feat: export canonical authorization records v0.1 - #205
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a PythiaLabs authorization export v0.1 profile with a JSON Schema, conformance fixture cases, a Python checker and adversarial tests, dependency pins, a GitHub Actions workflow, and interoperability documentation. ChangesAuthorization Export v0.1 Profile
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 OpenGrep (1.23.0)scripts/test_pythialabs_authorization_export.py┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m [00.11][ERROR]: unable to find a config; path Comment |
5 tasks
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/check_pythialabs_authorization_export.py`:
- Around line 172-179: The verify() logic is trusting
expected["authority_state"] instead of deriving the effective state from the
gate data, so stale or expired cases can pass incorrectly. Update verify() in
the authorization export checker to compute the authority state from the actual
authorization fields (including temporal/drift inputs like evaluation_clock,
expires_at, and revalidation_requirements) and use that derived state when
evaluating allowed/execution_allowed and side-effect expectations. Keep the
existing VALID_STATES guard, but make the state used in the allowed calculation
come from the gate data rather than expected authority_state.
- Around line 31-33: The canonical(value) helper currently uses json.dumps with
sort_keys/separators, which is only a Python-stable encoding and not RFC
8785/JCS-compliant. Replace it with a real JCS canonicalizer so the bytes used
for record_ref hashing match the fixture contract for all legal JSON values.
Keep the change localized to canonical() in the authorization export script and
ensure the hash input is produced from true RFC8785-JCS output.
- Around line 200-211: The verifier in check_pythialabs_authorization_export.py
currently accepts derived records without validating them against the published
schema. Update the main verification flow around verify(case) to validate each
derived record against
schemas/interop/pythialabs-authorization-record-v0.1.schema.json after
derivation, using the record’s actual structure rather than only ad hoc string
checks. Keep the existing case_id/duplicate handling, but fail fast with a clear
FixtureError when the schema check fails so malformed fields like
source_showcase, digests, or timestamps cannot pass.
- Around line 181-190: The join validation in verify() currently checks record
refs and authorization linkage but never asserts the expected join outcome from
handoff.expected_join. Update the verification around handoff(case,
authorization) to compare the observed join semantics against
expected["expected_join"], using the existing joined, observation, and
response_integrity_record checks to distinguish MATCH from
MATCH_WITH_INTEGRITY_FAILURE. Keep the change localized to verify() and the
fixture-driven assertions so the advertised downstream behavior is actually
enforced.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 632835f3-cf84-4dcd-9587-c7f42cd0457c
📒 Files selected for processing (4)
conformance/pythialabs-authorization-export-v0.1.jsondocs/interop/PYTHIALABS_AUTHORIZATION_EXPORT_V0_1.mdschemas/interop/pythialabs-authorization-record-v0.1.schema.jsonscripts/check_pythialabs_authorization_export.py
safal207
marked this pull request as ready for review
June 29, 2026 03:10
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/authorization-export.yml:
- Around line 5-22: The authorization-export workflow is only watching and
installing from scripts/requirements-pythialabs-authorization-export.txt, so
changes to the alias file can bypass CI or never be exercised. Update the
workflow trigger paths in authorization-export.yml and the dependency install
step to include and consume
scripts/pythialabs_authorization_export_requirements.txt as well, ensuring both
the alias and the canonical requirements file are covered. Keep the changes
aligned with the existing authorization export job so either file update runs
the verifier and installs the changed requirements.
In `@scripts/check_pythialabs_authorization_export.py`:
- Around line 68-83: The strings() helper currently returns the original list
object, which lets later mutations leak into the exported record. Update
strings() in check_pythialabs_authorization_export.py to return a new list copy
after validation, and keep export() relying on that helper so
authorization["record"] and canonical_bytes_utf8 stay immutable once built.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 95261914-a63b-49f1-af03-7fe5b80e4b97
📒 Files selected for processing (6)
.github/workflows/authorization-export.ymldocs/interop/PYTHIALABS_AUTHORIZATION_EXPORT_V0_1.mdscripts/check_pythialabs_authorization_export.pyscripts/pythialabs_authorization_export_requirements.txtscripts/requirements-pythialabs-authorization-export.txtscripts/test_pythialabs_authorization_export.py
✅ Files skipped from review due to trivial changes (2)
- scripts/pythialabs_authorization_export_requirements.txt
- docs/interop/PYTHIALABS_AUTHORIZATION_EXPORT_V0_1.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements PythiaLabs #204 as the pre-execution authority side of the three-record trustworthy-transition profile from safal207/Liminal#108.
This PR exports deterministic PythiaLabs gate decisions as provider-neutral
authorization_recordartifacts while preserving PythiaLabs' existing product boundary.Added
docs/interop/PYTHIALABS_AUTHORIZATION_EXPORT_V0_1.mdschemas/interop/pythialabs-authorization-record-v0.1.schema.jsonconformance/pythialabs-authorization-export-v0.1.jsonscripts/check_pythialabs_authorization_export.pyShowcase adapters
The same portable record shape is demonstrated across:
Elixir module names and internal atoms are not normative interoperability fields.
Fixture coverage
Exported bindings
The record keeps separate digests for:
This makes temporal expiry, target-state drift, and evidence drift explicit instead of hiding all context behind one generic digest.
Boundary
Validation
The checker deterministically rebuilds canonical records and handoffs, verifies pinned SHA-256 references, enforces zero additional side effects for blocked/expired/drifted authority, and preserves the independent integrity verdict.
Relates to #204 and safal207/Liminal#108.
Summary by CodeRabbit