Skip to content

docs(devlog): #936 security-review verdict + v2.10.2 release train ledger #1103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lidge-jun merged 1 commit into from
Aug 6, 2026
Merged

docs(devlog): #936 security-review verdict + v2.10.2 release train ledger #1103

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 79 additions & 0 deletions devlog/_plan/260806_disposition_sweep/070_936_release_train.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
# 070 — #936 security review, merge, and release train plan

User authorization (2026-08-06): owner delegates the #936 human security
review to this session; on PASS merge to dev, then run the full
dev→preview→main→npm train per `opencodex-release-train` procedure.

## Base (live)

| Ref | SHA / version |
|-----|----------------|
| origin/dev | `791e0fbf9` (v2.10.1 + #1097 + #1099) |
| origin/preview | `9ba45c85e` (2.10.1-preview.20260805) |
| origin/main | `99440ecd9` (2.10.1) |
| PR #936 head | `4874390dd` (open draft, merged-dev base b3a1d90a8 — two first-parent merge units behind (#1097, #1099; 15 reachable commits); merge-tree clean, no overlap with #1099's log.ts change) |

## wp1 — Security review scope (071 doc)

Owner-delegated review of the four hardening claims, diff-level, each with
threat model / bypass search / regression risk:

1. Vertex authority injection — `src/providers/google-vertex-location.ts`,
`src/adapters/google.ts:440`, `src/server/auth-cors.ts:429`.
2. Durable Bun executable provenance — `bin/ocx.mjs:394`,
`src/lib/bun-binary-validator.mjs`.
3. Claude ambient env fail-closed — `src/cli/claude.ts:76`, launcher
provenance `bin/ocx.mjs:464` (incl. the maintainer's recorded reversal:
all three slots fail closed without provenance).
4. Health management-token attestation — `src/oauth/health.ts:351/377`,
`src/lib/local-management-attestation.ts`, server challenge at
`src/server/index.ts:587`.

Also: workflows/release-automation touchpoints (MAINTAINERS.md blockers),
privacy:scan, and the merge-freshness question (base is 2 commits behind —
#1097 is devlog/test-only; #1099 changes src/usage/log.ts but does not

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Avoid a malformed Markdown heading at Line 34.

Line 34 starts with #1097, which triggers markdownlint rule MD018. Prefix the reference with PR so the paragraph remains valid Markdown.

Proposed fix 
-#1097 is devlog/test-only; `#1099` changes src/usage/log.ts but does not
+PR `#1097` is devlog/test-only; PR `#1099` changes src/usage/log.ts but does not
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
#1097 is devlog/test-only; #1099 changes src/usage/log.ts but does not
PR `#1097` is devlog/test-only; PR `#1099` changes src/usage/log.ts but does not
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)

[warning] 34-34: No space after hash on atx style heading

(MD018, no-missing-space-atx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@devlog/_plan/260806_disposition_sweep/070_936_release_train.md` at line 34,
Update the line beginning with “#1097” in the release-train document to prefix
the reference with “PR ”, avoiding a Markdown heading while preserving the
existing text.

Source: Linters/SAST tools

overlap #936's diff — merge-tree verified clean).
Parallel terra adversarial audit (fresh reviewer, not the wp-era one).
FAIL verdict = stop, report UNSAFE. No merge on a failed review.

## wp2 — Merge gates

ready-for-review → CI green on 4874390dd (or updated head if freshness
demands a dev merge-in) → `gh pr merge 936 --merge --match-head-commit <head>`
→ dev Cross-platform CI + Service lifecycle green on the merge SHA.

## wp3 — Train

Per release skill + audited convention (2.10.1 evidence: preview and main
carry SIBLING release-bump commits off the same dev source — promotion is
fast-forward of the chosen dev SHA to each branch, then an independent
`release.ts` bump on that branch; never merge preview's bump into main).
Version `2.10.2` (patch; the v2.10.0→v2.10.1 interval already carried
feat commits, so #1099's feat does not force 2.11.0). Order:

1. Choose release SHA on dev (post-#936 merge). FF-promote it to preview;
run `bun scripts/release.ts 2.10.2-preview.<date> --tag preview
--publish` on preview. release.ts itself waits for BOTH Cross-platform
CI and Service lifecycle on the bump SHA (release.ts:321); release.yml
re-enforces CI and conditionally Service lifecycle (release.yml:192).
2. FF-promote the SAME dev source SHA to main; run `bun scripts/release.ts
2.10.2 --tag latest --publish` on main. Same double gate on the main
Comment on lines +59 to +60

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Reconcile the source-SHA rule with the execution ledger.

