feat(sandbox): build and verify patch-validator image - #67
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='48ef9cd4051d6bf0a76d32a0c6acdcaac8adbfaa'
repo='ContextualWisdomLab/noema'
echo '== exact commit identity =='
printf 'checkout='; git rev-parse HEAD
printf 'requested='; git rev-parse "$requested"
git cat-file -e "${requested}^{commit}"
git status --short
git merge-base --is-ancestor "$requested" HEAD && echo 'requested_is_ancestor_of_checkout=yes' || true
echo '== PR state and checks =='
gh pr view 67 --repo "$repo" \
--json number,isDraft,headRefOid,baseRefOid,reviewDecision,reviews,statusCheckRollup,url
echo '== diff from PR base to requested commit =='
base=$(gh pr view 67 --repo "$repo" --json baseRefOid --jq .baseRefOid)
printf 'base=%s\n' "$base"
git diff --name-status "$base" "$requested"
echo '== candidate files =='
fd -HI -t f . | rg -i \
'(patch-validator|patch_image_validation|Dockerfile|workflow|vitest|coverage|changelog|doctoring|static-runtime|receipt|image.*verify|pyproject|package\.json)$' \
| sort
echo '== source outlines =='
for f in \
Dockerfile.patch-validator \
.github/workflows/patch-validator-image.yml \
scripts/verify-patch-validator-image.mjs \
scripts/lib/patch-validator-static-runtime-evidence.mjs \
scripts/lib/patch-validator-image-receipts.mjs \
reviewer/noema_reviewer/patch_image_validation.py \
package.json \
vitest.config.ts \
pyproject.toml \
CHANGELOG.md \
docs/patch-validator-image.md \
docs/doctoring/patch-validator-image.md; do
if [ -f "$f" ]; then
echo "---- $f ----"
case "$f" in
*.mjs|*.ts) ast-grep outline "$f" --items all --view compact || true ;;
*.py) ast-grep outline "$f" --lang python --items all --view compact || true ;;
*) wc -l "$f" ;;
esac
fi
done
echo '== focused security and quality references =='
rg -n -i -C 3 \
'(pkg:generic|process\.versions|purl|cpe|catalog|unmapped|unsupported|unresolved|assessment|match-artifact|grype|syft|trivy|vex|ignore|severity|unknown|medium|high|critical|ngtcp2|database|provider|image.?id|source.?target|network=none|read-only|readonly|cap-drop|no-new-privileges|seccomp|tmpfs|non-root|scratch|readelf|dynamic|needed|addon|stale|head|coverage|docstring)' \
Dockerfile.patch-validator .github/workflows/patch-validator-image.yml \
scripts reviewer package.json vitest.config.ts pyproject.toml CHANGELOG.md docs \
2>/dev/null || trueLength of output: 202685 🏁 Script executed: #!/bin/bash
set -euo pipefail
show() {
file="$1"; start="$2"; end="$3"
echo "---- ${file}:${start}-${end} ----"
nl -ba "$file" | sed -n "${start},${end}p"
}
echo '== exact current PR and check state =='
gh pr view 67 --repo ContextualWisdomLab/noema \
--json headRefOid,isDraft,reviewDecision,statusCheckRollup,reviews \
| jq '{
headRefOid,
isDraft,
reviewDecision,
checks: [.statusCheckRollup[] | {
name: (.name // .context // "unknown"),
status,
conclusion,
detailsUrl
}],
reviews: [.reviews[] | {
author: .author.login,
state,
commit: .commit.oid
}]
}'
echo '== Dockerfile and workflow: authority, identity, scanners, receipts, stale-head =='
show Dockerfile.patch-validator 1 220
show .github/workflows/patch-validator-image.yml 1 220
show .github/workflows/patch-validator-image.yml 220 420
show .github/workflows/patch-validator-image.yml 420 700
echo '== embedded runtime verifier and receipt verifier =='
show scripts/lib/patch-validator-static-runtime-evidence.mjs 1 620
show scripts/lib/patch-validator-image-receipts.mjs 1 680
show scripts/verify-patch-validator-image.mjs 1 420
echo '== targeted regression tests =='
for f in \
test/patch-validator-static-runtime-evidence.test.ts \
test/patch-validator-static-runtime-metadata.test.ts \
test/patch-validator-static-binary-vulnerability-scan.test.ts \
test/patch-validator-receipt-verifier.test.ts \
test/patch-validator-workflow.test.ts \
