Fix PortfolioTruth security receipt same-cycle binding - #205
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| with security_coverage_receipt_writer(canonical): | ||
| raise RuntimeError("collector interrupted") | ||
|
|
||
| assert canonical.with_name(f".{canonical.name}.lock").is_file() |
| receipt = _collect(cohort_count=DEFAULT_EXPECTED_GITHUB_COHORT_COUNT) | ||
| canonical = tmp_path / GITHUB_SECURITY_RECEIPT_FILENAME | ||
| write_security_coverage_receipt(receipt, canonical) | ||
| binding = load_security_coverage_receipt( |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c1608722fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| staged.replace(path) | ||
| published.append(path) | ||
| except Exception: | ||
| with publication_guard: |
There was a problem hiding this comment.
When a caller supplies a valid binding but passes security_alerts_by_name from another receipt—or metadata whose ID, digest, and path match but whose state or producer fields do not—this guard revalidates the receipt file but discards the returned LoadedSecurityCoverage; the snapshot has already been built from the caller-provided mappings. Canonical output can therefore report security findings or provenance not present in the bound bytes, so publication should compare against or build from the reloaded entries and complete metadata before replacing outputs.
AGENTS.md reference: src/AGENTS.md:L5-L10
Useful? React with 👍 / 👎.
2 participants
Summary
Root cause
The collector previously advertised writer intent only during final receipt replacement. PortfolioTruth could publish R0 while R1 was already being produced but not yet visible at the canonical pointer.
Validation
Notes