Repository navigation
integrate: preserve recovery quarantine with cache and single-mailbox safeguards - #118
Conversation
…ve temporary transfer files
… worker and backup repairs
…s without promotion
…restored quarantine
Share a strict addr-spec validator between market recipient binding and the SMTP boundary. Revalidate legacy jobs before opening a connection and explicitly pin a singleton envelope recipient. Preserve SMTPUTF8, quoted comma local parts, current buyer/endpoint generation checks and uncertain semantics. 127 local regressions passed (Python 3.13.5; stdlib SMTP parser/serializer with a recording transport, no external sends). Before fix: 73 failed, 54 passed. Update versioned security rule and _index. Refs #81, #85.
CI36401618834 correctly rejected the initial msg.security shard at 233 tokens (>200). Compress prose while retaining root/secret isolation, release-owned rules, EffectJob-only mail state, explicit buyer acceptance and single-mailbox SMTP binding. Do not change the tokenizer, token budget or test assertions. Production source and all 127 mailbox regressions are unchanged; local tests still pass. Final-head full CI remains required. Refs #81, #85.
…box guards Preserve #112/#116 production source and #115/#117 disjoint changes, retaining both histories. Resolve the two exact failures from #116 CI36401032045 without changing production safety or CI gates: retain real market evidence/ACL checks before backup, verify restored bytes and immutable business rows offline while all external reads remain quarantined; assert the actual OS-admin-before-console rejection based on real uid rather than an incorrect root-only test assumption. No quarantine bypass, test removal, arbitrary-error assertion, budget increase, DDL, production action or external delivery. Local syntax checked; target full matrix and artifacts required for this exact combined tree. Refs #64, #65, #68, #69, #70, #81, #83, #84, #85. Does not close field or umbrella acceptance.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Exact-head CI36403033365 passed. Independently verified four SHA-256 artifacts and disjoint real JUnit IDs: 1469 core + 8 conformance, no failures/errors/skips, wheel/sdist present. Preserve original token budget and all published operation semantics. Retain commit ancestry for serial #118 recovery integration. Refs #81, #85; no production or full-acceptance claim.
|
最终组合核验完成：head 最新Codex security review已覆盖精确905712a且completed，0 review threads；Copilot配额未完成不算批准。当前#117已保留历史合入main072776fa；GitHub合并预览edcdbbd4的双父为072776fa/905712a，tree仍为上述已验证tree，非用旧分支绿灯覆盖新main。 将用固定head merge保留#112/#116历史。未放宽生产quarantine、OS-admin/物理控制台门槛、token预算或CI断言。#69完整现行政策重放及promotion、#64/#65/#84生产证据和#70真实控制台批准仍未完成，不关闭总体验收，也没有生产部署/资金/恢复/外发。 |
Serial integration, not blanket completion
Refs #64, #65, #68, #69, #70, #81, #83, #84, #85. Incorporates reviewed #112/#116 and #115/#117, retaining their histories. Main at preparation:
eb67b5a3976fd520668a2b302b74df62cf207667.Exact parents:
1e66532c450c0dad0233a956f3b9a713c1783f16: merged fix: revalidate compact cache projections across six real read clients #115 cache guard + current fix: prevent mailbox parsing from expanding delivery recipients #117 singleton SMTP target/rule-budget fix.c97a5286c029aae298d66aa4c6390497f053e4c8: fix: recovery evidence, persistent restore quarantine and root rotation integrity (#68–70) #112 recovery containment + Task A: custody challenge binding, Root rotation locking and pinned deny-only recovery replay #116 task-A hardening.Both descend from
67401759...; their changed file sets are disjoint. The combined tree overlays only the ten current cache/mail blobs onto A's tree, then changes two integration tests. No collaborator ref was changed or force-pushed.Head
905712a73f74d0a87956d781b717e757cf124d0b, tree1a8a28f467183ccab029625b0524ae5c5b7f115f.Exact CI failures repaired, no production bypass
#116 full target CI36401032045 failed two tests in shard1. Artifact10960732603 ZIP SHA-256
97f8cbfb93d3eb9094473846d950f3fb20b22cdfb5bd8298f191adfebc726749was downloaded and its real JUnit failures read.recovery_quarantined, writes exactwrites_paused, worker cannot claim, and all state remains unchanged.Preserved guarantees
Persistent quarantine, deny-only independently pinned replay, separate online/backup key retirement, Root journal locking/history checks, exact current cache authorization and singleton SMTP envelope remain. Original @1/@2/@3 operations, money semantics and full CI/node-ID/token-budget gates unchanged. No DDL or new promotion operation.
#69 complete current ACL/TopicBan/policy replay and controlled promotion remain unfinished. #64/#65/#84 real deployment/old-data/independent current checkpoint/capacity and #70 real console/CA approvals are not supplied and remain blocked. No production deployment, Root/PIN/keys/funds, restore/delete or external mail/webhook.
Required evidence before merge
Fresh exact-head Python3.15/PG16/Valkey9 four-shard CI, real node-ID disjointness/completeness, conformance, wheel/sdist, recovery workflow and review. Local only syntax checked for these two test edits; A's reported 58 local tests and #117's 127 units are not a substitute. #117 should pass and be serially integrated first; do not merge based on older branch success.