feat: harden local runtime, entitlements, and Store delivery - #22
Open
kristoffersodersten wants to merge 84 commits into
Open
feat: harden local runtime, entitlements, and Store delivery#22kristoffersodersten wants to merge 84 commits into
kristoffersodersten wants to merge 84 commits into
Conversation
- Added __init__.py files to all server subdirectories (intent, model, operations, runtime, task) to enable proper Python package imports - Fixed import statements in server modules (ollama_client, nano_server, runtime_profiles) to use absolute imports - Updated eslint.config.js to support .mjs files with Node.js globals for scripts - All TypeScript builds successfully, ESLint passes (0 errors), and all tests pass (28/28) - Python modules now import correctly without ModuleNotFoundError Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Install pnpm before setup-node cache initialization and use the repository lockfile for CodeQL dependency setup.\n\nVerified: pnpm lint; pnpm lint:manifest; pnpm typecheck; pnpm test
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5b58ff4fde
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR restores/aligns the CI and CodeQL workflows to bootstrap pnpm before setup-node caching, and ensures dependency installation uses pnpm + pnpm-lock.yaml. It also updates ESLint configuration for .mjs files and includes small Python/module and formatting tweaks.
Changes:
- Update GitHub Actions CI and CodeQL workflows to set up pnpm earlier and use pnpm caching +
pnpm install --frozen-lockfile. - Add an ESLint override for
**/*.mjsto lint ES2022 Node ESM files with appropriate globals. - Minor Python import/whitespace-only edits in the server code and a formatting-only change in a stress report JSON.
Reviewed changes
Copilot reviewed 7 out of 13 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/ci.yml |
Installs pnpm before setup-node to support pnpm cache bootstrap. |
.github/workflows/codeql.yml |
Uses pnpm + pnpm-lock.yaml for JS CodeQL dependency setup and caching. |
eslint.config.js |
Adds .mjs linting config (ES2022, ESM, Node globals). |
server/nano_server.py |
Adjusts imports (module path style) and adds a trailing newline. |
server/ollama_client.py |
Adjusts extraction preset import to a package-qualified path. |
server/runtime_profiles.py |
Whitespace-only change (trailing newline). |
reports/stress/master_summary.json |
Formatting-only change (adds a blank whitespace line). |
server/__init__.py |
Empty package marker file (no content shown). |
server/intent/__init__.py |
Empty package marker file (no content shown). |
server/model/__init__.py |
Empty package marker file (no content shown). |
server/operations/__init__.py |
Empty package marker file (no content shown). |
server/runtime/__init__.py |
Empty package marker file (no content shown). |
server/task/__init__.py |
Empty package marker file (no content shown). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Route a fixed local sample through the paid extraction contract and persist successful completion. Replace static AES material with a per-install non-exportable key and cover the locked path plus encrypted round-trip.\n\nVerified: pnpm typecheck; pnpm exec tsc -p tsconfig.json; node --test tests/panel/*.test.mjs
… codex/sod-617-first-run-export
Allow the full browser suite and unpacked-extension proof to run against the same explicitly selected Chrome binary.\n\nVerified: SELECTPILOT_CHROME_EXECUTABLE=<local Chrome> pnpm test:e2e (7 passed); pnpm lint
…un-export feat(onboarding): add real first-run export flow
kristoffersodersten
enabled auto-merge
August 10, 2026 20:27
Restore imports compatible with the documented script invocation and add that invocation as a CI smoke gate. Remove unrelated whitespace noise identified in review.\n\nVerified: python3 server/nano_server.py --help; pnpm lint; pnpm lint:manifest; pnpm typecheck; pnpm test
This was referenced Aug 18, 2026
Verification: remote-compute-audit; compute guard heavy/light refusal checks; bash -n; git diff --check
Verified: pnpm lint && pnpm typecheck && pnpm build && pnpm test && pnpm test:privacy && pnpm test:e2e && pnpm bench:frontier && pnpm runtime:compile-policy && pnpm runtime:validate-policy && node scripts/stress-runner.mjs
