Repository navigation
feat(trust): E14 subprocessor list (DRAFT — do not merge) - #3707
Draft
PetrefiedThunder wants to merge 6 commits into
Draft
PetrefiedThunder wants to merge 6 commits into
PetrefiedThunder wants to merge 6 commits into
Conversation
Update the public Trust inventory for diligence E14: keep in-production vendors separate from OpenAI, Vertex, and LlamaCloud (not enabled in production); add region and transferMechanism filled only from each vendor's official DPA or regions pages; leave blank when unstated. LlamaCloud availabilityLabel matches Security/Lead draft wording. Signed-off-by: Christopher Sellers <1@christophersellers.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
Update the LlamaCloud availability label to the planned wording and reword purpose so the draft does not claim the vendor is live. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
Collaborator
Author
There was a problem hiding this comment.
Findings
-
Blocking — Vercel
transferMechanismmisnames the UK instrument. Row currently saysUK International Data Transfer Agreement. Vercel's own DPA (https://vercel.com/legal/dpa, Schedule 3) defines"UK IDTA"as the UK international data transfer addendum (Schedule 5). Every other inventory row correctly uses Addendum. Fix toUK International Data Transfer Addendum(or quote Vercel's exact DPA phrasing) before PASS. -
LlamaCloud planned / not live — OK and consistent with sources. On this head:
availability: 'not_in_production'(notwhere_configured, not live)availabilityLabel:Planned: document extraction for admin bulk PDF uploads; not enabled in production as of Oct 28, 2026; enablement pending legal review and customer notice(exact string locked by unit test)purposealso states planned / not enabled in production
Aligns with product diligence E14 (split list; keep LlamaCloud off; don't claim where_configured when unset) and security E14 (production extraction OFF; Oct 28 Railway key-absent evidence; add inventory row with honest availability). Lead-steered "planned not live" correctly supersedes the older security draft labelWhere configured. Not enabled.... Region (us-east-1 / eu-central-1) and SCC Module 2/3 + UK Addendum via ToS-incorporated DPA match LlamaIndex regions docs and Terms §8.2–8.3.
-
Non-blocking — rest of inventory checks. OpenAI / Vertex use
not_in_productionwith the Legal not-in-production label. In-production vendors usedefault/where_configuredas steered. TypeSafe AI and Cloudflare R2 / OpenAIregionblanks are acceptable where the DPA does not state a single primary region. No en/em dashes in labels. Scope limited totrust-subprocessors.ts+ test. Did not mark ready or merge (DRAFT; lawyer + C.Lee Approvals still required).
Verdict
FAIL on the Vercel UK transfer-mechanism wording only. LlamaCloud planned/not-live check passes. Re-request review after the one-word (Agreement → Addendum) fix on Vercel.
REVIEW: FAIL codex 5110012
Codex FAIL on #3707: Vercel DPA Schedule 3 defines UK IDTA as the UK international data transfer addendum, not Agreement. Re-verified other vendors; no other Agreement/Addendum mismatches. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
Collaborator
Author
There was a problem hiding this comment.
Delta re-review vs FAIL 5110012
Scope
511001238..690aa4c71: only frontend/src/lib/trust-subprocessors.ts and frontend/src/lib/__tests__/trust-subprocessors.test.ts (1 line inventory fix + 8-line regression test). Still DRAFT; not marked ready; not merged.
Findings
- Resolved — Vercel UK transfer mechanism.
transferMechanismis nowEU Standard Contractual Clauses with UK International Data Transfer Addendum. Re-checked https://vercel.com/legal/dpa Schedule 3:"UK IDTA" means the UK international data transfer addendum (Schedule 5)and UK transfers incorporate that IDTA together with the 2021 SCCs. No residualAgreementin the inventory file. - Regression test — sound and data-free. Asserts the exact Vercel string and
not.toMatch(/Agreement/i). No fixtures, secrets, tenant data, or network I/O. - No new defects. LlamaCloud remains
not_in_productionwith the planned / not-live label from the prior head. No other inventory fields changed in this delta.
