docs: align buyer README with read-only handoff - #73
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@opencode-agent Apply only the bounded changelog completion to exact current head Modify only Under Do not change the version. Do not modify README, tests, |
|
@opencode-agent Supersede the immediately preceding changelog-only request. On exact current head
Do not change the version. Do not modify tests, |
|
@coderabbitai review Review only exact current head |
|
@opencode-agent Perform a read-only exact-head review of PR #73 at Verify that the immutable RED commit |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red="233db635419ee21ec80a3409629ff6d767ebd9eb"
green="17f226211be1a6b810f3715b2c3a4686b9a5b67d"
printf '%s\n' '== Checked-out commit and requested objects =='
git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$red"
git cat-file -t "$green"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$base" "$red" "$green"
printf '%s\n' '== Ancestry checks =='
git merge-base --is-ancestor "$base" "$red" && echo "base is ancestor of RED"
git merge-base --is-ancestor "$red" "$green" && echo "RED is ancestor of GREEN"
printf '%s\n' '== Changed paths and stats: base..GREEN =='
git diff --stat "$base" "$green"
git diff --name-status "$base" "$green"
printf '%s\n' '== Changed paths and stats: base..RED =='
git diff --stat "$base" "$red"
git diff --name-status "$base" "$red"
printf '%s\n' '== Changed paths and stats: RED..GREEN =='
git diff --stat "$red" "$green"
git diff --name-status "$red" "$green"
printf '%s\n' '== Full text diff: base..GREEN =='
git diff --no-ext-diff --unified=80 "$base" "$green" -- README.md CHANGELOG.md
printf '%s\n' '== Full text diff: base..RED =='
git diff --no-ext-diff --unified=80 "$base" "$red" -- README.md CHANGELOG.md
printf '%s\n' '== Full text diff: RED..GREEN =='
git diff --no-ext-diff --unified=80 "$red" "$green" -- README.md CHANGELOG.md
printf '%s\n' '== Candidate regression test files in base..GREEN =='
git diff --name-only "$base" "$green" | while IFS= read -r f; do
case "$f" in
*test*|*spec*) printf '%s\n' "$f" ;;
esac
done
printf '%s\n' '== README assertions at each revision =='
for rev in "$base" "$red" "$green"; do
echo "-- $rev --"
git show "$rev:README.md" | rg -n -i -C 2 \
'third.publisher|credential.free|credential-free|handoff|promotion|reconstruct|repository write|auto-merge|pull request|branch' \
|| true
done
printf '%s\n' '== Changelog release headings at base and GREEN =='
for rev in "$base" "$green"; do
echo "-- $rev --"
git show "$rev:CHANGELOG.md" | rg -n -C 2 '^\[Unreleased\]|^## \[|^### Fixed' || true
done
printf '%s\n' '== PR metadata and check status =='
gh pr view 73 --repo ContextualWisdomLab/EgressWeave \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,statusCheckRollup}'Length of output: 45697 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red="233db635419ee21ec80a3409629ff6d767ebd9eb"
green="17f226211be1a6b810f3715b2c3a4686b9a5b67d"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
doc_path="docs/hourly-autonomous-maintenance.md"
printf '%s\n' '== Regression test diff and full source =='
git diff --no-ext-diff --unified=100 "$base" "$green" -- "$test_path"
for rev in "$red" "$green"; do
echo "-- $rev:$test_path --"
git show "$rev:$test_path" | cat -n
done
printf '%s\n' '== Test function map =='
ast-grep outline "$test_path" --items all --type function --view expanded
printf '%s\n' '== Base handoff contract excerpts =='
git show "$base:$doc_path" | rg -n -i -C 4 \
'credential.free|credential-free|handoff|exact.base|exact base|digest|repository write|auto.merge|auto-merge|publisher|promotion|reconstruct|verify' \
|| true
printf '%s\n' '== Exact test-string evidence in README revisions =='
for rev in "$red" "$green"; do
echo "-- $rev --"
git show "$rev:README.md" | rg -n -F \
-e 'The product workflow uses two fresh runners.' \
-e 'The product workflow ends at the independently reverified credential-free patch handoff' \
-e 'does not create branches, pull requests, repository writes, or auto-merge requests.' \
