chore(stack): converge acquisition evidence branch with protected main - #534
chore(stack): converge acquisition evidence branch with protected main#534seonghobae wants to merge 3 commits into
Conversation
* test(security): expose stalled audit response cancellation * fix(security): keep audit size failure independent of stream cleanup * test(security): reject unsafe private-reporting evidence paths * fix(security): bind private-reporting evidence to safe filesystem authority * test(security): preserve retained-report source authority * docs(changelog): record private-reporting hardening * test(security): reject private-report repository dot segments * fix(security): reject private-report repository dot segments * test(security): retain SHA-256 audit source identity * fix(security): accept SHA-256 audit source commits * test(security): reject deceptive repository failure evidence * fix(security): bind failure evidence to validated repository * docs(security): record private reporting evidence authority * test(security): retain valid repository on source failure * fix(security): preserve independently validated audit identity * docs(security): align private-reporting source identities * docs(security): record private reporting audit hardening
* test(ci): expose floating runner selector starvation * fix(ci): pin reviewer runner image * fix(ci): pin verification runner image * fix(ci): pin image gate runner image * test(ci): reject quoted floating runner selectors * docs(changelog): record pinned runner repair
* docs: make Noema README product-first * docs(readme): fix architecture guide link * docs: license Noema under Apache-2.0 * docs: declare Noema source license * docs: publish Noema license * docs: record Apache-2.0 source decision * docs: track source license and tooling gap * docs: keep private package metadata lock-stable * test: align README policy with product-first surface * docs: separate source grant from private package metadata * docs: keep source and package rights distinct * docs: require HTTPS exchange endpoint * test: cover source-only licensing acquisition gate * chore(ci): stage reviewed README licensing gate repairs * fix(acquisition): make package license metadata distribution-aware * test: preserve package-distribution licensing gate * chore(ci): retire completed README repair workflow * docs: add exact Ask DeepWiki badge * docs: add Pages-ready public landing source * fix(ci): pin verification to Ubuntu 24.04 * fix(ci): pin reviewer verification to Ubuntu 24.04 * docs: restore scheduled maintenance entry point * fix(ci): pin required GitHub-hosted runner selectors (#532) * test(ci): expose floating runner selector starvation * fix(ci): pin reviewer runner image * fix(ci): pin verification runner image * fix(ci): pin image gate runner image * test(ci): reject quoted floating runner selectors * docs(changelog): record pinned runner repair * docs: preserve integrated rights-receipt authority
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| if ( | ||
| decision | ||
| && typeof decision === "object" | ||
| && !Array.isArray(decision) | ||
| && (packageDistributionApplies || packageMetadataDeclared) | ||
| ) { |
There was a problem hiding this comment.
🔴 Conflicting source licenses pass acquisition review
For private packages without license metadata, packageDistributionApplies skips the only rights-decision consistency checks. A contradictory root license can therefore pass acquisition review.
Prompt for agents
The source-only licensing path in scripts/acquisition-readiness-audit.mjs no longer has a machine-checkable link between licensing_ip.owner_legal_decision and licensing_ip.repository_rights. package.json previously supplied that link, but private packages now legitimately omit package_metadata. Add an independent validation of the retained root rights file against the declared SPDX/custom/unlicensed decision, while preserving the intended exemption from npm package metadata. Add regression fixtures where a private package claims one SPDX decision but repository_rights hashes a different license, and equivalent contradictory custom/unlicensed cases.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| ## Contributing | ||
|
|
||
| Before changing behavior, read [`AGENTS.md`](./AGENTS.md), the canonical PRD/TRD, architecture decisions, and the current product-gap evidence. Keep runtime/security changes test-first, preserve exact-head evidence boundaries, and update the public contract and operator documentation whenever externally visible behavior changes. |
There was a problem hiding this comment.
🔍 Internal procedure returns to README
The contributor paragraph reintroduces “exact-head” procedure despite CONTRIBUTING.md reserving it for internal documentation. Move that instruction behind the existing internal links.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Non-product stack convergence attempt for #526. Fresh GitHub mergeability resolved to
dirty, so no merge was performed and no source/ref was changed by this PR. The exact #526 branch remains intact ateaebeec1a26d2dd4ef1ca7f5210ad44c91258de9; current protected main remains6b2b3e90dc3d5bd24cd27ed11db41b9eb7106010. The failed #526 CI boundary is still live-base drift, but ordinary automatic merge convergence is not safe because protected-main and #526 have real overlapping changes. This temporary convergence vehicle is closed without merge; conflict resolution must preserve the unique #526 commercial-evidence delta and current protected-main licensing/runner/governance changes before regenerating exact-head evidence.