test/patch-validator-image-contract.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/production-coverage-policy.test.ts \
reviewer/tests/test_patch_validation_image_control_paths.py \
reviewer/tests/test_patch_validation_image_profile.py \
reviewer/tests/test_patch_validation_image_result_isolation.py; do
if [ -f "$f" ]; then
echo "---- $f ----"
rg -n -i -C 5 \
'(assessment|completed|pkg:generic|process\.versions|purl|cpe|identity|artifact|database|provider|ngtcp2|unknown|ignore|vex|severity|stale|head|network|read-only|coverage|docstring)' \
"$f" || true
fi
done
echo '== quality-gate configuration =='
for f in package.json vitest.config.ts pyproject.toml; do
if [ -f "$f" ]; then show "$f" 1 300; fi
doneLength of output: 4328 🏁 Script executed: #!/bin/bash
set -euo pipefail
show() {
file="$1"; start="$2"; end="$3"
echo "---- ${file}:${start}-${end} ----"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '== Dockerfile and workflow =='
show Dockerfile.patch-validator 1 220
show .github/workflows/patch-validator-image.yml 1 220
show .github/workflows/patch-validator-image.yml 220 420
show .github/workflows/patch-validator-image.yml 420 700
echo '== verifier implementations =='
show scripts/lib/patch-validator-static-runtime-evidence.mjs 1 620
show scripts/lib/patch-validator-image-receipts.mjs 1 680
show scripts/verify-patch-validator-image.mjs 1 420
echo '== targeted test assertions =='
for f in \
test/patch-validator-static-runtime-evidence.test.ts \
test/patch-validator-static-runtime-metadata.test.ts \
test/patch-validator-static-binary-vulnerability-scan.test.ts \
test/patch-validator-receipt-verifier.test.ts \
test/patch-validator-workflow.test.ts \
test/patch-validator-image-contract.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/production-coverage-policy.test.ts \
reviewer/tests/test_patch_validation_image_control_paths.py \
reviewer/tests/test_patch_validation_image_profile.py \
reviewer/tests/test_patch_validation_image_result_isolation.py; do
if [ -f "$f" ]; then
echo "---- $f ----"
rg -n -i -C 4 \
'(assessment|completed|pkg:generic|process\.versions|purl|cpe|identity|artifact|database|provider|ngtcp2|unknown|ignore|vex|severity|stale|head|network|read-only|coverage|docstring)' \
"$f" || true
fi
done
echo '== quality-gate configuration =='
for f in package.json vitest.config.ts pyproject.toml; do
if [ -f "$f" ]; then show "$f" 1 300; fi
doneLength of output: 123308 🏁 Script executed: #!/bin/bash
set -euo pipefail
show() {
file="$1"; start="$2"; end="$3"
echo "---- ${file}:${start}-${end} ----"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '== all generic identity and package-note references =='
rg -n -i -C 4 'pkg:generic|note\.package|node-package-note|application/vnd\.syft' \
Dockerfile.patch-validator .github/workflows scripts test docs CHANGELOG.md \
2>/dev/null || true
echo '== exact documentation and changelog claims =='
show CHANGELOG.md 1 40
show docs/patch-validator-image.md 1 180
show docs/doctoring/patch-validator-image.md 1 180
if [ -f docs/doctoring/patch-validator-embedded-scan-assessment.md ]; then
show docs/doctoring/patch-validator-embedded-scan-assessment.md 1 220
fi
echo '== static binary verification remainder and workflow regression checks =='
show scripts/lib/patch-validator-static-runtime-evidence.mjs 620 820
show test/patch-validator-workflow.test.ts 100 240
show test/patch-validator-image-documentation-current.test.ts 1 140
echo '== reviewer Python coverage and public-docstring contract =='
fd -HI -t f 'pyproject.toml' . -x sh -c \
'echo "---- $1 ----"; awk "{printf \"%6d %s\\n\", NR, \$0}" "$1"' sh {}
rg -n -i -C 3 '(interrogate|docstring|branch|coverage|pytest-cov|fail-under)' \
.github/workflows reviewer package.json pyproject.toml setup.cfg tox.ini \
2>/dev/null || trueLength of output: 117311
I found two current-head issues.
