Add a verified stable release channel - #809
Conversation
github-actions
Bot
added
the
coderabbit:first-pass
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedNext included review available in 58 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (32)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1fc04a9b28
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80064db2bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Review disposition at Review decisions and evidenceThe confirmed workflow-integrity omission is fixed: status compares installed workflows with the verified release archive and rejects changed, missing, or symlinked files/directories. All 26 status tests/201 assertions, 14 upgrade tests/162 assertions, focused lint, and independent corrective review pass. The tag-object anchor report was a false positive: the actual parser already rejected 40-/64-hex identities with suffix text or newlines. No follow-up issue was created. CodeRabbit explicitly skipped review and is not counted as a completed clean review. Automated summary comments are status artifacts; substantive inline findings are accounted for. Future full-PR scans should start after this comment unless |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46dd564a70
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a48151d523
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
Reviewed the diff (0b50d29...d90af66, 32 files, +4116/-202), focusing on the tag/receipt verification chain, the release workflow's two-job split, and scope/simplicity. Verification logic held up: Two lower-severity issues posted inline:
On scope: the PR description already acknowledges docs migration and trust-reporting could have been split out; I didn't find a clean way to split further without breaking the "channel" concept's cross-cutting need to stay consistent across install/upgrade/status/release. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dbb3e1cfb5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fc8ebc655
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bfc4244d1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
justin808
added
complexity:complexify
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 948d56ce75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| output, status = run_command(*command) | ||
| assert_equal 3, status.exitstatus, "#{relative} #{mutation}: #{output}" | ||
| assert_equal "CHECK_FAILED", JSON.parse(output).fetch("status") | ||
| File.binwrite(path, original) |
There was a problem hiding this comment.
When this test runs under the common 0022 umask, the stable archive installs bin/agent_doctor/contract.rb as 0664, but after the missing/modified checks this File.binwrite recreates it as 0644. Since doctor ownership includes the full permission mode, the later healthy-status assertion for LICENSE fails with installed doctor runtime differs from verified release; I reproduced this with ruby bin/upgrade-agent-workflows-test.rb -n /checks_installed_auxiliary/. Capture and restore the original mode along with the bytes so the mandatory full validation suite can pass.
AGENTS.md reference: AGENTS.md:L54-L60
Useful? React with 👍 / 👎.
1 participant
Why
Provide a stable adoption path backed by full verification of the exact release candidate, while ordinary PRs can use appropriate integration checks. Part of #296.
What changed
Stable installation, upgrade, rollback, and status now bind an annotated release tag to its peeled commit and verified GitHub release receipt. Development installs require an explicit channel; stack sync preserves existing stable installations, and channel conversion refuses before mutation when omitted managed content would remain active.
Status also verifies installed doctor/scanner runtimes, every expected flat skill directory, the installed license, and the installed version against the authenticated release. Missing skill roots or a missing/modified owned license cannot report a healthy stable installation. Integrity follows the recorded installed delivery mode; previewing a future mode does not require files that have not been installed yet.
Cold installation authenticates the standalone verifier against a SHA-256 pin from an independently trusted guide before executing any selected-release code. The authenticated verifier checks published provenance before checkout and installer execution; all fresh-install entry points use this canonical bootstrap.
The release workflow verifies the final versioned candidate with the complete validation suite using read-only permissions. A separate protected job then checks independent human approval of that exact commit, creates an immutable annotated tag, records its provenance, and publishes the release. Selected PR checks cannot substitute for this gate. Fork guidance recommends updating from a verified upstream tag while preserving fork changes and running fork checks; publishing a fork release requires its own full candidate verification.
The repository now separately blocks
v*tag updates and deletion with no bypass actors. Before the first release, administrators must still configure thestable-releaseenvironment with independent required reviewers and no bypass, and restrict tag creation to the approved release identity. This PR publishes no release. Cryptographic signatures are not required.Native Claude adoption verifies the release through copy staging and checks the installed commit. Stable Codex adoption currently uses verified copy installation: the existing native URL catalog entry does not pin the separately fetched plugin code, so that route remains development/unverified. This is a limitation of this repository's current catalog, not a claim that Codex lacks immutable plugin sources.