Verified: pnpm lint && pnpm test
Expand required CI validation to cover privacy, unpacked-extension E2E, fail-closed policy compilation, and stress contracts. Emit an exact-SHA artifact that explicitly remains non-runtime and non-full-system evidence.\n\nVerified: pnpm lint && pnpm lint:manifest && pnpm typecheck && pnpm build && pnpm test && pnpm test:privacy && pnpm test:e2e && pnpm bench:frontier && pnpm runtime:compile-policy && pnpm runtime:validate-policy && node scripts/stress-runner.mjs && pnpm verify:admission
Verified: workflow YAML parse and GitHub release metadata for action majors
Use the generated profile variable names consistently and add a side-effect-free plan mode with exact Fast and Balanced regression tests.\n\nVerified: bash -n scripts/bootstrap-macos-local.sh && pnpm lint && pnpm test && pnpm test:privacy && pnpm test:e2e
Install the launchd runtime outside privacy-protected source folders, require Python 3.10 or newer for both local and packaged helpers, and wait for bridge readiness. Verified: pnpm lint; pnpm test; pnpm build; pnpm verify:admission; pnpm test:privacy; pnpm test:billing; pnpm lint:manifest; pnpm validate:store; pnpm test:e2e
Verified: shellcheck scripts/*.sh; pnpm lint; pnpm test
Align both macOS installation paths with the declared Python 3.9 compatibility contract and keep the minimum version explicit in regression coverage. Verified: shellcheck scripts/install-macos-local.sh installer/macos/scripts/postinstall; node --test tests/panel/bootstrap-contract.test.mjs; full Hetzner release verification.
Keep CI candidate packaging unsigned while requiring an authorized Developer ID Installer identity and notarytool keychain profile for production release. Verified: shellcheck scripts/*.sh; node --test tests/panel/macos-release-contract.test.mjs tests/panel/bootstrap-contract.test.mjs; pnpm lint.
Add conflict-free loopback routing, hardened systemd and Nginx contracts, fail-closed preflight, safe diagnostics, and deployment regression coverage. Verified: pnpm lint; pnpm test; pnpm typecheck; pnpm test:privacy; pnpm package:store; pnpm test:e2e; shellcheck; systemd-analyze verify; hardened systemd smoke and recovery.
…ase-preflight feat(release): add production entitlement deployment
…hardening fix(billing): harden Paddle webhook verification
Intent: AXIOM-20260830-OXBH25 Encrypt project memory at rest, keep preferences device-local, redact runtime errors, bound bridge requests, and activate downstream Axiom enforcement. Not run: dependencies are intentionally absent on the Mac control surface; full verification runs on Hetzner.
Intent: AXIOM-20260830-OXBH25 Reject malformed and oversized authority requests, enforce JSON media types, bound server sockets, remove checkout HTML injection, and cap polling/network waits. Not run: full verification executes on Hetzner.
…content-bundle fix(ci): synchronize hardened content bundle
Intent: AXIOM-20260830-OXBH25 Normalize hostile trace identifiers, recursively redact runtime metadata, rotate feedback logs, cap SSE streams, and suppress raw model errors. Not run: full verification executes on Hetzner.
…mission-gaps fix(ci): map checkout hardening coverage
Intent: AXIOM-20260830-OXBH25
…mission-gaps fix(governance): verify signed Axiom intent
Intent: AXIOM-20260830-OXBH25
…installer-routing fix(macos): preserve hardware task routing
Fail closed on missing Store identity, runtime integrity failures, mutable state errors, and local inference saturation. Preserve exact model routing through the extension UI. Verified: pnpm lint; pnpm test; pnpm test:e2e; pnpm build; pnpm test:privacy; pnpm test:billing; pnpm bench:frontier; runtime policy validation; stress runner.
Record the verified repository boundary and preserve every external production and review gate as open. Verified: evidence commands recorded in the checkpoint.
Cover active helper modules and runtime policy with an aggregate launch-time hash, install the missing installation manager dependency, and normalize raw request timeouts into the explicit helper failure contract. Verified: targeted Python runtime tests, bootstrap contract tests, shell syntax checks, and git diff --check.
