Bootstrap protected Brutalist attestation gate - #76
Open
ejmockler wants to merge 2 commits into
Open
Conversation
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces Brutalist launch attestation v3: isolated evidence capture, offline Ed25519 signing, detached proof commits, strict evidence verification, and a protected ChangesBrutalist launch attestation
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant CaptureRunner
participant Signer
participant Finalizer
participant DiagnosticWorkflow
participant Verifier
Operator->>CaptureRunner: capture canonical review evidence
CaptureRunner-->>Operator: evidence digest
Operator->>Signer: sign canonical evidence offline
Signer-->>Finalizer: detached signature
Finalizer->>Verifier: validate evidence and create proof commit
Finalizer-->>DiagnosticWorkflow: attestation proof ref
DiagnosticWorkflow->>Verifier: verify immutable source and proof objects
Verifier-->>DiagnosticWorkflow: pass or failure
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/unit/scripts/brutalist-attestation.test.ts (1)
80-80: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff
JsonRecord = Record<string, any>usesany.The coding guidelines direct avoiding
anyin TypeScript. This alias is threaded through most helpers and the arbitrary-property mutations (attestation.reviewers[0].model = ...,evidence.request.arguments.force_refresh = ...) rely on it, so switching toRecord<string, unknown>would require casts at each mutation site. Consider a narrower fixture type (or a small set of interfaces forattestation/evidence) to regain type safety on the shapes actually exercised.As per coding guidelines: "Strive for strong type safety. Avoid using
anywhenever possible in TypeScript".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/unit/scripts/brutalist-attestation.test.ts` at line 80, Replace the JsonRecord alias with a narrow, type-safe fixture model covering the attestation and evidence fields exercised by the tests, including mutable reviewer model and force_refresh properties. Update the related helpers and fixtures to use these interfaces so arbitrary-property mutations remain type-checked without any or repeated casts.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/brutalist-review.yml:
- Around line 41-49: Update the candidate repository fetch command in the
workflow to fetch the pull request base SHA explicitly, alongside the existing
PR head and proof references, so git cat-file can resolve the expected base
commit even when the PR is out of date. Use the existing base-SHA workflow value
and preserve the current repository initialization and fetch behavior.
---
Nitpick comments:
In `@tests/unit/scripts/brutalist-attestation.test.ts`:
- Line 80: Replace the JsonRecord alias with a narrow, type-safe fixture model
covering the attestation and evidence fields exercised by the tests, including
mutable reviewer model and force_refresh properties. Update the related helpers
and fixtures to use these interfaces so arbitrary-property mutations remain
type-checked without any or repeated casts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: eef8f0aa-9c8a-4bd5-9215-a1231a77f32b
📒 Files selected for processing (8)
.github/brutalist-allowed-signers.github/workflows/brutalist-review.ymldocs/strategy/public-discovery-release-hypergraph/docs/BRUTALIST-ATTESTATION.mdscripts/finalize-brutalist-launch-review.mjsscripts/run-brutalist-launch-review.mjsscripts/sign-brutalist-evidence.mjsscripts/verify-brutalist-attestation.mjstests/unit/scripts/brutalist-attestation.test.ts
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Bootstrap the protected-base half of the Commons Brutalist launch-review protocol.
The workflow reads candidate source and detached proof only as inert Git objects,
then runs the verifier from the PR base checkout.
This deliberately does not attest this bootstrap PR. A candidate workflow
cannot authorize itself.
Exact scope
No application, cache, Convex, Cloudflare deployment, package, lockfile, or
release-hypergraph state is changed.
Local verification
Bootstrap limitations and merge order
verify its public-key fingerprint out of band.
The check remains diagnostic/spoofable until a distinct GitHub App or
organization-owned required workflow owns the authoritative status. The trust
root intentionally contains no key in this PR.
Summary by CodeRabbit
New Features
Bug Fixes
Tests