Repository navigation
Prepare Comic Manifest v1 contract release - #16
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
codex/scripts/build-contract-release.mjs
Line 75 in 028d563
Prevent output-parent swaps before creating artifacts
When the destination has multiple nonexistent components under a writable directory, resolveExternalOutput() validates only the currently existing ancestor and then returns a path string; the subsequent Git traversal leaves a substantial window in which another process can create one missing component as a symlink into the checkout. For example, after validating /tmp for /tmp/new-parent/out, replacing new-parent with a checkout symlink causes this mkdir and the later writes to follow it, bypassing the new fail-closed symlink check. Create and retain a verified directory handle or otherwise ensure path components cannot be substituted between validation and artifact writes.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Preparation draft for Studio #99. Base is Codex main
8044643bf888067f5a6e0d212f843d72e8787f2b; exact current head is028d5638e20d9283a2955aacbd38e1bfc6dca259(treecae3cbe3ae5945b53d544ef5be7dd19941e13689). This remains a draft preparation PR.Adds a separate one-contract Comic Manifest v1 catalog, checklist, explicit builder catalog selection, and reproducible builds. Proposed tag:
contract/comic-manifest/v1.0.0; schema ID:urn:definitely-secure:contract:comic-manifest:1.0.0:comic-manifest. The catalog emits only schema, source bundle, and manifest; it does not republish Prompt SDK or Context Builder assets or change the default catalog.A supplied source identity must be full commit/tree IDs; the commit must exist locally as a Git commit object and resolve to the supplied tree and clean local checkout tree. All builder Git calls set
GIT_NO_REPLACE_OBJECTS=1per-process, without changing global configuration; bundle reads use the verified source commit. Isolated replacement-ref regressions prove a valid commit's tree cannot be replaced and a wrong commit cannot be made to appear to match. Missing/fabricated commit, non-commit object, mismatched tree, and symlinked output-parent cases also fail closed.Verification: local
npm testpassed 248/248. Codex CI run 19 passed. Two clean builds from the exact current head/tree matched byte-for-byte:comic-manifest-v1.0.0.schema.json: 30,860 bytes; SHA-2567bd3c5392ae0db0c5baba553c233142d3d4427471f5850123eef7b87d4c8eaa4comic-manifest-v1.0.0.bundle.json: 865,650 bytes; SHA-256661b2c2a0e7c478799551043fa704d936cec238a0e64fea8c4523a0775e67309comic-manifest-v1.0.0.manifest.json: 1,152 bytes; SHA-2568875573aa251776b7133fb5af82e87ce37a6c4a735bffab80a7beed543cf11fcThe current exact-lock npm audit report is retained in the owner packet at
prepared-artifacts/audit-evidence/codex-npm-audit.json(SHA-2564f12cbad0e7ecd65f1b70fa84eeed108609f55f6d549ed8eaa29c377105b98e5); its lock SHA-256 isd655c146d12f82d5583ffe3a3c9740c1716cee4158035e8db5929977e1a48721. The audit reports zero vulnerabilities.The owner-provided A3 AI-review exception applies to code-merge review only. It does not authorize a release decision, tag, asset, or publication; no human review of final release artifacts is claimed. Preparation only: no tag, release, upload, publication, visibility/security change, or Issue #99 closure. Parent review/merge and separate explicit owner approval of exact post-merge artifact tuples are required.