I confirmed the current implementation closes the earlier empty-match finding. It now retains one raw Grype result for each reviewed identity. The verifier checks the pinned scanner descriptor, exact PURL/CPE source target, exact component set, raw match-artifact identity, shared canonical database/provider snapshot, no ignored matches, blocking and unknown severities, and the I also confirmed the current source contains stale-head checks before and after verification, trusted-host smoke receipt synthesis after zero exit, hardened non-root/no-network/read-only smoke settings, and configured 100% JavaScript and reviewer Python coverage/docstring gates. PR
|
|
@coderabbitai review Please perform a substantive read-only review of exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='4ccb5fc7f94844f1cb74a420d0ee3a9baabc0e92'
repo='ContextualWisdomLab/noema'
echo '== Exact commit identity =='
printf 'checkout='; git rev-parse HEAD
printf 'requested='; git rev-parse "$requested"
git cat-file -e "${requested}^{commit}"
git status --short
echo '== PR state and check state =='
gh pr view 67 --repo "$repo" \
--json number,isDraft,headRefOid,baseRefOid,reviewDecision,reviews,statusCheckRollup,url \
| jq '{
number, isDraft, headRefOid, baseRefOid, reviewDecision, url,
checks: [.statusCheckRollup[] | {
name: (.name // .context // "unknown"), status, conclusion, detailsUrl
}],
reviews: [.reviews[] | {
author: .author.login, state, commit: .commit.oid
}]
}'
echo '== Changed files from PR base =='
base=$(gh pr view 67 --repo "$repo" --json baseRefOid --jq .baseRefOid)
printf 'base=%s\n' "$base"
git diff --name-status "$base" "$requested"
echo '== Relevant source map =='
for f in \
Dockerfile.patch-validator \
.github/workflows/patch-validator-image.yml \
scripts/verify-patch-validator-image.mjs \
scripts/lib/patch-validator-static-runtime-evidence.mjs \
scripts/lib/patch-validator-image-receipts.mjs \
reviewer/noema_reviewer/patch_image_validation.py \
package.json vitest.config.ts pyproject.toml \
CHANGELOG.md docs/patch-validator-image.md \
docs/doctoring/patch-validator-image.md \
test/patch-validator-static-runtime-evidence.test.ts \
test/patch-validator-static-runtime-metadata.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/patch-validator-workflow.test.ts \
test/production-coverage-policy.test.ts; do
if [ -f "$f" ]; then
echo "---- $f ----"
case "$f" in
*.mjs|*.ts) ast-grep outline "$f" --items all --view compact || true ;;
*.py) ast-grep outline "$f" --lang python --items all --view compact || true ;;
*) wc -l "$f" ;;
esac
fi
done
show() {
file="$1"; start="$2"; end="$3"
if [ -f "$file" ]; then
echo "---- ${file}:${start}-${end} ----"
nl -ba "$file" | sed -n "${start},${end}p"
fi
}
echo '== Implementation and documentation excerpts =='
show Dockerfile.patch-validator 1 240
show .github/workflows/patch-validator-image.yml 1 760
show scripts/lib/patch-validator-static-runtime-evidence.mjs 1 760
show scripts/lib/patch-validator-image-receipts.mjs 1 760
show scripts/verify-patch-validator-image.mjs 1 460
show reviewer/noema_reviewer/patch_image_validation.py 1 520
show CHANGELOG.md 1 100
show docs/patch-validator-image.md 1 240
show docs/doctoring/patch-validator-image.md 1 220
show package.json 1 260
show vitest.config.ts 1 220
show pyproject.toml 1 320
echo '== Focused implementation, documentation, and regression references =='
rg -n -i -C 4 \
'(pkg:generic|note\.package|process\.versions|purl|cpe|catalog|unmapped|unsupported|unresolved|assessment|completed|positive.assessment|match-artifact|grype|syft|cyclonedx|trivy|database|provider|vex|ignore|severity|unknown|medium|high|critical|ngtcp2|image.?id|source.?target|network=none|read-only|readonly|cap-drop|no-new-privileges|seccomp|tmpfs|non-root|scratch|readelf|dynamic|needed|addon|stale|head|coverage|docstring)' \
Dockerfile.patch-validator .github/workflows/patch-validator-image.yml \
scripts reviewer package.json vitest.config.ts pyproject.toml \
