Repository navigation
Phase 6a: add receipt-bound portable release bundles - #51
Conversation
|
Warning Review limit reached
Next review available in: 31 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (17)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fea1e289f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| module_file_name: &str, | ||
| environment: &EnvironmentManifest, | ||
| ) -> Result<LeanProcessResult, AppError> { | ||
| execute_lean_with_profile(command, workspace, module_file_name, environment, true) |
There was a problem hiding this comment.
When release verify processes a publication-profile bundle, passing true here bypasses the existing guard that rejects execution without publication isolation. The downstream process runner only clears selected environment variables and enforces time/output bounds; it does not isolate the network, filesystem, subprocesses, or the manifest's memory limit. Consequently, a release module or imported dependency with an initializer/custom elaborator can run with the verifier user's host access even though the bundled environment declares network_access: false; replay should use the protected isolation runner rather than relaxing this precondition.
Useful? React with 👍 / 👎.
| license_expression: None, | ||
| restriction: ArtifactRestriction::Private, |
There was a problem hiding this comment.
For every --profile public build, these three report members are unconditionally marked private and unlicensed. ReleaseManifest::validate rejects any public release containing such a member, while all three paths are mandatory, so the public profile can never succeed even when every source, learning unit, and registered artifact has public licensed metadata. Preserve or derive eligible policy metadata for these required copies instead of hard-coding them as private.
Useful? React with 👍 / 👎.
Closes #50
Summary
release_manifest/1Rust contract, committed schema, and golden schema identityTrust boundary
Release replay is an integrity check only. It does not mint mathematical authority. Public projection fails closed on every private, restricted, unresolved, or unlicensed member.
Verification
cargo fmt --checkcargo clippy --workspace --all-targets --all-features -- -D warningscargo test --workspace(144 unit, 1 Lean worker, 4 MCP, 14 CLI)PYTHONPATH=src PYTHONWARNINGS=error::ResourceWarning python -m unittest discover -s tests -v(39)bash -n scripts/release-pilot-a.shgit diff --checkThe protected real CLI build/copy/hide-database/Lean replay runs only from protected
main; its retained artifact will be audited against the exact merge head before #50 is closed.