Force the ESLint filesystem helper to 0.16.8 so build tooling cannot follow attacker-controlled symlinks outside a copied source tree. The lockfile is regenerated and verified on Hetzner in the following commit.
Update init, autobuild, and analyze together to remove the December 2026 v3 deprecation and the legacy Node 20 action runtime warning.
Record the admitted implementation parent, physical diagnostic boundary, protected Store environment state, and remaining external authorities without promoting the project to production completion.
Keep extension preferences device-local, bind the side panel to the active tab before opening, surface restricted-page failures, and add verified plain-text export. Verified: Hetzner pnpm lint && pnpm test && pnpm test:e2e
Select the Fast E2B profile for automatic setup on every supported machine while keeping heavier profiles behind explicit operator choice. Verified: Hetzner pnpm lint && pnpm typecheck && pnpm test && pnpm test:e2e
Verified: node --test tests/panel/runtime-profiles.test.mjs
kristoffersodersten
force-pushed
the
codex/ci-foundation-repair
branch
from
September 4, 2026 05:37
2cda039 to
8a26f54
Compare
Use one explicit generation keep-alive contract across prewarm, runtime requests, launchd, and health reporting. Invalid overrides fail closed and no larger model is selected as fallback. Verified: python3 -m unittest tests.server.test_ollama_client tests.server.test_installation_manager Verified: node --test tests/panel/bootstrap-contract.test.mjs Verified: bash -n scripts/bootstrap-macos-local.sh scripts/install-macos-local.sh installer/macos/scripts/postinstall
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fast/gemma4:e2b-it-qat) on every supported machine; larger profiles require explicit operator selection.keep_alive=-1contract. Invalid overrides fail closed; embedding remains independently time-bounded.Exact-head verification
Source commit:
0e5ec938cbf1e12b22bda6efb4866771aa4273d4Pull-request merge ref:
aaa25122204c2fc096e3311b15bd68a56b88b34fGitHub checks on the exact head: 9/9 successful.
selectpilot-code-admission-aaa25122204c2fc096e3311b15bd68a56b88b34f(artifact ID9925367230) has evidence-file SHA-256979e1956e918a1425bb33c060565888aa9b248eafbef47f0ecdbbe9c0c29ec87.main; this PR pinsbrace-expansion@5.0.9and@humanfs/node@0.16.8, and exact-head Dependency Review passed at severitylowor higher.Exact-final-SHA physical Apple evidence
The signed candidate was installed from the exact source commit on physical
Mac16,10/ Apple Silicon / 16 GB with existing local model artifacts only.gemma4:e2b-it-qatat context 16,384, seed 42, maximum concurrency 1, and local-only mode. The larger installed E4B model remained inactive and all 37 cloud-tagged models were ignored.com.chromeai.nanois running and health exposesgeneration_keep_alive_seconds=-1.UNTIL Forever. A baseline Action Brief completed in 10 s; after 342 s idle it completed in 10 s; after 733 s idle it completed in 9 s. All three produced canonical digest67fbb16a29175c1de1a1517dcf9704fbb08bb026d2f64858dd2d387bb40ef45a.auto_profileremained Fast under the owner-selected smallest-effective-model rule.nomic-embed-text-v2-moe:latest, returned 768 dimensions in 27 s from cold state, and did not evict E2B; generation still reportedForever.Preparing local model bundle, returned green health, and the next Action Brief completed in 10 s with the same digest.ollama_unavailable; it did not substitute any installed or cloud model, and the primary E2B service remained healthy.Release boundary
This is a tested repository and physical development-runtime candidate, not an approved production release.
runtime_verified=false,physical_hardware_verified=false, andfull_system_ok=false; physical evidence is recorded here rather than rewriting CI evidence.mainremainsREVIEW_REQUIREDwith zero approvals. Approval and merge remain human-controlled; no self-approval, self-merge, or protection bypass was performed.mainrequires one approving review with admin enforcement, an eligible independent human reviewer must be explicitly configured before merge.chrome://extensions; automated unpacked-extension E2E is 7/7.