CHANGELOG.md docs test 2>/dev/null || true
echo '== Current-head changes that address the prior findings =='
git diff --no-ext-diff --unified=5 \
48ef9cd4051d6bf0a76d32a0c6acdcaac8adbfaa "$requested" -- \
Dockerfile.patch-validator \
.github/workflows/patch-validator-image.yml \
scripts/lib/patch-validator-static-runtime-evidence.mjs \
CHANGELOG.md docs/patch-validator-image.md \
docs/doctoring/patch-validator-image.md \
test/patch-validator-static-runtime-evidence.test.ts \
test/patch-validator-static-runtime-metadata.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/patch-validator-workflow.test.tsLength of output: 11487 🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='4ccb5fc7f94844f1cb74a420d0ee3a9baabc0e92'
repo='ContextualWisdomLab/noema'
show() {
file="$1"; start="$2"; end="$3"
if [ -f "$file" ]; then
echo "---- ${file}:${start}-${end} ----"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
fi
}
echo '== Failed verify check =='
gh run view 31223761973 --repo "$repo" --json \
databaseId,headSha,status,conclusion,event,workflowName,url,jobs \
| jq '{
databaseId, headSha, status, conclusion, event, workflowName, url,
jobs: [.jobs[] | {name, status, conclusion, startedAt, completedAt, url}]
}'
gh run view 31223761973 --repo "$repo" --log-failed 2>&1 || true
echo '== Dockerfile and workflow =='
show Dockerfile.patch-validator 1 130
show .github/workflows/patch-validator-image.yml 1 603
echo '== Evidence and receipt verification =='
show scripts/lib/patch-validator-static-runtime-evidence.mjs 1 760
show scripts/lib/patch-validator-image-receipts.mjs 1 760
show scripts/verify-patch-validator-image.mjs 1 460
show reviewer/noema_reviewer/patch_image_validation.py 1 520
echo '== Public records =='
show CHANGELOG.md 1 80
show docs/patch-validator-image.md 1 210
show docs/doctoring/patch-validator-image.md 1 360
show docs/doctoring/patch-validator-embedded-scan-assessment.md 1 260
echo '== Quality configuration =='
show package.json 1 120
show vitest.config.ts 1 180
show pyproject.toml 1 300
echo '== Exact regression tests for prior findings and requested controls =='
for f in \
test/patch-validator-package-note-identity.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/patch-validator-embedded-runtime-assessment.test.ts \
test/patch-validator-embedded-runtime-workflow.test.ts \
test/patch-validator-static-runtime-evidence.test.ts \
test/patch-validator-static-runtime-identity-binding.test.ts \
test/patch-validator-static-runtime-metadata.test.ts \
test/patch-validator-static-binary-vulnerability-scan.test.ts \
test/patch-validator-receipt-verifier.test.ts \
test/patch-validator-workflow.test.ts \
test/production-coverage-policy.test.ts \
reviewer/tests/test_patch_validation_image_control_paths.py; do
show "$f" 1 1000
done
echo '== Targeted references with context =='
rg -n -i -C 3 \
'(pkg:generic|note\.package|status.?=.?.completed|positive.assessment|cyclonedx|embedded-runtime-sbom|process\.versions|purl|cpe|unsupported|unmapped|unresolved|match-artifact|database|provider|ignored|ignore|vex|severity|unknown|medium|high|critical|ngtcp2|image.?id|source.?target|network=none|read-only|no-new-privileges|cap-drop|seccomp|tmpfs|user [0-9]|stale|head|coverage|docstring)' \
Dockerfile.patch-validator .github/workflows/patch-validator-image.yml \
scripts reviewer CHANGELOG.md docs test package.json vitest.config.ts pyproject.toml \
2>/dev/null || true
echo '== Delta from the prior reviewed commit =='
git diff --no-ext-diff --unified=5 \
48ef9cd4051d6bf0a76d32a0c6acdcaac8adbfaa "$requested" -- \
Dockerfile.patch-validator \
.github/workflows/patch-validator-image.yml \
scripts/lib/patch-validator-static-runtime-evidence.mjs \
CHANGELOG.md docs/patch-validator-image.md \
docs/doctoring/patch-validator-image.md \
docs/doctoring/patch-validator-embedded-scan-assessment.md \
test/patch-validator-package-note-identity.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/patch-validator-embedded-runtime-assessment.test.ts \
