Harden research promotion idempotence and evidence gates - #98
Conversation
Deploying website with
|
| Latest commit: |
b573461
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://12bbd3f7.website-bks.pages.dev |
| Branch Preview URL: | https://codex-promotion-policy-harde.website-bks.pages.dev |
Deploying secopsai with
|
| Latest commit: |
b573461
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://6dcd0666.secopsai.pages.dev |
| Branch Preview URL: | https://codex-promotion-policy-harde.secopsai.pages.dev |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5734617db
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if evidence.get("metadata_url"): | ||
| add_evidence(case["case_id"], evidence_type="registry_metadata", title="Registry metadata captured during candidate discovery", locator=evidence["metadata_url"], provenance="official registry monitor", notes=candidate.get("reason") or "", metadata={"candidate_id": candidate["candidate_id"]}, db_path=db_path, actor=actor) | ||
| case_id = f"RSC-{hashlib.sha256(candidate['candidate_id'].encode()).hexdigest()[:12].upper()}" | ||
| subject_id = f"SUB-{hashlib.sha256(f'{case_id}|package|{candidate["ecosystem"]}|{candidate["package"]}|{candidate.get("version") or ""}'.encode()).hexdigest()[:16].upper()}" |
There was a problem hiding this comment.
On the project's supported Python 3.10/3.11 runtimes, reusing the outer f-string's double quotes inside these expressions is a SyntaxError (the relaxed nested-f-string grammar only arrived in Python 3.12). Importing secopsai.research_discovery therefore fails before any command can run; rewrite this and the analogous evidence_id expression without same-quoted nested f-strings.
Useful? React with 👍 / 👎.
| connection.execute("""INSERT OR IGNORE INTO research_subjects | ||
| (subject_id, case_id, subject_type, ecosystem, name, version, publisher, status, metadata_json, created_at) | ||
| VALUES (?, ?, 'package', ?, ?, ?, ?, 'active', ?, ?)""", |
There was a problem hiding this comment.
Every successful promotion now inserts the subject without registry_state, so the schema migration supplies its unknown default. The replaced add_subject call explicitly recorded registry_state="available", which is appropriate because this candidate was observed through registry metadata; promoted cases now contain an inaccurate lifecycle state and require a redundant registry check to restore it.
Useful? React with 👍 / 👎.
1 participant
Follow-up hardening for PR #97.
Verification: focused promotion tests pass; full Core suite passed on the parent implementation.