-e 'Any future external, independently reviewed, credential-separated promotion must reconstruct' \
-e 'and verify the exact tree before any repository write.' \
-e 'The product workflow uses three fresh runners.' \
-e 'A third publisher rechecks the sealed patch' \
|| true
done
printf '%s\n' '== README final-byte state =='
for rev in "$base" "$red" "$green"; do
printf '%s ' "$rev"
if git show "$rev:README.md" | tail -c 1 | od -An -t x1 | rg -q '0a'; then
echo 'ends with LF'
else
echo 'does not end with LF'
fi
done
printf '%s\n' '== Changelog changes, excluding Unreleased section context =='
git diff --no-ext-diff --unified=3 "$base" "$green" -- CHANGELOG.md
printf '%s\n' '== Non-doc/test changed paths classified =='
git diff --name-only "$base" "$green" | awk '
$0 == "README.md" || $0 == "CHANGELOG.md" || $0 == "tests/test_hourly_opencode_nvidia_contract.py" { next }
{ print }
'Length of output: 38009 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red="233db635419ee21ec80a3409629ff6d767ebd9eb"
green="17f226211be1a6b810f3715b2c3a4686b9a5b67d"
normalize_readme() {
git show "$1:README.md" | tr -s '[:space:]' ' '
}
printf '%s\n' '== Regression conditions after the test whitespace normalization =='
for rev in "$red" "$green"; do
normalized="$(normalize_readme "$rev")"
echo "-- $rev --"
for condition in \
'A third publisher' \
'ends at the independently reverified credential-free patch handoff' \
'does not create branches, pull requests, repository writes, or auto-merge requests' \
'external, independently reviewed, credential-separated promotion' \
'reconstruct and verify the exact tree before any repository write'
do
if printf '%s' "$normalized" | grep -Fq -- "$condition"; then
printf 'present: %s\n' "$condition"
else
printf 'absent: %s\n' "$condition"
fi
done
done
printf '%s\n' '== README final byte, Base64 encoded =='
for rev in "$base" "$red" "$green"; do
printf '%s: ' "$rev"
git show "$rev:README.md" | tail -c 1 | base64 | tr -d '\n'
printf '\n'
done
printf '%s\n' '== Whitespace error check for exact review range =='
git diff --check "$base" "$green"
printf '%s\n' '== Commit-level changed paths =='
git diff-tree --no-commit-id --name-status -r "$red"
git diff-tree --no-commit-id --name-status -r "$green"Length of output: 2737
I reviewed exact head
|
|
@coderabbitai review Review only exact current head |
|
@opencode-agent Perform a read-only exact-head review of PR #73 at Verify both immutable test-first boundaries: |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red_publication="233db635419ee21ec80a3409629ff6d767ebd9eb"
red_egress="e1a4557fd42c16cad5469ecd2a362cf10c438854"
green="b58d1fd234b9224881e97c340d9eb18a03ff5cd5"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
operator_path="docs/hourly-autonomous-maintenance.md"
printf '%s\n' '== Exact objects and ancestry =='
printf 'checked_out_head='
git rev-parse HEAD
for rev in "$base" "$red_publication" "$red_egress" "$green"; do
git cat-file -e "${rev}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$rev"
done
git merge-base --is-ancestor "$base" "$red_publication" && echo 'base -> publication RED: yes'
git merge-base --is-ancestor "$red_publication" "$red_egress" && echo 'publication RED -> egress RED: yes'
git merge-base --is-ancestor "$red_egress" "$green" && echo 'egress RED -> GREEN: yes'
printf '%s\n' '== Changed paths and whitespace: base..GREEN =='
git diff --name-status "$base" "$green"
git diff --stat "$base" "$green"
git diff --check "$base" "$green"
printf '%s\n' '== Commit-level changed paths =='
for rev in "$red_publication" "$red_egress" "$green"; do
printf '\n-- %s --\n' "$rev"
git diff-tree --no-commit-id --name-status -r "$rev"
done
printf '%s\n' '== Three-file diff: base..GREEN =='
git diff --no-ext-diff --unified=80 "$base" "$green" -- \
README.md CHANGELOG.md "$test_path"
printf '%s\n' '== README and changelog diffs at each RED boundary =='
for range in "$base $red_publication" "$red_publication $red_egress" "$red_egress $green"; do
set -- $range
printf '\n-- %s..%s --\n' "$1" "$2"
git diff --no-ext-diff --unified=40 "$1" "$2" -- README.md CHANGELOG.md