test/patch-validator-embedded-runtime-workflow.test.tsLength of output: 200029 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/noema'
section() {
file="$1"; start="$2"; end="$3"
echo "---- ${file}:${start}-${end} ----"
awk -v start="$start" -v end="$end" \
'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '== Failed verify job metadata and failed-step log =='
gh run view 31223761973 --repo "$repo" --json jobs \
| jq '.jobs[] | {name, conclusion, steps: [.steps[] | select(.conclusion == "failure") | {name, number, conclusion}]}'
gh run view 31223761973 --repo "$repo" --log-failed 2>&1 \
| tail -n 1200 || true
echo '== Docker package note and final-image contract =='
section Dockerfile.patch-validator 1 105
section test/patch-validator-package-note-identity.test.ts 1 120
section test/patch-validator-image-contract.test.ts 1 360
echo '== Workflow: authority, image binding, static and embedded evidence =='
section .github/workflows/patch-validator-image.yml 1 190
section .github/workflows/patch-validator-image.yml 190 360
section .github/workflows/patch-validator-image.yml 360 603
echo '== Verifier: catalog, raw per-component Grype data, and policy =='
section scripts/lib/patch-validator-static-runtime-evidence.mjs 1 250
section scripts/lib/patch-validator-static-runtime-evidence.mjs 250 560
section scripts/lib/patch-validator-static-runtime-evidence.mjs 560 760
section scripts/lib/patch-validator-image-receipts.mjs 1 300
section scripts/verify-patch-validator-image.mjs 1 420
echo '== Smoke runner and receipt host boundary =='
section reviewer/noema_reviewer/patch_image_validation.py 1 520
echo '== Precise regression tests and quality gates =='
section test/patch-validator-embedded-runtime-assessment.test.ts 1 520
section test/patch-validator-embedded-runtime-workflow.test.ts 1 260
section test/patch-validator-static-runtime-identity-binding.test.ts 1 440
section test/patch-validator-static-runtime-evidence.test.ts 1 520
section test/patch-validator-image-documentation-current.test.ts 1 130
section test/production-coverage-policy.test.ts 1 220
section package.json 1 80
section vitest.config.ts 1 160
section pyproject.toml 1 260
echo '== Scoped forbidden and required terms =='
rg -n -i -C 2 \
'(pkg:generic|assessment\.status|status.?=.?.completed|positive.assessment|embedded-runtime-sbom|vex|ignoredmatches|ignored.matches|grype.*db update|GRYPE_DB_AUTO_UPDATE|network=none|--read-only|no-new-privileges|cap-drop|seccomp|tmpfs|65532|live.head|head.sha|coverage|interrogate)' \
Dockerfile.patch-validator \
.github/workflows/patch-validator-image.yml \
scripts/lib/patch-validator-static-runtime-evidence.mjs \
scripts/lib/patch-validator-image-receipts.mjs \
scripts/verify-patch-validator-image.mjs \
reviewer/noema_reviewer/patch_image_validation.py \
CHANGELOG.md docs/patch-validator-image.md \
docs/doctoring/patch-validator-image.md \
docs/doctoring/patch-validator-embedded-scan-assessment.md \
test/patch-validator-package-note-identity.test.ts \
test/patch-validator-image-documentation-current.test.ts \
test/patch-validator-embedded-runtime-assessment.test.ts \
test/patch-validator-embedded-runtime-workflow.test.ts \
package.json vitest.config.ts pyproject.toml \
2>/dev/null || trueLength of output: 194565 🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='4ccb5fc7f94844f1cb74a420d0ee3a9baabc0e92'
base='5c2e6762d07598094e5301c491d15ba83dcdcd51'
repo='ContextualWisdomLab/noema'
echo '== Current check state =='
gh pr view 67 --repo "$repo" --json headRefOid,isDraft,reviewDecision,statusCheckRollup \
| jq '{
headRefOid, isDraft, reviewDecision,
checks: [.statusCheckRollup[] | {name: (.name // .context // "unknown"), status, conclusion, detailsUrl}]
}'
echo '== Dependency-resolution delta for the failed audit =='
git diff --no-ext-diff --unified=4 "$base" "$requested" -- package.json package-lock.json
echo '-- current nanoid records --'
