ci(verification): emit repository-wide execution receipt - #248
ci(verification): emit repository-wide execution receipt#248Deleted user (ghost) wants to merge 33 commits into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
aegisomega | 44a09a1 | Commit Preview URL Branch Preview URL |
Jul 31 2026, 05:58 PM |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| "> This receipt reports named commands at one exact commit. Static definitions, " | ||
| "unparsed contract assertions, exclusions, deployment state, and runtime authority remain separate.", |
| """ | ||
|
|
||
| from pathlib import Path | ||
| import textwrap |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| - name: Commit verified repairs | ||
| run: | | ||
| set -euo pipefail | ||
| git config user.name 'aegis-verification[bot]' | ||
| git config user.email 'aegis-verification[bot]@users.noreply.github.com' | ||
| git add \ | ||
| sovereign-omega-v2/src/api/claude-client.ts \ | ||
| sovereign-omega-v2/src/api/managed-agent-client.ts \ | ||
| sovereign-omega-v2/src/core/ralph-loop.ts \ | ||
| sovereign-omega-v2/src/scale-os/control-plane.ts \ | ||
| sovereign-omega-v2/src/skill-harness/scanner/codebase-scanner.ts | ||
| git commit -m 'fix(lint): repair typed API and deterministic source boundaries' | ||
| git push origin "HEAD:${HEAD_BRANCH}" |
There was a problem hiding this comment.
3. typescript-source-lint-repair pushes commits 📜 Skill insight ⌂ Architecture
The new PR-triggered workflow grants contents: write and performs a git push, creating a single automated control surface that can mutate repository state. This violates the requirement to avoid any single surface with unrestricted mutation rights.
Agent Prompt
## Issue description
`.github/workflows/typescript-source-lint-repair.yml` is triggered by `pull_request` and has `contents: write`, then commits and pushes changes back to the PR branch. This creates an automated mutation authority surface inside CI.
## Issue Context
Compliance requires that mutation authority is distributed and bounded; CI should not be able to unilaterally mutate repository content in a PR-triggered workflow.
## Fix Focus Areas
- .github/workflows/typescript-source-lint-repair.yml[3-10]
- .github/workflows/typescript-source-lint-repair.yml[68-80]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| /** Send a follow-up message to a running session. */ | ||
| async sendEvent(sessionId: string, message: string): Promise<void> { | ||
| await (this._client as any).beta?.sessions?.createEvent(sessionId, { | ||
| await this.managedClient().beta.sessions.createEvent(sessionId, { | ||
| type: 'user', | ||
| content: message, | ||
| }) | ||
| } |
There was a problem hiding this comment.
4. sendevent() bypasses eventenvelope 📜 Skill insight ⌂ Architecture
ManagedAgentClient.sendEvent() sends raw type/content objects directly via sessions.createEvent instead of communicating through an EventEnvelope. This violates the requirement that agent communication must use EventEnvelope only.
Agent Prompt
## Issue description
Agent communication in `ManagedAgentClient` is performed via direct SDK calls (`sessions.createEvent`) with raw `{ type, content }` payloads rather than `EventEnvelope` objects.
## Issue Context
The compliance rule requires that inter-agent communication is routed exclusively through `EventEnvelope` (to preserve uniform auditability/lineage semantics).
## Fix Focus Areas
- sovereign-omega-v2/src/api/managed-agent-client.ts[161-212]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| #!/usr/bin/env python3 | ||
| """Apply the bounded TypeScript lint repair set for PR #248. | ||
|
|
||
| This script is intentionally temporary. Every replacement asserts the expected | ||
| preimage count and exits before writing the affected file if the preimage does | ||
| not match the admitted source state. | ||
| """ |
There was a problem hiding this comment.
5. apply_typescript_lint_repairs.py missing tier 📜 Skill insight ≡ Correctness
The newly added automation script lacks an explicit T0–T5 tier classification annotation despite introducing a new repair mechanism used by CI. This violates the requirement that every new concept be tier-classified before use.
Agent Prompt
## Issue description
`scripts/apply_typescript_lint_repairs.py` introduces a new deterministic repair mechanism but does not declare an explicit tier classification (T0–T5).
## Issue Context
The compliance rule requires new concepts/constructs to be explicitly tier-classified before use in code.
