Repository navigation
Prepare Comic Manifest v1 Platform release - #42
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b4d5e732d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (pin?.status !== 'released' || pin?.repository !== 'DefinitelySecureStudio/codex' || | ||
| pin?.version !== '1.0.0' || pin?.tag !== 'contract/comic-manifest/v1.0.0' || pin?.commit !== lock?.commit || | ||
| pin?.schema_id !== lock?.schema_id || pin?.artifact_uri !== schema?.artifact_uri || | ||
| pin?.media_type !== schema?.media_type || pin?.byte_size !== schema?.byte_size || pin?.sha256 !== schema?.sha256) { | ||
| blockers.push('Runtime validator pin has not adopted the exact published contract tuple.'); |
There was a problem hiding this comment.
When the published contract is adopted, updating contract.js and the release lock is sufficient for this condition to pass even if src/comic-manifest/generated/schema-v1.js was never regenerated. comicManifestReleaseReadiness() would then report ready and the non-candidate builder could package validator code carrying the old source provenance—or old validation behavior if the schema changed. Read and validate the generated header/hash against the adopted commit and schema tuple, as the Context Builder release checker does.
Useful? React with 👍 / 👎.
| if (expected.some(filename => !manifest.assets.some(asset => asset.filename === filename))) throw Error('Trusted manifest omits an expected release asset.'); | ||
| return { verified: true, commit: manifest.commit, assets: expected.length + 1 }; |
There was a problem hiding this comment.
When a fresh-download directory contains every expected asset plus an unexpected release asset, this verifier still returns verified: true: the allowlist is applied only to filenames declared inside the trusted manifest, and the directory itself is never enumerated. This defeats the documented complete-set/exact-allowlist check and can approve a release containing unreviewed additional assets; compare the directory entries against the seven assets plus the manifest before succeeding.
Useful? React with 👍 / 👎.
Preparation draft for Studio #99. Base is Platform main after the Studio #98 DNS lookup guard merge
1b5fd00189e6dcc3f3c7f1a76f4229029c9fb8ea(treeccc876bd1e8184d29e53b4aa4bec3d2d630cfd8e). Exact current prep head:8b4d5e732db9345f915833289977aaa3b93175c9(tree683e2dd392c93f1e55502edeb8aeed54c46ba3a3).Proposes component tag
comic-manifest/v1.0.0and additive Platform package version1.2.0, stillprivate: true. The Platform candidate lock still records the pre-merge Codex prep tuple at028d5638e20d9283a2955aacbd38e1bfc6dca259; that tuple is historical and is not the merged Codex approval packet. The lock remainscandidate-unpublished. Readiness stays blocked pending owner-approved Codex publication and independent immutable-download verification, then Platform adoption of that exact published tuple and validator regeneration. Historical SDK and Context Builder locks/assets remain separate.The builder accepts a supplied source identity only when the full commit object exists locally and resolves to the exact declared and checkout tree. All Git calls set
GIT_NO_REPLACE_OBJECTS=1per-process, without changing global configuration; source archives and lock/API snapshots are read from the verified commit. Regressions cover missing/fabricated objects, non-commit objects, mismatched trees, symlinked outputs, and isolated replacement refs in both directions.Verification on this exact head: Platform
npm testpassed 700/700 on an isolated rerun; targeted release tests passed 7/7; offline Comic Manifest conformance passed 325/325, with 29 reviewed fixtures byte-identical. Platform CI run 80 passed on code headaf408d4bbe083de4f6da160c7f6c12dc28c1a468across Node 22 and 24. The current head adds only this verification-record documentation correction. Platform CI run 81 passed on exact current head8b4d5e732db9345f915833289977aaa3b93175c9with Node 22 and 24; each job passednpm testand the offline Comic Manifest conformance step. Two clean candidate builds from exact current head/tree683e2dd392c93f1e55502edeb8aeed54c46ba3a3matched byte-for-byte.Fresh
npm audit --jsonreports from the official registry, captured at 2026-10-07T21:20:20Z, are retained in the owner packet: Platform report SHA-256b966435ec31b7d61483d849d853d936f86183d654661604e532f1be934735a79, lock SHA-256ef90ff0593d91ed26980629ce896ac08294281ed2521db01d7e19ad89b5d87bd; Codex report SHA-2564f12cbad0e7ecd65f1b70fa84eeed108609f55f6d549ed8eaa29c377105b98e5, lock SHA-256d655c146d12f82d5583ffe3a3c9740c1716cee4158035e8db5929977e1a48721. Both reports found zero vulnerabilities. A later reviewer refresh attempt could not resolve registry DNS (ENOTFOUND) and produced no new audit result; the recorded successful report above remains tied to the unchanged Platform lock SHA-256ef90ff0593d91ed26980629ce896ac08294281ed2521db01d7e19ad89b5d87bd. The earlier moderate fast-uri 3.1.7 advisory (GHSA-hrr3-gc8f-f4qj) was fixed by a lock-only update to 3.1.8 within Ajv's existing range;package.jsondid not change, and THIRD_PARTY_NOTICES records BSD-3-Clause for fast-uri.Candidate artifact identities (declared media type is in the manifest; future GitHub transport MIME must be measured separately):
comic-manifest-v1.0.0.source.tar.gz, 485,314 bytes, SHA-2566038e17855cb7e4d7b151da9040e35b0d8f0010d44097d851935ed0384ce423dcomic-manifest-v1.0.0.package.tgz, 225,295 bytes, SHA-2567cb4c088c1f28f2188d838063d1a258544362f6530e0b2b9026bc4a47ffba563comic-manifest-v1.0.0.package-lock.json, 3,149 bytes, SHA-256ef90ff0593d91ed26980629ce896ac08294281ed2521db01d7e19ad89b5d87bdcomic-manifest-v1.0.0.sdk-contract-lock.json, 7,588 bytes, SHA-2566b4b515cc606f2c50b1baead50faaddd3d87d3a1d7b2c9b14e4170e36776dfabcomic-manifest-v1.0.0.context-builder-contract-lock.json, 1,366 bytes, SHA-256297dfa1e7e1e89b63eba0df5d3e012d6243f449bdcddc9e9e34714e786f7e595comic-manifest-v1.0.0.contract-lock.json, 1,793 bytes, SHA-25641995510b4a0546198f139124a79e29b0f698718fc05e5b755a411753657b52acomic-manifest-v1.0.0.api-v1.json, 1,274 bytes, SHA-2561ae2605069c38d40bac6c6ea65dff901e27893b95b1c977a694096d77728e052comic-manifest-v1.0.0.manifest.json, 5,256 bytes, SHA-2560beea6176c32152222784c5563cfe6574e9660d4bf8a65ad7f7fa975d50ac341; its digest is reported separately because the manifest does not self-reference.The owner-provided A3 AI-review exception applies to code-merge review only. It does not authorize a release decision, tag, release asset, or publication; no human review of final release artifacts is claimed. Preparation only: no tag, release, upload, npm publication, visibility/security change, or Issue #99 closure. Parent review/merge and separate explicit owner approval of exact post-merge artifact tuples are required.