done
printf '%s\n' '== Contract test source at RED and GREEN revisions =='
for rev in "$red_publication" "$red_egress" "$green"; do
printf '\n-- %s:%s --\n' "$rev" "$test_path"
git show "$rev:$test_path" | cat -n
done
printf '%s\n' '== Buyer wording at publication RED, egress RED, and GREEN =='
for rev in "$red_publication" "$red_egress" "$green"; do
printf '\n-- %s:README.md --\n' "$rev"
git show "$rev:README.md" | rg -n -i -C 3 \
'two fresh runners|three fresh runners|third publisher|credential-free|handoff|exact-base|digest-bound|network|web tools|model|NVIDIA NIM|GitHub|package sources|promotion|repository write|auto-merge|pull requests|branches' || true
done
printf '%s\n' '== Operator contract evidence at stacked base =='
git show "$base:$operator_path" | rg -n -i -C 4 \
'two fresh runners|credential-free|exact.base|digest|handoff|network|web tools|package sources|GitHub|NVIDIA NIM|repository write|auto-merge|pull request|branch|promotion|reconstruct|verify' || true
printf '%s\n' '== Changelog headings and changed Unreleased section =='
for rev in "$base" "$green"; do
printf '\n-- %s:CHANGELOG.md headings --\n' "$rev"
git show "$rev:CHANGELOG.md" | rg -n -C 2 '^\[Unreleased\]|^## \[|^### Fixed' || true
done
printf '%s\n' '== README EOF byte =='
for rev in "$base" "$green"; do
printf '%s: ' "$rev"
git show "$rev:README.md" | tail -c 1 | od -An -t x1
done
printf '%s\n' '== PR metadata (informational only) =='
gh pr view 73 --repo ContextualWisdomLab/EgressWeave \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup}'Length of output: 98641 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red_publication="233db635419ee21ec80a3409629ff6d767ebd9eb"
red_egress="e1a4557fd42c16cad5469ecd2a362cf10c438854"
green="b58d1fd234b9224881e97c340d9eb18a03ff5cd5"
normalized_readme() {
git show "$1:README.md" | tr '\n\t' ' ' | tr -s ' '
}
check_phrase() {
rev="$1"
phrase="$2"
expected="$3"
content="$(normalized_readme "$rev")"
if printf '%s' "$content" | grep -Fq -- "$phrase"; then
actual="present"
else
actual="absent"
fi
printf '%s | expected=%s | actual=%s | %s\n' "$phrase" "$expected" "$actual" "$rev"
[ "$actual" = "$expected" ]
}
printf '%s\n' '== Publication-boundary RED-to-GREEN text conditions =='
check_phrase "$red_publication" "A third publisher" "present"
check_phrase "$red_publication" "ends at the independently reverified credential-free patch handoff" "absent"
check_phrase "$red_publication" "does not create branches, pull requests, repository writes, or auto-merge requests" "absent"
check_phrase "$red_publication" "external, independently reviewed, credential-separated promotion" "absent"
check_phrase "$red_publication" "reconstruct and verify the exact tree before any repository write" "absent"
check_phrase "$green" "A third publisher" "absent"
check_phrase "$green" "ends at the independently reverified credential-free patch handoff" "present"
check_phrase "$green" "does not create branches, pull requests, repository writes, or auto-merge requests" "present"
check_phrase "$green" "external, independently reviewed, credential-separated promotion" "present"
check_phrase "$green" "reconstruct and verify the exact tree before any repository write" "present"
printf '%s\n' '== Egress-boundary RED-to-GREEN text conditions =='
check_phrase "$red_egress" "no direct network access" "present"
check_phrase "$red_egress" "runner egress is restricted" "absent"
check_phrase "$red_egress" "model web/network tools are denied" "absent"
check_phrase "$red_egress" "NVIDIA NIM endpoint" "absent"
check_phrase "$green" "no direct network access" "absent"
check_phrase "$green" "runner egress is restricted" "present"
check_phrase "$green" "model web/network tools are denied" "present"
check_phrase "$green" "NVIDIA NIM endpoint" "present"
printf '%s\n' '== Historical changelog content: base vs GREEN =='
historical_base="$(git show "$base:CHANGELOG.md" | sed -n '/^## \[0\.3\.0\]/,$p' | sha256sum | awk '{print $1}')"
historical_green="$(git show "$green:CHANGELOG.md" | sed -n '/^## \[0\.3\.0\]/,$p' | sha256sum | awk '{print $1}')"
