fix(authority): complete parent-bound recovery chain - #45
Conversation
Integrate the independently produced exact-reduction helpers after focused and full validation. Require both provider review artifacts and byte-identical parent-Kernel reduction for ALLOW and DENY evidence.
Integrate the independently produced live-control-plane slice after focused validation. Source-own delete_branch_on_merge=false, enforce and read it back during bootstrap, and bind the setting into recovery evidence.
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f5a2f50412
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| test "$(jq -er '.state' promotion/pull-request.json)" = "open" | ||
| test "$(jq -er '.merged' promotion/pull-request.json)" = "false" | ||
| test "$(jq -er '.merge_commit_sha' promotion/pull-request.json)" = "$merge_sha" | ||
| elif [[ "$current_main" = "$merge_sha" ]]; then |
There was a problem hiding this comment.
When this recovery branch admits current_main == merge_sha, a rerun after a previous promotion was cancelled or lost its runner after merge/rebind can continue with the live rulesets still bound to the candidate or merged SHA. The workflow then proceeds into stage, where authority_ruleset_broker.py advance only accepts both rulesets at the parent SHA, so stage fails and the recover job is skipped because it requires needs.stage.result == 'success'; that leaves the promotion unable to self-recover without manual ruleset repair. Please restore/normalize the rulesets before staging, or bypass advance for this merged-main resume path.
Useful? React with 👍 / 👎.
|
... |
|
Full closing reason (the close comment above was truncated): Closing as superseded, per the approved HELM-350 disposition (operator decision 2026-07-23). This PR continues the stale #44 authority stack; its head conflicts with main and does not represent the current authority path (live truth is the content pinned at c585fc5 by ruleset 18924515). Branch intentionally not deleted. |
3 participants
Stack 3 of 6. Completes parent-bound promotion recovery and immutable-head verification. Depends on #41; followed by #42, #43, and #36.