Verdict
PASS on this head. Keep DRAFT pending lawyer + C.Lee Approvals; do not merge from this review.
REVIEW: PASS codex 690aa4c
Contributor
✅ Bundle Size Report
Bundle is within the 10.0MB limit. |
Contributor
PR Blocker ChecklistHead SHA: Status: Ready
|
Contributor
|
Vercel preview: https://regengine-mzh30e9lt-petrefiedthunders-projects.vercel.app Access is via Vercel login (Deployment Protection). |
…or-list Signed-off-by: Christopher Sellers <1@christophersellers.com>
…claim The Preview status detail on /trust said "but is not GA" in the same line as GS1 EPCIS 2.0, which the copy gate's live-claim rule (correctly) treats as labeling a non-live capability with GA. It fails on main too (f8d7cdf). Reword to "has not reached general release" with the same meaning. Also ratchet scripts/copy-lint/baseline.json down for the 10 file/rule entries that #3641 already fixed on main (counts only decrease to 0; nothing is added or raised). Signed-off-by: Christopher Sellers <1@christophersellers.com>
The invite journey passed its assertions (the invitee is listed on /settings/users) but then failed in cleanupInviteFixture with "database is locked" on both attempts. The spec opened the admin SQLite file with node:sqlite and no busy timeout, so any in-flight write from the admin service made SQLite return SQLITE_BUSY immediately. Open the database through one helper that sets PRAGMA busy_timeout=5000 so the fixture waits for the concurrent write to commit. No assertion, skip or retry setting changes. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
left a comment
PetrefiedThunder
left a comment
Collaborator
Author
There was a problem hiding this comment.
Delta review vs prior PASS 690aa4c (re-verified head 8bcb95a).
Authored non-merge commits after prior PASS: cc86948 (copy reword + baseline ratchet), 8bcb95a (e2e busy_timeout). Remerge onto current origin/main is clean and leaves the same three-file delta plus the already-reviewed E14 trust-subprocessors work.
Findings:
- frontend/src/app/trust/page.tsx: Preview detail "but is not GA" -> "but has not reached general release". EPCIS stays labeled Preview on the same line. No new compliance/FDA claims, no dashes, no live-claim hit (copy-lint live-claim: 0; full check and --gate vs main baseline exit 0).
- scripts/copy-lint/baseline.json: exactly 10 stale rule entries removed, zero additions, zero raises. Removed rules no longer fire on those paths at this head (spot-checked via check-copy.mjs).
- frontend/tests/e2e/authenticated-core-journeys.spec.ts: adds openAdminDatabase() with PRAGMA busy_timeout=5000 and routes expectAdminAuditLog + cleanupInviteFixture through it. No assertion, skip, or retry setting changes.
Conflict note (not a FAIL of this delta): trial merge with #3706 (7a894f0) on current main conflicts in both orders on trust/page.tsx Preview detail only. baseline.json does not conflict (identical 10-entry ratchet). Recommended resolution: keep #3706 wording ("supported workspaces only...") since that is the SEL-607 directed rewrite of this line; keep #3707 e2e busy_timeout and either PR's identical baseline ratchet.
DRAFT PR: still lawyer + C.Lee yes before merge.
