejectedV1|backend|transport|aggregate' \
proof/region/v1/provenance.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
2>/dev/null || true
echo '=== Inventory oracle and pin independence ==='
rg -n -C 12 \
'inventory|sha256|SHA-256|test.*count|order.*hash|gate|outer|oracle|subprocess|independent|materialize_admitted_source_files_v1' \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/tests/test_build.py \
2>/dev/null || trueLength of output: 196445 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit="dda9e73"
parent_commit="$(git rev-parse "${head_commit}^")"
echo '=== Direct changed files only ==='
git diff-tree --no-commit-id --name-status -r "$head_commit"
echo '=== Direct diff, narrowed to provenance and relevant tests ==='
git diff --no-ext-diff --unified=80 "${parent_commit}..${head_commit}" -- \
proof/region/v1/provenance.py \
proof/region/v1/tests/test_source_lock.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/arb/pipeline.py
echo '=== Provenance imports and public materializer/replay region ==='
sed -n '1,110p' proof/region/v1/provenance.py
rg -n -A 240 -B 30 \
'^(def (source_archive_replay_coordinates_v1|replay_admitted_source_archive_v1|materialize_admitted_source_files_v1)|class ProvenanceErrorV1)' \
proof/region/v1/provenance.py
echo '=== Identity/cache and ordinary-hostile-input test methods ==='
rg -n \
'def test_.*(identity|cache|hostile|ordinary|base_exception|BaseException|materializ|replay)' \
proof/region/v1/tests/test_source_lock.py
rg -n -A 100 -B 15 \
'def test_.*(identity|cache|hostile|ordinary|base_exception|BaseException|materializ|replay)' \
proof/region/v1/tests/test_source_lock.py
echo '=== Exact writes to derived identity fields in changed source and tests ==='
rg -n -C 8 \
'(setattr|delattr|__dict__|object\.__setattr__|identity\s*=|\.identity)' \
proof/region/v1/provenance.py \
proof/region/v1/tests/test_source_lock.py
echo '=== Exception clauses in relevant shared source and tests ==='
rg -n -C 8 \
'except\s+(Exception|BaseException)|raise\s+(KeyboardInterrupt|SystemExit)|assertRaises.*(KeyboardInterrupt|SystemExit|BaseException|ProvenanceErrorV1)' \
proof/region/v1/provenance.py \
proof/region/v1/tests/test_source_lock.py
echo '=== Engine-neutral import proof ==='
rg -n \
'^(import|from) ' proof/region/v1/provenance.py
rg -n -i -C 3 \
'\barb\b|pipeline|receipt|build_input|build_transport|BuildRejectedV1|Docker|backend|runner|workflow' \
proof/region/v1/provenance.py || trueLength of output: 185081
Замечаний в указанном scope нет.
Тесты не запускались. Проверка была статической. You are interacting with an AI system. |
lemone112
force-pushed
the
agent/build-transport
branch
from
August 1, 2026 12:55
7a82231 to
284ee16
Compare
lemone112
force-pushed
the
agent/mpfi-source-materialization
branch
from
August 1, 2026 14:08
dda9e73 to
7155024
Compare
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
…t/mpfi-source-materialization # Conflicts: # proof/region/v1/tests/test_build.py
…t/mpfi-source-materialization
This was referenced Aug 1, 2026
Collaborator
Author
|
Этот materializer-срез поглощён терминальным PR #514 (base |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Суть
Выносит единственный engine-neutral materializer допущенных source-архивов в
provenanceи закрывает два общих provenance-нарушения:__dict__; подменаidentityне может сменить capability coordinate;FOREIGN_BINDINGдо BUILD, аKeyboardInterruptне поглощается.Arb сохраняет только свой USTAR layout и aggregate capability; MPFI сможет использовать тот же checked materializer, не импортируя Arb и не дублируя security-critical replay.
Корень
У
frozendataclass остаётся изменяемый__dict__.cached_propertyпозволял внедрить ложную derived identity, а узкая обработка nominal exception оставляла rawRuntimeErrorна public replay path.Инварианты
Проверка на текущей голове
RuntimeError.BuildRejectedV1(CONTRACT_VIOLATION)до backend.-O.-O.-O.git show --checkчист.Граф
База: #508. Этот срез намеренно независим от #509; следующий source-lock срез — #511. Workflow и runner не меняются.