## Fix Focus Areas
- scripts/apply_typescript_lint_repairs.py[1-7]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| repair: | ||
| name: Repair eleven reproducible TypeScript lint errors | ||
| if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 90 | ||
| env: | ||
| HEAD_BRANCH: ${{ github.head_ref }} | ||
| EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ env.HEAD_BRANCH }} | ||
| fetch-depth: 0 | ||
| token: ${{ github.token }} | ||
|
|
||
| - name: Assert exact writable branch | ||
| run: | | ||
| set -euo pipefail | ||
| test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" | ||
| test -z "$(git status --short)" | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '22' | ||
|
|
||
| - name: Apply deterministic bounded patch | ||
| run: python3 scripts/apply_typescript_lint_repairs.py | ||
|
|
||
| - name: Verify complete TypeScript surface | ||
| working-directory: sovereign-omega-v2 | ||
| run: | | ||
| set -euo pipefail | ||
| npm ci | ||
| npm run lint | ||
| npm run typecheck | ||
| npm run test -- --reporter=dot | ||
| npm run build |
There was a problem hiding this comment.
6. Write token executes pr code 🐞 Bug ⛨ Security
The new typescript-source-lint-repair workflow runs PR-branch code (python3 scripts/... and `npm ci/npm run ...) while granting contents: write`, so a same-repo PR can execute arbitrary commands with a write-capable GITHUB_TOKEN (exfiltrate it and/or push unintended commits). The later “five-file mutation” check cannot mitigate this because the untrusted code runs before that guard.
Agent Prompt
### Issue description
`.github/workflows/typescript-source-lint-repair.yml` executes PR-controlled code (Python + npm install + npm scripts) in the same job where the workflow has `permissions: contents: write` and uses `${{ github.token }}`. For same-repo PRs, this allows arbitrary code execution with a write-capable token.
### Issue Context
This workflow is triggered on `pull_request` when the workflow file changes, but that trigger condition still allows the PR to include arbitrary additional changes (including to `scripts/apply_typescript_lint_repairs.py`, `package.json` scripts, and lockfiles). `npm ci` may run lifecycle scripts; `npm run ...` runs repository-defined scripts.
### Fix Focus Areas
- .github/workflows/typescript-source-lint-repair.yml[1-80]
### Recommended fix approach
Implement one of these safe patterns:
**Option A (simplest/safer): make it manual/trusted-only**
- Replace the `pull_request` trigger with `workflow_dispatch` (or require a maintainer-controlled label/approval gate) and keep `contents: write`.
**Option B (retain automation): split into two jobs with least privilege**
1) **verify job**
- Set `permissions: contents: read`.
- Run `python3 scripts/apply_typescript_lint_repairs.py` and the `npm` verification steps.
- Upload the resulting patch/changed files as an artifact.
2) **push job**
- Depend on `verify`.
- Set `permissions: contents: write`.
- Download the artifact and commit/push *only* those exact files.
- Do **not** run `npm` (or any PR-controlled scripts) in this write-privileged job.
Additionally:
- Use `actions/checkout` with `persist-credentials: false` in any job that runs untrusted code, and only inject credentials in the minimal push step/job.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
Code review by qodo was updated up to the latest commit 44a09a1 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44a09a18c2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
|
|
||
| def pytest_ignore_collect(collection_path: Path, config): # type: ignore[no-untyped-def] | ||
| del config | ||
| return is_standalone_contract_script(Path(collection_path)) |
There was a problem hiding this comment.
When the repository-verification workflow runs python -m pytest ... --ignore=python/tests/test_ledger_persist.py, this hook now returns False for test_ledger_persist.py instead of None; pytest's ignore hook is first-result, so that false result forces collection and prevents the CLI --ignore from taking effect. In this CI path the explicitly excluded 4 GB CoreMatrix persistence suite is still collected/run, which can OOM or fail the new required verification job; return True only for standalone scripts and None otherwise.
Useful? React with 👍 / 👎.
| - name: Apply deterministic bounded patch | ||
| run: python3 scripts/apply_typescript_lint_repairs.py |
There was a problem hiding this comment.
Because this workflow is triggered by changes to typescript-source-lint-repair.yml, the PR that adds this file also runs this step against the already-repaired sources in this same commit. The repair script still asserts the old preimage such as (event as any).usage and exits before verification when that text is gone, so this write-capable check fails immediately instead of producing useful evidence; either delete the temporary workflow after applying the repairs or make the script idempotent.
Useful? React with 👍 / 👎.
| matrix: | ||
| include: |
There was a problem hiding this comment.
