test(corpus): lock audited external napplet evidence - #23
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e88a46de05
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f24f5fcba5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61350a326a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d138b7aefe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex: please re-review exact head |
|
@codex review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b1552d0d8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 96798a6e11
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 079b050cb4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head All prior threads are fixed and resolved. Exact-head gates passed: Node verifier tests; Nix shell classification; canonical-lock regression; full pinned verifier ( |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e6b4840787
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c5f24a4e71
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe61eccc1a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # jq expands these variables, not Bash. | ||
| # shellcheck disable=SC2016 | ||
| set +e | ||
| "$timeout_bin" --kill-after=1 "$jq_timeout_seconds" "$jq_bin" -e \ |
There was a problem hiding this comment.
When UZEL_JQ_BIN malfunctions during the final coordinate comparison, this invocation discards stdout but leaves stderr inherited and checks only the exit status. A fast producer can therefore flood CI log or capture storage for the full timeout, and a jq wrapper that emits diagnostics before exiting 0 still lets the verifier report success. Route this comparison through the bounded subprocess helper and reject nonempty stderr like the preceding jq stages.
AGENTS.md reference: uzel-poc-validated-pack/AGENTS.md:L20-L20
Useful? React with 👍 / 👎.
|
Deferred by product priority. This corpus is for later real native-runtime interoperability acceptance after profile/follows and core runtime bugs are fixed—not a current TypeScript conformance target. Preserve the branch/evidence, but do not merge or continue review churn now. Resume under issue #21 only after the dependency order in #9 is satisfied. |
1 participant
Purpose
Partial, data-only slice of #21. This locks a small audited external napplet corpus before live fetch/launch automation exists. It does not close #21.
What changed
hzrd149/napplelets@aa4dc7a0799d95e3066b50055b29685d6e376045:nak 0.20.1; hostnakversions are rejected.jqentry enumeration instead of allowing an empty false-success loop.Deliberate limits
This PR adds no napplet artifact blobs, runtime registration, UI integration, dependency pins, or live-availability claims. It does not claim reproducible builds of the external projects. Live naddr fetch/launch/screenshots remain blocked on #13 and #17. Runtime dependency repinning remains #11.
Failure contract
0: corpus valid2: trust failure, including an invalid signature3: verifier infrastructure failure, including missing/broken/wrong-versionnakor malformed decoder outputsafeAutomationuses a closed mapping; unknown values fail validation.How tested
pnpm checkpnpm lintpnpm testpnpm test:ui— 22/22graphify path "External napplet interoperability corpus" "Runtime"— no runtime pathIndependent defect review found four verifier-contract issues and one basename-path issue; all were fixed before PR creation. Exact-head Codex review then found an unknown-name allowlist bypass and an unpropagated
jqenumeration failure. Both now have regressions and are fixed atf24f5fcba5e0079b16e754e4bc8eecc0cbfdd461.Refs #21