8000 Fix protected runner context check by Mnehmos · Pull Request #32 · Mnehmos/MathOS · GitHub
[go: up one dir, main page]
Skip to content

Fix protected runner context check - #32

Merged
Mnehmos merged 1 commit into
mainfrom
fix/protected-runner-context
Jul 20, 2026
Merged

Fix protected runner context check#32
Mnehmos merged 1 commit into
mainfrom
fix/protected-runner-context

Conversation

@Mnehmos
@Mnehmos Mnehmos commented Jul 20, 2026
Copy link
Copy Markdown
Owner

Outcome

Repairs the first protected-main publication candidate failure after PR #31.

The producer defined its report vocabulary as:

readonly RUNNER_ENVIRONMENT="github_hosted"

That assignment shadowed GitHub's immutable default:

RUNNER_ENVIRONMENT="github-hosted"

The protected-only comparison therefore rejected every real GitHub-hosted run even though the separate workflow gate had already established GITHUB_REF_PROTECTED=true.

This patch renames only the report-vocabulary constant to REPORT_RUNNER_ENVIRONMENT, preserving GitHub's immutable RUNNER_ENVIRONMENT for the protected-context check.

Exact failure evidence

  • Merged source: 55a0ae0fad9fe5cfd20ed0a5fbddf6b80a5303c1
  • Source tree: 7508582f4ac01b6cd4533c135d7da5f238ad2149
  • Publication run: 29716292659
  • Boundary job: 88270125287
  • Failure: exit 65, protected context disagreement
  • Failed artifact: 8450708477
  • Archive digest: sha256:29c70446a4ba089b44621b254bd6ff54ca3a109a836ff8c60a4525e8e7059c27
  • Smoke execution, smoke attestation, and constrained smoke challenge all passed before the candidate gate failed
  • Unconditional artifact retention passed

Validation

  • bash -n scripts/publication-candidate.sh
  • Mocked matching protected context reaches the next control check (exit 69 for locally unavailable WSL jq), proving it passes the protected-context gate
  • The same mock with RUNNER_ENVIRONMENT=self-hosted fails closed at the protected-context gate with exit 65
  • git diff --check

Head: c0e3cd9230892e5863f3a291d7f750ba67a2ca3c
Tree: 5dc109a29888c7ac34e67cdd6fb84454947133e5

Non-goals

No authority is created. The repair changes neither candidate contents nor validation semantics; reports and attestation-verification records remain authoritative:false.

Advances #21.

@coderabbitai
coderabbitai Bot commented Jul 20, 2026 •
edited
Loading
Copy link
Copy Markdown

Warning

Review limit reached

@Mnehmos, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1dfdb11a-ae8f-4532-883b-49d353b593d4

📥 Commits

Reviewing files that changed from the base of the PR and between 55a0ae0 and c0e3cd9.

📒 Files selected for processing (1)
  • scripts/publication-candidate.sh
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/protected-runner-context

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This was referenced Jul 20, 2026
Merged
Closed
@Mnehmos
Mnehmos marked this pull request as ready for review July 20, 2026 04:17
@Mnehmos
8000
Mnehmos commented Jul 20, 2026
Copy link
Copy Markdown
Owner Author

Exact repair-head validation is green:

  • CI run: https://github.com/Mnehmos/MathOS/actions/runs/29716502965
  • Head: c0e3cd9230892e5863f3a291d7f750ba67a2ca3c
  • Tree: 5dc109a29888c7ac34e67cdd6fb84454947133e5
  • All five required jobs passed
  • Pinned-Lean simulated candidate passed
  • CodeRabbit completed with no review or inline findings
  • Matching mocked protected context crosses the gate; a self-hosted context still fails closed

The failed protected run remains retained as artifact 8450708477. Merge will use the exact head guard, followed by a fresh protected-main publication run.

@Mnehmos
Mnehmos merged commit fc91164 into main Jul 20, 2026
6 checks passed
@Mnehmos
Mnehmos deleted the fix/protected-runner-context branch July 20, 2026 04:21
@Mnehmos
Mnehmos commented Jul 20, 2026
Copy link
Copy Markdown
Owner Author

Protected candidate production is now complete and independently inspected.

Exact merged source:

Downloaded candidate audit:

  • canonical request: 9f32d3eca940100b92f6ceb91e975fb859f99c1cf97fb98ae859e6cd79419103
  • 25-role retained closure: ff67bc6f101681ff5c8345c763036ca1c07caed4eec714ba8c35f5017a5c28e3
  • publication report: 12f0aaca0f6e9a16c242205da24f53fadc08ba9177cff6e039ec394c50ee1012
  • retained validator result: 1d5adfc932ffa566f859c45caba62d97443e80ee1a3eb4532f792e5ca69362c0
  • attempt summary: 503c86845b6e0a78fa3712b9cf999f78203c15df2550356e3965a12944740ea5
  • candidate Sigstore bundle: a23d190fdaffe7e87fc98747b32525f96f199aa05f5431cba39548b38207a84e
  • raw pinned-gh verification: 1e6063a8ca1ef58476992d8691f702cc39d547ce94d82ebf90a848eef75d549a
  • constrained verification record: 93871363affcfcc6a36d954577779de5791752d2951340c90f77df095c81ce3a
  • verified Rekor timestamp: 2026-07-20T04:22:41Z

Inspection confirmed exactly 25 sorted fixed-path closure members and all member hashes; source commit/tree/run/attempt agreement; clean checkout; GitHub-hosted protected main; enforced network, memory, time, and output controls; empty environment/formalization imports; protected dependency output containing only /opt/lib/lean/Init.olean; one exact no-axioms result in both local and protected audits; seven intact retained CAS objects; three passed protected execution records; report-subject digest agreement; SLSA v1 predicate; exact workflow certificate identity; exact source commit/ref; GitHub-hosted runner; and one verified timestamp.

The report, attempt, validator result, and constrained attestation record all remain authoritative:false. This completes candidate production and retained evidence only. Controlled ingestion, authoritative proof/refutation evidence, and mathematical-status derivation remain unavailable.

This was referenced Jul 20, 2026
Merged
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Mnehmos
0