rg -n -C 3 '"node_modules/nanoid"|"nanoid"' package-lock.json
echo '-- base nanoid records --'
git show "${base}:package-lock.json" | rg -n -C 3 '"node_modules/nanoid"|"nanoid"' || true
echo '== Reviewer quality configuration =='
fd -HI -t f 'pyproject.toml' reviewer . \
| sort \
| while IFS= read -r f; do
echo "---- $f ----"
awk 'NR <= 320 { printf "%6d %s\n", NR, $0 }' "$f"
done
rg -n -i -C 3 \
'(pytest|pytest-cov|cov-fail-under|branch|interrogate|fail-under|docstring)' \
reviewer .github/workflows package.json 2>/dev/null || true
echo '== Exact tests that cover stale-head and host-only receipt synthesis =='
rg -n -i -C 4 \
'(stale|exact.head|head.sha|trusted.host|host.produced|container.output|result.isolation|network=none|read-only|non-root)' \
reviewer/tests/test_patch_validation_image_control_paths.py \
reviewer/tests/test_patch_validation_image_result_isolation.py \
reviewer/tests/test_patch_validation_image_runner_edges.py \
reviewer/tests/test_patch_validation_image_profile.py \
test/patch-validator-workflow.test.ts \
2>/dev/null || trueLength of output: 202278 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='5c2e6762d07598094e5301c491d15ba83dcdcd51'
echo '== nanoid resolution at base and current head =='
python3 - <<'PY'
import json
import subprocess
def lockfile_at(revision):
if revision is None:
with open("package-lock.json", encoding="utf-8") as f:
return json.load(f)
return json.loads(subprocess.check_output(
["git", "show", f"{revision}:package-lock.json"], text=True
))
for label, revision in (("base", "5c2e6762d07598094e5301c491d15ba83dcdcd51"), ("head", None)):
lock = lockfile_at(revision)
packages = lock.get("packages", {})
direct = packages.get("node_modules/nanoid")
dependents = []
for path, entry in packages.items():
dependencies = entry.get("dependencies", {}) if isinstance(entry, dict) else {}
if "nanoid" in dependencies:
dependents.append({"path": path, "range": dependencies["nanoid"]})
print(json.dumps({
"revision": label,
"lockfileVersion": lock.get("lockfileVersion"),
"nanoid": direct,
"directDependents": dependents,
}, sort_keys=True, indent=2))
PY
echo '== Changed package and lockfile entries only =='
git diff --numstat "$base" HEAD -- package.json package-lock.json
git diff --no-ext-diff --name-status "$base" HEAD -- package.json package-lock.json
echo '== Reviewer Python quality configuration =='
fd -HI -t f 'pyproject.toml' reviewer . | sort
for f in $(fd -HI -t f 'pyproject.toml' reviewer . | sort); do
echo "---- $f ----"
awk 'NR <= 240 { printf "%6d %s\n", NR, $0 }' "$f"
done
echo '== Reviewer quality-gate workflow commands =='
rg -n -C 3 \
'(python -m pytest|pytest-cov|interrogate|--fail-under|--fail-under=|--fail-under )' \
.github/workflows reviewer/pyproject.toml 2>/dev/null || true
echo '== Current PR checks =='
gh pr view 67 --repo ContextualWisdomLab/noema --json statusCheckRollup \
| jq '[.statusCheckRollup[] | {name: (.name // .context // "unknown"), status, conclusion}]'Length of output: 7869
I found no new actionable code-level findings in the requested scope. The two prior findings are fixed on this head:
I confirmed these current controls:
The current The
|
1 participant
Summary
Adds a repository-owned, credential-free patch-validator image and strict image-owned
node_patch_verifyprofile as a stacked follow-on to PR #65. The runtime is a checksum-authenticated, fully static Node.js 24.19.0 executable in a non-rootscratchimage. Embedded native-dependency evidence is modeled as raw, exact-identity scanner evidence rather than unsupported generic identities or locally synthesized completion claims.Current stack identity
Freshly revalidated immediately before this metadata update:
feat/quarantined-patch-validation/ PR feat(sandbox): add quarantined patch validation #65.5c2e6762d07598094e5301c491d15ba83dcdcd51.feat/patch-validator-image-supply-chain.c5f36bc56673a3316f4213430ca5412b41bc0ec9.No predecessor check/review/model evidence is promoted to the current exact head.