This matrix only audits the sovereign runtime, studio, and MCP server, but the same PR adds a repository-wide security policy for every executable surface and the repo has other tracked lockfile-backed products such as hub/, cockpit/, enterprise/, platform-picker/, and tactical/. In PRs that touch those omitted surfaces, high/critical production vulnerabilities can still be introduced while this new "Production Dependency Audit" passes, so add the remaining production lockfiles or make the gate explicitly scoped.
Useful? React with 👍 / 👎.
ghost
left a comment
ghost
left a comment
There was a problem hiding this comment.
Recovery-mode correction:
- Current PR head is
44a09a18c2333863387b323e2de392f30e9a9bf0, while the body presents81b5f43a26ff1ec4048eebd19950dd3589809a62as the final verified candidate. - The PR base snapshot is
afe904d0c313691353eae0d5c3ff782a2f740a7f; currentmainhas advanced to0bdffe75b56e5cd27c0632e1ba166620da327494. - All 15 pull-request-triggered GitHub Actions runs visible for the current head concluded
action_required, including repository-wide verification, Automaton-2, Automaton-3, experiment admission, Scale OS controls, Kernel One, MCP resources, Integration Ledger, OSV, Hadolint, lint and dependency audit. - The combined commit-status surface currently shows only successful Vercel statuses. Those do not establish repository verification.
Therefore VERIFIED is not admissible for the current head. The PR has been returned to draft. Before readiness, the description and receipt must bind the actual head, the branch must be reconciled with current main, and the named GitHub Actions workflows must execute conclusively on that exact candidate.
ghost
mentioned this pull request
Admission hold — exact-head evidence invalidatedCurrent verification snapshot (2026-08-01):
Therefore the embedded Required before this PR can act as verification authority:
Status: BLOCKED / NOT AUTHORITATIVE. No merge authorization. |
Purpose
Stop presenting one suite's passing count as if it represented the whole repository.
This PR creates an exact-head repository verification receipt that separates:
A grep-derived definition count is never reported as a passing-test count.
Final exact-head evidence
Candidate commit:
81b5f43a26ff1ec4048eebd19950dd3589809a62Repository receipt:
VERIFIED;d3f2093e251ba6043f838c6b8753af70d2489a129d33ba305ee2eb1da9a835c4.Parsed suite counts:
Executed successfully but intentionally not converted into a fabricated numeric total:
Production dependency evidence
Exact-head JSON audits now report zero vulnerabilities at every severity for:
sovereign-omega-v2production graph;studioproduction graph;sovereign-omega-v2/mcp-serverproduction graph.Repairs included:
postcsspatched to8.5.18;1.30.0and vulnerable transitive lock entries repaired;The temporary write-capable dependency-repair workflow was deleted after producing the bounded four-file patch. It is not part of the final diff.
Python corpus correction
The repository contains two Python test semantics:
sys.exit.The latter are now isolated from pytest import and executed as subprocess tests rather than silently excluded. Full collection also exposed undeclared runtime imports;
jsonschemaandredisare now declared inpython/requirements.txt.Explicit exclusions remain visible in the receipt:
test_ledger_persist.py: existing approximately 4 GB real-CoreMatrix allocation boundary;stress_test.py: performance stress program, not part of deterministic unit/contract verification.Existing control-plane checks
On the final candidate, Experiment Admission, Automaton-2, Automaton-3, Scale OS Controls, Kernel One, MCP Resources, Integration Ledger, OSV-Scanner, Hadolint, frozen membrane, Rust suites, Gate 8, Python bridge, Studio, all six product builds, and the Constitutional Ceremony have passed. The informational TypeScript coverage job may complete after the ceremony and does not contribute authority to the repository receipt.
Authority boundary
The receipt proves only named commands against one exact commit. It does not prove deployment state, live telemetry, or runtime authority.
Studio on canonical remote still has a build contract but no committed test script. Therefore the five local Holonñgram tests are not claimed by this PR. The local Holonñgram worktree must be pushed or replayed into a branch before it can receive repository-wide evidence.
Source-informed next security slice
The supplied GPT-5.6 and Claude Mythos system cards support stronger intent boundaries, confirmations for consequential actions, prompt-injection testing, reckless-action preflight, and continuous monitoring. Cloudflare's post-quantum origin-auth work supports a separate ML-DSA mTLS readiness assessment. None of those later capabilities are falsely claimed as implemented in this PR.
The third supplied Drive file remains inaccessible to the connected account (
404 Not Found) and is not used as evidence.