Fix hosted runner public-surface regression - #35
Merged
Conversation
Why: - A literal hosted-runner home example in the build/test spec matched the executing release runner's real home and correctly failed the public-source gate. Changed: - Replaced environment-specific absolute runner-home examples with symbolic fail-closed guidance. - Added deterministic live-spec and synthetic-leak coverage for hosted runner home scanning without changing scanner policy. Verification: - Focused public-surface tests passed (28/28). - Implementation and spec-only harness profiles passed on the same task-tree fingerprint. - Repository and independent staged current-source audits passed. Affected: - client/test/public-surface.test.mjs - spec/build-and-test.md Refs: - https://github.com/fiveonecode/simulator-broker/actions/runs/33370063438 Session: - task-sessions/rr19-runner-home-public-surface-20260831
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Reviewed top-level PR feedback and left the current code unchanged. These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The failure was an interaction between a correct environment-derived scanner and tracked documentation that named the executing runner's own home. This fix removes that collision without adding an allowlist or changing scanner policy. If a real matching home path enters tracked source later, the gate still fails and recovery remains removal or generalization of that path.
How you verified
node --test client/test/public-surface.test.mjs(28/28)npm run verify:public-surface(258 tracked files)implementationharness profile, including full broker/client/app/harness suitesspec-onlyharness profile, including 42 public documentation/release checksNotes
This PR does not select or move a tag and does not change release assets, retained artifacts, Formula, or Cask files. Residual risk remains intentional: a future tracked absolute path equal to the executing account home will fail closed and must be generalized rather than bypassed.