printf 'base_sha256=%s\ngreen_sha256=%s\n' "$historical_base" "$historical_green"
[ "$historical_base" = "$historical_green" ]
git diff --no-ext-diff --exit-code "$base" "$green" -- \
':(literal)CHANGELOG.md' \
--word-diff=porcelain >/dev/null || true
git diff --no-ext-diff --unified=0 "$base" "$green" -- CHANGELOG.md | sed -n '1,40p'
printf '%s\n' '== README final newline =='
for rev in "$base" "$green"; do
if git show "$rev:README.md" | tail -c 1 | grep -qx ''; then
printf '%s ends with LF\n' "$rev"
else
printf '%s does not end with LF\n' "$rev"
fi
done
printf '%s\n' '== PR metadata, informational only =='
gh pr view 73 --repo ContextualWisdomLab/EgressWeave \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup}'Length of output: 5989
Python substring checks are case-sensitive. Therefore, You are interacting with an AI system. |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
red_publication="233db635419ee21ec80a3409629ff6d767ebd9eb"
red_egress="e1a4557fd42c16cad5469ecd2a362cf10c438854"
red_architecture="cb1e9d9f19b118769eee64cf1a4b52a0c39c4b4b"
green="9db7143d68c78a804fd653f48525332935bb28fd"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
operator_path="docs/hourly-autonomous-maintenance.md"
echo '== Exact revisions =='
printf 'checked_out_head='
git rev-parse HEAD
for rev in "$base" "$red_publication" "$red_egress" "$red_architecture" "$green"; do
git cat-file -e "${rev}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$rev"
done
echo '== Ancestry =='
git merge-base --is-ancestor "$base" "$red_publication" && echo 'base -> publication RED: yes'
git merge-base --is-ancestor "$red_publication" "$red_egress" && echo 'publication RED -> egress RED: yes'
git merge-base --is-ancestor "$red_egress" "$red_architecture" && echo 'egress RED -> architecture RED: yes'
git merge-base --is-ancestor "$red_architecture" "$green" && echo 'architecture RED -> GREEN: yes'
echo '== Changed paths and whitespace: base..GREEN =='
git diff --name-status "$base" "$green"
git diff --stat "$base" "$green"
git diff --check "$base" "$green"
echo '== Per-commit changed paths =='
for rev in "$red_publication" "$red_egress" "$red_architecture" "$green"; do
echo "-- $rev --"
git diff-tree --no-commit-id --name-status -r "$rev"
done
echo '== Full scoped diff: base..GREEN =='
git diff --no-ext-diff --unified=100 "$base" "$green" -- \
README.md ARCHITECTURE.md CHANGELOG.md "$test_path"
echo '== RED-to-GREEN document diffs =='
for range in \
"$base $red_publication" \
"$red_publication $red_egress" \
"$red_egress $red_architecture" \
"$red_architecture $green"
do
set -- $range
echo "-- $1..$2 --"
git diff --no-ext-diff --unified=70 "$1" "$2" -- README.md ARCHITECTURE.md CHANGELOG.md "$test_path"
done
echo '== Full regression contract at RED and GREEN revisions =='
for rev in "$red_publication" "$red_egress" "$red_architecture" "$green"; do
echo "-- $rev:$test_path --"
git show "$rev:$test_path" | cat -n
done
echo '== Regression-test function map =='
ast-grep outline "$test_path" --items all --type function --view expanded
echo '== Buyer-facing contract wording at each boundary =='
for rev in "$red_publication" "$red_egress" "$red_architecture" "$green"; do
echo "-- $rev --"
for path in README.md ARCHITECTURE.md; do
echo " :: $path"
git show "$rev:$path" | rg -n -i -C 3 \
'two fresh runners|three fresh runners|third publisher|product.*publication|publication.*runner|credential-free|exact-base|exact base|digest-bound|handoff|network|web tools|runner egress|package sources|GitHub|NVIDIA NIM|promotion|repository write|auto-merge|pull requests|branches|reconstruct|verify' \
|| true
done
done
echo '== Operator contract at stacked base =='
git show "$base:$operator_path" | rg -n -i -C 4 \
'two fresh runners|credential-free|exact.base|exact base|digest|handoff|network|web tools|package sources|GitHub|NVIDIA NIM|repository write|auto-merge|pull request|branch|promotion|reconstruct|verify' \
|| true
echo '== Unreleased and historical changelog comparison =='
for rev in "$base" "$green"; do
echo "-- $rev headings --"
