Repository navigation
feat: managed checkout and cross-transport revocation checks (#74–76) - #111
Conversation
One-use feature-branch materializer. It only applies the reviewed patch and publishes that branch; it does not merge, deploy, close issues, or weaken existing CI. The materializer removes itself before the final PR tree.
Full combined CI 36348523874 failed with 122 collection errors because test_service imported the directory-scoped installed fixture from the bare conftest module after tests/issue_78_80/conftest.py had been imported. Let pytest resolve installed by fixture name instead, and remove the redundant re-export import in test_transfer. No fixture, production code, assertion, or CI selection changes. Reproduced nested-conftest shadowing locally against both real test modules: 2 import errors before, all 8 selected tests collected after. Full Python 3.15/PostgreSQL CI will rerun on this commit. Refs #75, #76, #77.
…buyer-only mail (#74) Preserve orders.buy@1 and escrow-v1. Add explicit orders.buy@2 with optional checkout acceptance under escrow-instant-v1, separate signed delivery ACK, current DeliveryTarget checks, and generation-bound minimal email hints. Keep transfer legs, delivery, signed decision, replay result and mail outbox atomic. Extend real PostgreSQL regressions for rollback, competition, revocation, no blind SMTP retries and the prefunded bounty-to-bundle flow.
Integrate main b1ac767, preserving its CI shards, schema hardening and live notification lease fences. Add group-reshare revocation, historical reads, known-digest cache, search, Sync and independent-authority checks across HTTP, GET path, GraphQL, MCP HTTP, CLI and MCP stdio. Document versioned checkout/ACK/mail contracts and explicit remaining acceptance. Remove the temporary source export workflow from the final tree; the unchanged main CI now verifies all tests, conformance and builds. Refs #74, #75, #76. Includes the unchanged PR #99 dependency slice; no umbrella issue closure, production authority update or deployment.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Reject mismatched restored terms, funding references, settlement timestamps, delivery IDs and preparation timestamps without touching immutable journal or ledger triggers. Verify the domain-separated release request and original order/evidence digests before a claim; no additional transfer is performed. Refs #74, #75.
…hecks Register actor and recipient as typed identity references without weakening unknown-table rejection or modifying historical journal/ledger bytes. Add real PostgreSQL corruption and repeated-startup regressions. Use an explicit non-null projection for the six-adapter warm-cache test; compact wire output omits optional null fields from default projections. Retain every positive cache assertion and post-revocation denial check. Refs #74, #75, #76.
|
Final integration follow-up at The full four-shard run at This head registers only the decision's actual identity fields ( Current complete CI: https://github.com/TokenNotIncluded/msg.lmm.best/actions/runs/36353919437 . Earlier targeted passes are not a substitute for this final-head gate. No umbrella issue is closed and no production configuration is changed. @codex security review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Integrate main 4c46671 and its exact test-identity CI gate, shared current_attempt fence, tool/Git/maintenance completion checks and all eleven regressions. Resolve the sole worker overlap by retaining the complete latest-main worker outside the existing buyer-bound mail projection/configuration checks. Before integration, head 8aa0e12 passed run 36353919437: 1160 business/security tests plus 8 conformance checks, zero failures/errors/skips, wheel/sdist and contracts gate. All four downloaded artifact SHA-256 digests were verified. The integrated head is subject to a fresh full CI run; no issue closure or deployment is implied.
|
Resolved the latest main conflict in The preceding Current integrated-head CI is https://github.com/TokenNotIncluded/msg.lmm.best/actions/runs/36354944861 ; it must pass separately before merge. The previous no-major-findings review at @codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Scope
Refs #74, #75, #76. This delivers a bounded implementation; keep the umbrella issues open for remaining acceptance.
orders.buy@1and the originalescrow-v1digest. Add signedorders.buy@2with an immutable package digest and atomic in-site preparation. Optionalauto_acceptrequires the explicitescrow-instant-v1policy.delivery.claim@1acknowledges receipt without paying again and validates complete signed order/delivery snapshots after restoration.docs/MANAGED_CHECKOUT.md.Final verification
Tested head:
4ef3548b933e26b32a557ced12a1a046ea698844, treeb55140fa180c3c583ea48c711c0c88e493b957e1.Full CI run 36354944861 passed all four shards and the final contracts gate on Python 3.15/PostgreSQL/Valkey:
msg.nodeididentities against every shard manifest: complete collection, no duplicates, omissions or skipped cases.Earlier runs deliberately reproduced four DeliveryTarget failures, then exposed and fixed migration classification/test cache-projection assumptions. No security assertions, unknown-table refusals or immutable-journal guards were removed to make tests pass.
Integration and review
Includes the existing PR #99 dependency at
c49cf90, without modifying its branch. Main4c466717is integrated, preserving the exact test-identity gate and all #113 tool/Git/maintenance fences. The only worker overlap was resolved by retaining every latest-main byte outside the existing mail changes, verified by Git blob hash. Main CI is unchanged; temporary source-export workflows are absent from the final tree.Codex reported no major issues for
8aa0e12; the initial security review covered5f8b02b. A further review was requested for merge head4ef3548; it is not represented as completed unless the bot records completion. Copilot could not review because the requester reached its quota.Remaining acceptance
No production deployment, money movement or credential-policy update was performed. Existing signed authority ceilings require explicit review for new operations. Full case/evidence/panel/quorum/appeal/deadline arbitration and complete recovery/doctor/selftest remain under #75. The full organization/Topic/certificate/ShareLink/restoration/attachment matrix remains under #76; unsupported ShareGrant constraints still fail closed. General default-projection/null digest normalization is unchanged. Larger packages, secret/service goods, order-inbox reference projection and deployed official fixture initialization remain outside this #74 slice.