Repository navigation
Verify Comic Manifest contract compatibility (Studio #89) - #30
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e267a856c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| }); | ||
| test('historical build/preparation evidence cannot replace or renew current use authority',()=>{ | ||
| assert.throws(()=>bind(fixture,foundation,foundation.authorization.expires_at)); |
There was a problem hiding this comment.
At foundation.authorization.expires_at, the fixture's package has simultaneously reached its own expires_at and has already crossed review_after, so bind() still throws CONTEXT_PACKAGE_REVIEW_REQUIRED/CONTEXT_PACKAGE_EXPIRED even if the SDK stops enforcing authorization expiration. This makes the advertised expired-grant regression test falsely pass; use a package whose validity extends beyond the authorization or assert that validateContextBinding() specifically emits CONTEXT_AUTHORIZATION_EXPIRED.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Summary
Prove that the proposed Comic Manifest contract binds exact production/result/release identities to the existing released SDK and prepared Context Package. Tests consume verbatim Codex schema/fixture bytes pinned to commit
53e4bd7738ae33c928bf72864d69d413168cc5b4, with source paths, sizes and SHA-256 digests. No Manifest runtime, orchestration or production dependency is introduced.Merge after DefinitelySecureStudio/codex#13. Codex remains the normative owner; copied schema bytes are explicitly test-only and cannot be edited independently. The existing Builder fixture is reused unchanged.
Validation
npm test: 409 passing tests, including eight new consumer-proof tests.node scripts/check-context-builder.mjs: offline conformance/reference flows pass with network guarded.git diff --checkpasses.Constitutional and release impact
Constitution v1.0.0, tag
constitution/v1.0.0, Studio commita9cc8a503aa30e17820edc62ac95f7cbe10e0564; merged Studio ADR 0018 at7b5065cef76bea9580609caba356b0d8fe7cc17c. Owner: @andrewperis, with Codex/Platform review. Universal, repository/production-system and automated-workflow design profiles apply to this bounded offline proof. Runtime/release conformance is not claimed. Production adoption waits for #99; rollback removes this test consumer.Boundaries and dependencies
Closes DefinitelySecureStudio/studio#89 after the coordinated Codex contract PR is merged.