git show "$rev:CHANGELOG.md" | rg -n -C 3 '^\[Unreleased\]|^## \[|^### Fixed' || true
done
base_historical="$(git show "$base:CHANGELOG.md" | sed -n '/^## \[0\.3\.0\]/,$p' | sha256sum | awk '{print $1}')"
green_historical="$(git show "$green:CHANGELOG.md" | sed -n '/^## \[0\.3\.0\]/,$p' | sha256sum | awk '{print $1}')"
printf 'historical_base_sha256=%s\nhistorical_green_sha256=%s\n' "$base_historical" "$green_historical"
echo '== Exact test phrase checks =='
normalize() {
git show "$1:$2" | tr '\n\t' ' ' | tr -s ' '
}
assert_phrase() {
rev="$1"; path="$2"; expected="$3"; phrase="$4"
if normalize "$rev" "$path" | grep -Fq -- "$phrase"; then actual=present; else actual=absent; fi
printf '%s | %s | expected=%s | actual=%s\n' "$rev" "$path" "$expected" "$actual"
}
assert_phrase "$red_publication" README.md present 'A third publisher'
assert_phrase "$green" README.md absent 'A third publisher'
assert_phrase "$red_egress" README.md present 'no direct network access'
assert_phrase "$green" README.md absent 'no direct network access'
assert_phrase "$green" README.md present 'Model web/network tools are denied'
assert_phrase "$green" README.md present 'runner egress is restricted'
assert_phrase "$green" README.md present 'NVIDIA NIM endpoint'
assert_phrase "$red_architecture" ARCHITECTURE.md present 'publication'
assert_phrase "$green" ARCHITECTURE.md present 'credential-free'
assert_phrase "$green" ARCHITECTURE.md present 'does not create branches, pull requests, repository writes, or auto-merge requests'
assert_phrase "$green" ARCHITECTURE.md present 'reconstruct and verify the exact tree before any repository write'
echo '== PR metadata and exact-head checks, informational only =='
gh pr view 73 --repo ContextualWisdomLab/EgressWeave \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,statusCheckRollup}'Length of output: 178321
Python string membership checks are case-sensitive. Therefore, The remaining scoped review results are consistent with the requested contract:
GitHub reports only a successful CodeRabbit status for this exact head. Required hosted CI and security evidence is missing. I do not treat that status as acceptance evidence. I did not approve, merge, or modify the PR.
|
|
@opencode-agent Progress #81 only if the live PR #73 head is still exactly Adjacent buyer-facing inspection found one stale accepted-ADR claim that #73 does not yet cover: Use two auditable commits in order:
Do not modify After GREEN, run the focused documentation contract plus the complete repository contract available on this stacked branch. Report RED SHA, GREEN/current SHA, exact changed paths, and validation evidence in this PR conversation. Missing or draft-skipped hosted checks are not success; the final stack still requires auditable credential-separated reconstruction after #66 integrates. |
|
@opencode-agent Complete only the bounded README GREEN on exact current head Exact-head CI run Modify only After that README-only change, run the focused failing contract and the complete repository CI/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract available on the branch. Report the resulting exact head and evidence here. Keep the PR Draft. Do not merge, mark Ready, auto-merge, rebase, retarget, publish, or release. |
|
@opencode-agent Supersede my immediately preceding README-only request because the branch advanced before it could apply. Complete only the bounded README GREEN on exact current head Exact-head CI run Modify only Then run the focused failing contract and the complete repository test/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract. Report the resulting exact head and evidence here. Keep Draft; do not merge, mark Ready, auto-merge, rebase, retarget, publish, or release. |
|
@opencode-agent Supersede my README-only request on On exact current head Then run the focused contract and the complete repository test/100% production statement+branch coverage/public-docstring/Ruff/compile/package contract. Report the resulting exact head and evidence here. Keep Draft; do not merge, mark Ready, auto-merge, rebase, retarget, publish, or release. |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