Implemented boundary
node_patch_verify/node_patch_verify_v1profile with no caller-provided command;/opt/noema;.githubsurfaces stay outside the untrusted patch language;scratchimage;process.versionsinventory and strict component-identity/database-snapshot binding;Test-first runtime correction
A predecessor run reached the real container smoke boundary and failed because the fully static Node runtime had been compiled with
--with-intl=none; the pinned Vite/Vitest path requires ECMAScript Unicode-property regular expressions such as\p{ID_Continue}. The smallest reviewed correction retained the scratch/static isolation target while switching tosmall-icuand adding an explicit Unicode-regex runtime capability probe both before and after binary strip/package-note verification.The old failure is predecessor evidence only. The current exact head must prove the corrected real image path independently.
Test-first acquisition/licensing correction
A fresh acquisition audit found a separate source defect after the runtime correction:
Dockerfile.patch-validatoremittedorg.opencontainers.image.licenses="LicenseRef-Proprietary"even though Noema currently has no approved rootLICENSE/custom-rights decision andpackage.jsonisprivatewith nolicensefield. That image metadata silently selected a legal posture that repository automation has no authority to choose.878ae7622a88216a5f4b7a5f362ecdbf032c8cf9— RED contract proves the current package has no license declaration and rejects an OCIlicenseslabel in that undecided state.57ff5b2347a620ce926f7b2a464fd49c5793a2fd— removes the invented OCI license label while preserving exact source/revision/title/description/documentation metadata.c5f36bc56673a3316f4213430ca5412b41bc0ec9— updates the image contract documentation so public visibility,private: true, or an inventedLicenseRef-*value is never treated as outbound-rights authority.This PR does not choose MIT, Apache-2.0, proprietary, source-available, or another outbound license. Issue #5 and the canonical licensing/IP contract own the authorized rights decision and transfer evidence.
Current exact-head verification
For exact current head
c5f36bc56673a3316f4213430ca5412b41bc0ec9at this metadata update:reviewer-cirun31348568551: terminal success.cirun31348568564: terminal failure at the inherited repository-wide nanoid advisory gate; fix(security): update transitive nanoid for CVE-2026-67213 #76 owns the root dependency remediation. No audit waiver or duplicate lockfile patch is introduced here.patch-validator-imagerun31348568589/ job93335056366: in progress, non-passing evidence. Exact-head checkout and stale-head refusal, scanner installation, and the current image build have started; static-runtime identity, real no-network smoke, SBOM/vulnerability evidence, receipt verification and final stale-head refusal are not accepted until fresh terminal evidence proves them.Queued/in-progress/pending/skipped/cancelled/status-only/stale/predecessor/synthetic evidence is never promoted to success, approval, release acceptance or merge authority.
Security and authority constraints
COPILOT_GITHUB_TOKEN;.github/workflows/repair-*, self-modifying Action, branch-patchingcontents:write, protection bypass or repeat-until-green behavior;Merge boundary
Do not merge until #65 and #76 integrate in dependency order, this unique image work is refreshed onto the correct protected lineage, the then-current exact head passes application/reviewer/eligible Security Scan/image build+real smoke+SBOM/vulnerability/provenance requirements, current findings are clean, and actual live governance/qualifying review requirements are satisfied. Registry publication/signature/attestation/digest-lock activation remains separately owned by #66. No version bump or release is claimed.
Related: #5, #9, #27, #29, #65, #66, #75, #76