Line 59 requires main to use the same dev source SHA as preview. Line 75 records preview promotion to 9795aeb50, while Line 76 records main promotion to 6865c005d after #1094 and #1101 advanced dev. These releases used different source SHAs.

The exact-head watcher in scripts/release.ts:189-209 verifies each workflow against its own SHA. It does not enforce equality between preview and stable sources. Document this as an approved exception with the included commits and evidence, or enforce the same-source rule in future trains.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@devlog/_plan/260806_disposition_sweep/070_936_release_train.md` around lines
59 - 60, Reconcile the source-SHA requirement in the release-train plan with the
execution ledger: update the relevant train documentation to mark the differing
preview and main SHAs as an approved exception, including commits `#1094` and
`#1101` and supporting evidence, or revise the release process to enforce
identical preview and stable source SHAs in future trains. Keep the exact-head
verification behavior in scripts/release.ts unchanged unless implementing the
enforcement option.

bump SHA.
3. Converge dev (merge the release bumps back or per convention); push.
4. Verify: `npm view @bitkyc08/opencodex dist-tags --json`, three branch
tips, final workflow conclusions, main-checkout stashes intact.

Rollback: `npm dist-tag add @bitkyc08/opencodex@<prev> latest`.

## Ledger

| Step | Evidence |
|------|----------|
| #936 security review | 071 doc: owner-delegated direct review + adversarial terra audit (019fd548) — both PASS; verdict PASS recorded |

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the referenced security-review verdict

The ledger says the PASS verdict is recorded in 071_936_security_review.md, but a repo-wide search and git ls-tree -r of this commit show no such file; only this row asserts the owner-delegated review happened. Because #936 changed authentication and credential boundaries, anyone auditing the v2.10.2 release cannot verify the required explicit security review from the repository. Add the promised published verdict document, or point this row to the actual review evidence instead.

AGENTS.md reference: AGENTS.md:L218-L224

Useful? React with 👍 / 👎.

| #936 merge | ready-for-review → CI re-ran green → `gh pr merge --merge --match-head-commit 4874390dd` → merge commit `9795aeb50` on dev |
| dev gates on 9795aeb50 | Cross-platform CI success; Service lifecycle success |
| preview promotion | FF `9ba45c85e → 9795aeb50` pushed; `release.ts 2.10.2-preview.20260806 --tag preview --publish` → published (npm dist-tag preview = 2.10.2-preview.20260806; GitHub pre-release created) |
| main promotion | FF `99440ecd9 → 6865c005d` (dev moved +2 PRs between preview cut and main cut — merged since preview cut: #1094 CI gate hardening, #1101 issue-quality fix); release.ts local-preflight hit the known `cursor-native-exec-shell` 5s timeout flake (reproduced passing in isolation; identical flake seen on #1097 CI) → manual release.ts continuation: bump `246850263` pushed, CI + Service lifecycle green on the SHA, `release.yml` dispatched with `expected-sha` → publish success |

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Correct the main promotion ancestry

The history does not support the claim that two PRs, including #1094, landed between the preview and main cuts: preview bump e5ec1add2 is based on 9795aeb50, whose first parent is already #1094 merge 35f87e8d, while main source 6865c005d has 9795aeb50 as its first parent and adds only #1101. As written, the release ledger incorrectly describes #1094 as stable-only; change this to one intervening PR and remove #1094 from the since-preview list.

Useful? React with 👍 / 👎.

| stable release | npm dist-tag latest = 2.10.2; GitHub Release v2.10.2 marked Latest |

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Move the completed security record into _fin

This row establishes that the stable release is already published, and the following rows record dev convergence and final working-tree safety, so this is a terminal record rather than open planning. Keeping it under devlog/_plan/ misclassifies the shipped security hardening as open triage and makes repository hygiene tooling apply the open-plan policy to it; move this completed release/security unit, including its verdict, under devlog/_fin/.

AGENTS.md reference: AGENTS.md:L79-L83

Useful? React with 👍 / 👎.

| dev convergence | merged main + preview release bumps into dev; package.json conflict resolved to `2.10.2`; typecheck clean; dev pushed `bf063b57b` |
| Working-tree safety | main/preview promotion worktrees were clean; user stashes in main checkout untouched (6 preserved); no dirty files were present or harmed |
Loading