This change spans 32 files because channel selection and identity must stay consistent across installation, upgrade/rollback, status, trust reporting, host guidance, and release automation. Documentation migration and trust-reporting integration could have been split; they remain together to keep the advertised stable path consistent. A separate native Codex stable catalog mechanism is deferred. Most added code is regression coverage and verification of GitHub release evidence.
How to review and verify
Start with
docs/release-channel.mdand the read-only verification job in.github/workflows/release.yml. Then inspect stable installation evidence and the pre-mutation stack guard. Full candidate verification must precede tag creation, and selected PR coverage must never qualify a release.Test plan
bin/validate, including installer and stack suites.deferred_to_update_changelog.Agent details
Current candidate and evidence
Current review found a Linux fixture mode-restoration defect. A faithful isolated Linux run reproduced the failure. A four-line test-only correction preserves original file permissions after restoring content; the existing upgrade suite then passed 20 tests and 266 assertions. That correction and the latest main integration are under local validation and are not yet published. The published candidate remains blocked by this confirmed finding. Claude reported 63 permission denials and published no review artifact; its launcher success is not a clean review attestation.
Candidate
948d56ce75177599b7bf28996c6387855c7cd9beintegrates actual mainf26ed1e33b78568ce76d1f4c1b7efd92fc24254b, after the installer batching, documentation CI selector, and integration/promotion contract merged. The automatic integration preserves all 32 feature paths and modes: 26 files retain their prior feature bytes; six combine the independently reviewed incoming changes. Current-main changelog is preserved exactly. Independent review found no actionable issue in those six compositions, including stable source materialization feeding the batched installer. Precommit checks passed with documented partial coverage while incoming skill changes were staged. Clean committed local full validation: PASS, including installer and stack suites. Current-head hosted full validation and review cohort: PENDING.The preceding candidate
1dc309041e2191814ee37e8b30be2a1217925d5cpassed clean local full validation and full hosted validation. Its independent final correction review passed 47 tests and 477 assertions. These results are historical; qualification of the updated integration is listed separately.The final completeness correction passed upgrade tests (20 tests/266 assertions), status tests (27 tests/211 assertions), and all five lint tools. Independent corrective review repeated all 47 tests/477 assertions and found no actionable regressions. Missing one or all flat skill roots, a missing skills parent, an absent legacy delivery-mode field, and missing/modified licenses are covered. Valid companion installations remain accepted. Expected content comes from the authenticated release, without a new persisted inventory. Earlier corrective regressions passed 2 tests/49 assertions. They cover missing/modified doctor and scanner runtimes, invalid installed version metadata, valid upgrade availability, flat-to-companion status and upgrade dry-run, and companion-to-flat integrity. Comparison uses the verified installed release and existing ownership comparison; requested mode remains a compatibility input. No additional metadata schema was introduced.
Earlier qualification includes status tests (27 tests/211 assertions), receipt/bootstrap tests (20 tests/112 assertions), eight stable installer cases, Linux bootstrap replay (3 tests/10 assertions), and stack-preservation tests. The documented bootstrap code itself is exercised. Symlinked managed ancestors are rejected; these reads are not an atomic filesystem snapshot. Unrelated personal files remain untouched. Claude's extra local engine is unavailable due its weekly limit and is not counted as passing evidence.
QA Evidence
948d56ce75177599b7bf28996c6387855c7cd9be.Decision log
Stable Codex adoption uses the verified copy route. A separate immutable native Codex catalog entry and first-release administrative setup remain outstanding, so this PR does not close every adoption criterion in #296. PR qualification is not a release attestation; the release workflow must run every suite uninterrupted on the final versioned candidate.