head="3b484b2692be2c078a68a77d810798832d0beacd"
red_publication="233db635419ee21ec80a3409629ff6d767ebd9eb"
red_egress="e1a4557fd42c16cad5469ecd2a362cf10c438854"
red_architecture="cb1e9d9f19b118769eee64cf1a4b52a0c39c4b4b"
red_adr="294e562b9dfce43fcccd7209588b88597b8a42c7"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
echo '== Exact revision and ancestry =='
printf 'checked_out_head='
git rev-parse HEAD
for rev in "$base" "$red_publication" "$red_egress" "$red_architecture" "$red_adr" "$head"; do
git cat-file -e "${rev}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$rev"
done
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git merge-base --is-ancestor "$red_publication" "$head" && echo 'publication_red_is_ancestor=yes'
git merge-base --is-ancestor "$red_egress" "$head" && echo 'egress_red_is_ancestor=yes'
git merge-base --is-ancestor "$red_architecture" "$head" && echo 'architecture_red_is_ancestor=yes'
git merge-base --is-ancestor "$red_adr" "$head" && echo 'adr_red_is_ancestor=yes'
echo '== Changed paths and whitespace =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Scoped file structure =='
ast-grep outline "$test_path" --items all --type function --view expanded
echo '== Full five-file diff =='
git diff --no-ext-diff --unified=45 "$base" "$head" -- \
README.md ARCHITECTURE.md docs/adr/0001-security-boundaries-and-modular-integration.md \
CHANGELOG.md "$test_path"
echo '== Per-boundary diffs =='
for pair in \
"$base $red_publication" \
"$red_publication $red_egress" \
"$red_egress $red_architecture" \
"$red_architecture $red_adr" \
"$red_adr $head"
do
set -- $pair
echo "-- $1..$2 --"
git diff --no-ext-diff --unified=20 "$1" "$2" -- \
README.md ARCHITECTURE.md docs/adr/0001-security-boundaries-and-modular-integration.md \
CHANGELOG.md "$test_path"
done
echo '== Relevant test functions at HEAD =='
rg -n -A45 -B3 \
'def test_(buyer_readme_describes|architecture_describes|accepted_adr_describes)' \
"$test_path"
echo '== Exact wording across buyer-facing documents at HEAD =='
for path in README.md ARCHITECTURE.md docs/adr/0001-security-boundaries-and-modular-integration.md; do
echo "-- $path --"
git show "$head:$path" | rg -n -i -C 3 \
'third publisher|three fresh runners|publication.*runner|publishing identity|credential-free|handoff|exact-base|digest-bound|model web/network tools|runner egress|package sources|github|nvidia nim|branches|pull requests|repository writes|auto-merge|external|independently reviewed|credential-separated|reconstruct|verify' \
|| true
done
echo '== RED-to-GREEN phrase conditions =='
normalize() { git show "$1:$2" | tr '\n\t' ' ' | tr -s ' '; }
for rev in "$red_publication" "$red_egress" "$red_architecture" "$red_adr" "$head"; do
echo "-- $rev --"
for spec in \
'README.md|A third publisher' \
'README.md|no direct network access' \
'README.md|model web/network tools are denied' \
'ARCHITECTURE.md|publishing identity creates a normal pull request' \
'docs/adr/0001-security-boundaries-and-modular-integration.md|publishing identity creates a normal pull request' \
'docs/adr/0001-security-boundaries-and-modular-integration.md|external, independently reviewed, credential-separated promotion'
do
path="${spec%%|*}"; phrase="${spec#*|}"
if normalize "$rev" "$path" | grep -Fiq -- "$phrase"; then state=present; else state=absent; fi
printf '%s: %s\n' "$state" "$spec"
done
done
echo '== Changelog historical-content checksum =='
for rev in "$base" "$head"; do
printf '%s ' "$rev"
git show "$rev:CHANGELOG.md" | sed -n '/^## \[0\.3\.0\]/,$p' | sha256sum
done
git diff --no-ext-diff --unified=12 "$base" "$head" -- CHANGELOG.md
echo '== Exact PR metadata and check runs =='
gh pr view 73 --repo ContextualWisdomLab/EgressWeave \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,statusCheckRollup}'
gh api "repos/ContextualWisdomLab/EgressWeave/commits/$head/check-runs" \
--jq '.check_runs[] | {name,status,conclusion,details_url}'Length of output: 94648 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
head="3b484b2692be2c078a68a77d810798832d0beacd"
