feat: validate redacted runtime evidence aggregate - #144
Conversation
Co-Authored-By: Codex <noreply@openai.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7421691599
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "provider_rows", | ||
| "secret", | ||
| "token", |
There was a problem hiding this comment.
tg_token credential field
When an aggregate contains this repository's Telegram credential key tg_token (used by ExecutionRuntime and populated from TG_TOKEN), the recursive scanner compares the entire lowercased key against this set, so it does not match token and validation returns ok: true. This defeats the redacted-evidence guarantee and can allow a live notification credential into accepted evidence; explicitly reject the known key or safely recognize credential-bearing key variants.
Useful? React with 👍 / 👎.
| def _is_sha256(value: Any) -> bool: | ||
| return isinstance(value, str) and bool(re.fullmatch(r"[0-9a-f]{64}", value.strip())) | ||
|
|
||
|
|
||
| def _is_git_revision(value: Any) -> bool: | ||
| return isinstance(value, str) and bool(re.fullmatch(r"[0-9a-f]{40}", value.strip())) |
There was a problem hiding this comment.
For artifact and reconciliation hashes—and likewise for source revisions below—calling strip() only for the regex check means values such as " <64 hex characters> " are certified while the untrimmed, noncanonical string remains in the aggregate. Any consumer performing an exact digest or revision comparison on the accepted value will then fail or derive a different identity, so validation should either reject surrounding whitespace or normalize the stored value.
Useful? React with 👍 / 👎.
| def _is_utc_timestamp(value: Any) -> bool: | ||
| if not isinstance(value, str) or not value.endswith("Z"): | ||
| return False | ||
| try: | ||
| datetime.fromisoformat(value.replace("Z", "+00:00")) |
There was a problem hiding this comment.
When input_timestamp is a date-only value such as 2026-03-13Z, this replacement produces 2026-03-13+00:00, which Python 3.11's datetime.fromisoformat accepts as a naive midnight datetime. The aggregate is therefore marked valid despite lacking both a timestamp and UTC timezone information, weakening the release identity's audit precision; require a datetime component and verify that the parsed value is aware with a zero UTC offset.
Useful? React with 👍 / 👎.
1 participant
Static-only P4 evidence contract: fail-closed redacted aggregate with RiskEngine, cap, stop/breaker, and reconciliation validation. No runtime, deployment, provider, broker, or credential changes.