ci: adopt isolated central controls and repository-owned verification - #63
ci: adopt isolated central controls and repository-owned verification#63openboa wants to merge 3 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review Please review exact head b6b5da3. This is a CI-only migration: check that repository verification remains equivalent to the current published contract, existing protection/ownership is preserved, and candidate execution stays delegated to the immutable central isolated launcher. The old-base bootstrap transition is a separately documented delivery gate, not permission to bypass it. No dataset or product behavior is being published. |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review the latest exact head 8359d07. The infrastructure-directory gap found in openboa-ai/coffee-chat-roastery#57 is fixed here too. Both new cases (.github/product-behavior.js and .githooks/eval-results.json) failed before the fix, and all five tests now pass in the pinned isolated launcher. The previously documented old-base transition gate and effective-settings decision remain unresolved; no checks or policy were bypassed. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review exact head 982e5db. The same-named file/directory issue from openboa-ai/coffee-chat-roastery#57 is fixed across all four repositories. Complete tracked file paths and regular-file checks now enforce the published layout, replacing the redundant basename-only reductions. LICENSE, AGENTS.md and SECURITY.md directory-replacement regressions failed before the fix; all eight tests now pass in the pinned isolated launcher. Existing old-base CI/history-scan approval boundaries remain unchanged; no policy or settings were bypassed. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Scope
CI-only adoption of the reviewed central controls in openboa-ai/.github#16. Tracked in openboa-ai/coffee-chat-bench#78; human decision owner: @SonSangjoon.
Exact evidence
The published Git tree matches the locally isolated and tested tree byte-for-byte.
Delivery gate
This is not a claim that remote CI has passed. The current base still selects f33da6bbcdfebd0693ff7673d750f369629e000e and that old workflow expects a base policy bootstrap which these skeletons no longer contain. Opening this PR will establish the actual old-pin run result; rerunning it does not select this candidate's new pin.
Do not remove required checks, fabricate success, or bypass the current gate. Exact-head Codex review and a separately recorded, scoped, expiring owner decision are required for any first-pin transition exception. Actual GitHub rulesets and Environment settings have not been changed by this PR. After a permitted merge, verify the merged tree and effective controls before reporting rollout complete. Structural success is not benchmark validity, Judge calibration, or Product lift.
Review follow-up
Restored the exact tracked-file boundary inside .github/ and .githooks/ after the Roastery review identified a regression. The same issue was reproduced in all four repositories: both new cases failed before the fix; all eight tests pass after it. This preserves repository layout, not a duplicated central security implementation. Latest exact head: 982e5db.
Complete-path review follow-up
The second Roastery finding showed that a root file could be replaced with a same-named directory. The three reported leaf replacements were reproduced in all four repositories (five existing tests passed; the three new tests failed). The verifier now compares complete tracked paths against the published layout and requires every accepted path to be a regular file. Redundant basename-only checks were removed. Eight tests now pass per repository in the pinned isolated launcher; central policy and staged/whole-index Gitleaks checks pass. No workflow, merge policy, permissions, source data, Product behavior or security policy changed in this follow-up.