parent="$(git rev-parse "${head}^")"
operator_path="docs/hourly-autonomous-maintenance.md"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
echo '== README EOF bytes =='
for rev in "$base" "$parent" "$head"; do
printf '%s ' "$rev"
git show "$rev:README.md" | tail -c 1 | od -An -t x1
done
echo '-- README EOF diff metadata by revision --'
git diff --no-ext-diff --summary "$base" "$head" -- README.md
git diff --no-ext-diff --summary "$parent" "$head" -- README.md
echo '== Operator handoff contract at base =='
git show "$base:$operator_path" | rg -n -i -C 5 \
'exact.base|exact base|digest|sha-256|credential-free|handoff|two fresh runners|model web/network tools|runner egress|package sources|nvidia nim|repository write|pull request|auto-merge|external.*promotion|reconstruct|verify' \
|| true
echo '== Cross-document exact required phrases at head =='
for path in README.md ARCHITECTURE.md docs/adr/0001-security-boundaries-and-modular-integration.md; do
echo "-- $path --"
git show "$head:$path" | tr '\n\t' ' ' | tr -s ' ' | \
grep -Eio '.{0,90}(credential-free patch handoff|model web/network tools are denied|runner egress is restricted|external, independently reviewed, credential-separated promotion|reconstruct and verify the exact tree before any repository write).{0,90}' \
|| true
done
echo '== Test syntax and asserted-phrase audit =='
git show "$head:$test_path" | python3 -c '
import ast
import sys
source = sys.stdin.read()
ast.parse(source)
print("python_syntax=valid")
for phrase in (
"model web/network tools are denied",
"runner egress is restricted",
"NVIDIA NIM endpoint",
"ends at the independently reverified credential-free patch handoff",
"reconstruct and verify the exact tree before any repository write",
):
print(f"{phrase}={source.count(phrase)}")
'
echo '== Exact GitHub Actions run metadata =='
gh run view 31146404269 --repo ContextualWisdomLab/EgressWeave \
--json databaseId,headSha,status,conclusion,event,workflowName,createdAt,updatedAt,jobs \
--jq '{databaseId,headSha,status,conclusion,event,workflowName,createdAt,updatedAt,jobs:[.jobs[]|{name,status,conclusion,startedAt,completedAt,steps:[.steps[]|{name,status,conclusion}]}]}'Length of output: 2775 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="c038a9509d1a8eae8561cc9081e67e12bd373d42"
head="3b484b2692be2c078a68a77d810798832d0beacd"
parent="$(git rev-parse "${head}^")"
operator_path="docs/hourly-autonomous-maintenance.md"
test_path="tests/test_hourly_opencode_nvidia_contract.py"
echo '== README EOF bytes =='
for rev in "$base" "$parent" "$head"; do
printf '%s ' "$rev"
git show "$rev:README.md" | python3 -c '
import sys
data = sys.stdin.buffer.read()
print("empty" if not data else f"last_byte=0x{data[-1]:02x}")
'
done
echo '-- README EOF diff metadata by revision --'
git diff --no-ext-diff --summary "$base" "$head" -- README.md
git diff --no-ext-diff --summary "$parent" "$head" -- README.md
echo '== Operator handoff contract at base =='
git show "$base:$operator_path" | rg -n -i -C 5 \
'exact.base|exact base|digest|sha-256|credential-free|handoff|two fresh runners|model web/network tools|runner egress|package sources|nvidia nim|repository write|pull request|auto-merge|external.*promotion|reconstruct|verify' \
|| true
echo '== Cross-document exact required phrases at head =='
for path in README.md ARCHITECTURE.md docs/adr/0001-security-boundaries-and-modular-integration.md; do
echo "-- $path --"
git show "$head:$path" | tr '\n\t' ' ' | tr -s ' ' | \
grep -Eio '.{0,90}(credential-free patch handoff|model web/network tools are denied|runner egress is restricted|external, independently reviewed, credential-separated promotion|reconstruct and verify the exact tree before any repository write).{0,90}' \
|| true
done
echo '== Test syntax and asserted-phrase audit =='
git show "$head:$test_path" | python3 -c '
import ast
import sys
source = sys.stdin.read()
ast.parse(source)
print("python_syntax=valid")
for phrase in (
"model web/network tools are denied",
"runner egress is restricted",
"NVIDIA NIM endpoint",