REVIEW: PASS codex 8bcb95a
PetrefiedThunder
added a commit
that referenced
this pull request
Oct 29, 2026
Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
added a commit
that referenced
this pull request
Oct 29, 2026
Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
added a commit
that referenced
this pull request
Oct 29, 2026
Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com>
PetrefiedThunder
added a commit
that referenced
this pull request
Oct 30, 2026
… direction (#3713) * feat(trace): report depth exhaustion and walk transformation links by direction Stories S1 and S2 of docs/product/FSMA_204_READINESS_GAP_ANALYSIS_2026-10-28 (PR #3701). Both close a silent-truncation path the external readiness PRD excludes: a trace that stopped at its depth limit read as complete, and the FDA export lineage walk followed transformation links in either direction, so a backward step to a parent lot followed by a forward step pulled in sibling lots that never touched the seed. S1, records trace (`/api/v1/records/trace/forward|backward/{tlc}`): - CanonicalEventStore.trace_walk returns a TraceWalk with `truncated` (result cap, #1282) and a new `depth_exhausted` flag, set when a lot was reached at max_depth and never expanded. Conservative, no extra query. - trace_forward / trace_backward keep the (links, truncated) contract by delegating to trace_walk. - TraceResponse gains `depth_exhausted` and `max_depth`. S2, export lineage (`_expand_tlcs_via_transformation_links`, batch twin, `/api/v1/fda/trace/{tlc}`): - Direction travels as a column in the single recursive branch: forward rows only join input_tlc, backward rows only output_tlc. `both` is now the union of a pure forward and a pure backward walk (21 CFR 1.1350(c)), not an undirected walk, so sibling lots are excluded. - New `_expand_tlcs_detailed` returns TlcExpansion with `depth_exhausted` and per-lot reach data; the list-returning functions wrap it. - fetch_trace_graph_data labels nodes by the walk that reached them (a lot two hops downstream was labelled upstream before), adds per-node depth, and returns `direction` and `depth_exhausted`. The route accepts `direction=forward|backward|both` (default both). Export and /export/verify share the same walk, so they stay consistent. Bundles produced before this change will not reproduce byte-for-byte when sibling lots were present; no customer bundles exist (pre-production). Tests: depth flags on the writer walk, router response fields, direction SQL shape on the recursive CTE, a live PostgreSQL sibling-exclusion case, and a new route test for /api/v1/fda/trace. Verified locally against a scratch PostgreSQL 16 at alembic head plus the tenant-scope query gate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GyhDYG3ddQvVKyu2qtYfCj * fix(scripts): spell the key-dir mode as stat.S_IRWXU for the Semgrep gate Ported from #3736. The Semgrep OWASP hard gate on main has flagged scripts/create_test_api_key.py:140 (insecure-file-permissions) since #3625 and the main merge carried the finding into this branch. The directory mode is unchanged (owner read, write and execute only; the key file itself stays 0600). This no-ops once main carries the fix. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GyhDYG3ddQvVKyu2qtYfCj * fix(trace): judge the depth limit per direction and keep graph edges inside the returned lots Two review findings on the S2 walk. depth_exhausted collapsed both walks to MIN(depth) per lot before checking the limit, so a lot the backward walk found early hid a forward frontier: with S -> A -> X -> S and X -> Y, a both-direction trace from S at depth 2 omits Y (X sits at depth 2 forward, never expanded) yet read depth_exhausted=false because X is at depth 1 backward. The CTE's final select now takes MIN(depth) per (lot, direction) first and reports whether any walk only reached a lot at the limit; the display depth is still the shallowest reach. Rows without the new column fall back to the collapsed depth. fetch_trace_graph_data selected every link touching any returned lot, so a sibling branch (A -> S when tracing B in A -> B, A -> S) and opposite-direction neighbours leaked into edges and named lots absent from nodes. Both ends must now be returned lots, in SQL and again on the rows for persistence stubs. Tests: unit cases for the per-direction limit (fake rows carrying the fifth column, SQL shape) and for edge restriction; a live PostgreSQL case for the cycle graph at depths 2, 3 and 4. All three failed before the change. Tenant-scope query gate passes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GyhDYG3ddQvVKyu2qtYfCj * fix(copy): Trust Preview detail avoids GA live-claim next to EPCIS Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com> --------- Signed-off-by: Christopher Sellers <1@christophersellers.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
PetrefiedThunder
added a commit
that referenced
this pull request
Nov 3, 2026
…ifications (#3739) * fix(SEL-615): show beta unavailable for SEL-614 frontend loads * fix(copy): Trust Preview detail avoids GA live-claim next to EPCIS Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com> --------- Signed-off-by: Christopher Sellers <1@christophersellers.com> Co-authored-by: CS <cs@CSs-MacBook-Pro.local>
PetrefiedThunder
added a commit
that referenced
this pull request
Nov 4, 2026
* fix(SEL-616): degrade Compliance when readiness/summary is unavailable Root cause of the prod 503 is outside this PR (regengine lacks SELECT on tenants.status for the bridge-key auth path). Soften the Compliance Dashboard so a score or workbench readiness failure stays sectional instead of blanking the page, and document the DevOps grant in the PR. * fix(copy): Trust Preview detail avoids GA live-claim next to EPCIS Match #3707 wording: Preview stays evaluation-only without saying GA. Refresh copy-lint baseline so the gate matches the scan. Signed-off-by: Christopher Sellers <1@christophersellers.com> * test(frontend): cover 401 on workbench readiness (SEL-616) Readiness 401 rejects once with a machine-readable auth status, and the Compliance page shows the unavailable state instead of placeholder readiness data when only readiness is unauthorized. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(compliance-ui): readiness card shows loading, and survives a failed score refetch (SEL-616) - Both Import readiness cards render a loading line while the readiness request is in flight, instead of placeholder 'No saved preflight run yet' / '0 open fixes' data. - The score-down readiness strip now shows whenever the score errors, including when react-query still holds a cached score from an earlier good load. Previously both readiness cards were hidden in that case. Display-only; no scoring or compliance logic changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Signed-off-by: Christopher Sellers <1@christophersellers.com> Co-authored-by: CS <cs@CSs-MacBook-Pro.local> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DRAFT — do not merge
Diligence E14 (subprocessor list). This PR is DRAFT only.
Summary
where_configuredfor vendors that are not in production; they usenot_in_productionwith explicit availability labels.regionandtransferMechanismon every row, filled only from each vendor's official DPA / regions pages. Blank when the page does not state it.Files:
frontend/src/lib/trust-subprocessors.tsfrontend/src/lib/__tests__/trust-subprocessors.test.tsTrust / DPA pages already render
availabilityLabel,purpose,dataProcessed, andlocation. They do not yet showregion/transferMechanismcolumns; those fields are on the data model for Legal diligence and a follow-up UI pass if approved.Availability split
defaultwhere_configuredwhere_configuredwhere_configuredwhere_configuredwhere_configuredwhere_configurednot_in_productionnot_in_productionnot_in_productionLlamaCloud label is the exact planned / not live string from VS Code Lead (Oct 28, 2026). Semicolon kept as given (no-dashes UI rule does not conflict). Nothing in this draft claims LlamaCloud is live or in production use.
Per-vendor region / transferMechanism (sources + supporting phrases)
Supabase (in use)
Railway (in use)
Vercel (in use)
Sentry (in use)
Stripe (in use)
PostHog (in use)
Resend (in use)
TypeSafe AI (in use)
Cloudflare R2 (in use)
locationdisplay string retained for the current UI).OpenAI (not in production)
Google Cloud Vertex AI (not in production)
locationstill shows United States (us-central1) from prior inventory; that specific region code is not asserted by the CDPA as a default.)LlamaCloud (not in production)
/workspace/security/e14-llamacloud-security-review-2026-10-28.md(Railway/Vercel prod:LLAMA_CLOUD_API_KEYabsent → extraction off)Planned: document extraction for admin bulk PDF uploads; not enabled in production as of Oct 28, 2026; enablement pending legal review and customer noticeBlank fields (and why)
Verification (local Mac worktree)
npx tsc --noEmit -p tsconfig.json(frontend): passnpx eslinton changed files: passnpx vitest run src/lib/__tests__/trust-subprocessors.test.ts: 8/8 passOut of scope / follow-ups
region/transferMechanismon Trust and DPA pages (not in this PR; data only).Codex FAIL follow-up (Oct 28, 2026)
transferMechanism: Agreement → Addendum per https://vercel.com/legal/dpa Schedule 3 definition of UK IDTA.