"ends at the independently reverified credential-free patch handoff",
"reconstruct and verify the exact tree before any repository write",
):
print(f"{phrase}={source.count(phrase)}")
'
echo '== Exact GitHub Actions run metadata =='
gh run view 31146404269 --repo ContextualWisdomLab/EgressWeave \
--json databaseId,headSha,status,conclusion,event,workflowName,createdAt,updatedAt,jobs \
--jq '{databaseId,headSha,status,conclusion,event,workflowName,createdAt,updatedAt,jobs:[.jobs[]|{name,status,conclusion,startedAt,completedAt,steps:[.steps[]|{name,status,conclusion}]}]}'Length of output: 20945 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="3b484b2692be2c078a68a77d810798832d0beacd"
git show "$head:README.md" | nl -ba | tail -n 8Length of output: 473 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="3b484b2692be2c078a68a77d810798832d0beacd"
git show "$head:README.md" | python3 -c '
import sys
lines = sys.stdin.read().splitlines()
start = max(0, len(lines) - 8)
for number, line in enumerate(lines[start:], start + 1):
print(f"{number}: {line}")
'Length of output: 722
The remaining scoped review is consistent with the requested contract.
I did not approve, merge, or change the draft state. You are interacting with an AI system. |
|
@opencode-agent Apply the validated one-byte completion on draft PR #73 only if the branch head is still exactly Modify only Do not modify |
|
@opencode-agent Apply only the bounded GREEN repair to exact current head The immutable test-first RED commit is
Run |
|
@opencode-agent Fix the existing test-only RED on PR #73 only from exact current head |
1 participant
Test-first buyer trust-boundary repair
Progresses #72 and #81 as a documentation/test stack behind replacement PR #84. Closed #66 and all predecessor-head checks/reviews remain historical context only; no review, approval, status, or check transfers across PR objects or changed heads.
Exact live stack state
c038a9509d1a8eae8561cc9081e67e12bd373d42.fbc0e2f1934f44f616c73ef9217c81480fd1926e.1385280f74b05b38cb955276636c495563b0e605.c038a9509d1a8eae8561cc9081e67e12bd373d42; docs: align buyer README with read-only handoff #73 is six security: remove autonomous repository-write publisher #84 commits behind and therefore remains Draft.Preserved test-first history
The branch retains the earlier README, architecture, and accepted-ADR RED→GREEN history that removes the stale repository-local publisher description and states that repository-local product development ends at the independently reverified credential-free patch handoff.
Latest bounded RED→GREEN pair:
2afb7eb749b963ed5e0c58d8804cdeefe28385e2strengthens the buyer README contract to require the sentence-startingModel web/network tools are denied, a conventional final LF, and the hourly-workflowprintfliteral-\nincident regression.1385280f74b05b38cb955276636c495563b0e605changes onlyREADME.md: it capitalizes that sentence-startingModeland restores exactly one final LF. The commit diff contains no other path or wording change.The incident regression itself depends on the later #84 workflow commits and must not be treated as exact-head green on this divergent branch. No current-head workflow run exists for
1385280f74b05b38cb955276636c495563b0e605; draft-skipped or predecessor-head evidence is not acceptance.Bounded product/documentation contract
This slice:
[Unreleased]without a version bump;Remaining gates
Keep this PR Draft. First integrate #84 through its own exact-head central security/review/approval gates. Then reconstruct or otherwise audibly reconcile this documentation slice against the accepted protected head without force-push/rebase shortcuts, rerun exact integrated-tree CI and the repaired organization Security Scan, complete current-head automated review, obtain a qualifying independent non-author
APPROVEDreview, resolve only valid addressed threads, and satisfy branch protection and repository rules before integration.Do not merge, enable auto-merge, release, publish, force-update, or count queued, skipped, stale, predecessor-head, synthetic-merge, fail-open, or absent evidence as success.