fix: reject indeterminate gateway network authority - #14
Draft
seonghobae wants to merge 84 commits into
Draft
Conversation
📝 WalkthroughWalkthroughGeneric 및 migration 설정이 0번 포트와 효과적 소켓 권한 중첩을 거부하도록 변경되었습니다. 중첩 판정은 공유 함수로 통합되었습니다. 관련 계약 문서, ADR, 제품 기준선, 변경 이력, 회귀 테스트를 갱신했습니다. Changes소켓 권한 검증
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GatewayConfig
participant edge_contract
participant UpstreamConfig
participant MigrationAdmin
GatewayConfig->>edge_contract: 리스너와 메트릭 권한 검증
edge_contract-->>GatewayConfig: ListenerCollision 또는 성공
GatewayConfig->>UpstreamConfig: 업스트림 포트 검증
UpstreamConfig-->>GatewayConfig: ZeroUpstreamPort 또는 성공
MigrationAdmin->>edge_contract: 리스너와 메트릭 권한 중첩 검사
MigrationAdmin-->>MigrationAdmin: ZeroTransportAuthorityPort 우선 반환
Merge Risk: 🟡 Moderate · up to This change hardens listener admission, but some IPv4-mapped IPv6 wildcard collisions can still be accepted and IPv6 regression fixtures may not reach the intended validation path. Resolve these cases before merge to ensure conflicting listener configurations are rejected reliably. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
seonghobae
changed the title
seonghobae
added
bug
ChatGPT Codex Connector
This was referenced Sep 2, 2026
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a48b03f20715b6e708cb26648d16b954ba57be24'
head='1b0848d4e745b78072af5f499d5fd0626439e024'
merge='bc00010494276b826c62476e55954e8f81d0f806'
prior_child='c4a71b866ca4fe3e62a125174473f1a18a7b2e9d'
echo '== Exact topology =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s%nbody=%b' "$head"
echo '== Exact range commits =='
git log --format='%H %P %s' --reverse "$base..$head"
echo '== Exact range paths =='
git diff --name-status "$base...$head"
echo '== Whitespace check =='
git diff --check "$base...$head"
echo '== Claimed succession ancestry =='
for commit in "$base" "$prior_child" "$merge"; do
printf '%s: ' "$commit"
if git cat-file -e "${commit}^{commit}" 2>/dev/null &&
git merge-base --is-ancestor "$commit" "$head"; then
echo ancestor
else
echo not-ancestor-or-unavailable
fi
done
echo '== Movement after merge =='
git log --format='%H %P %s' "$merge..$head"
git diff --name-status "$merge..$head"
git diff --no-ext-diff --unified=120 "$merge..$head" -- docs/product-technical-gap-baseline.md
echo '== Merge topology and parent contributions =='
git show -s --format='merge=%H%nparents=%P%nsubject=%s' "$merge"
mapfile -t parents < <(git show -s --format='%P' "$merge")
for i in "${!parents[@]}"; do
echo "-- parent[$i] ${parents[$i]} -> merge --"
git diff --name-status "${parents[$i]}..$merge"
done
git show --cc --no-ext-diff --format=fuller --unified=100 "$merge" -- \
tests/pg_erd_admin_config_contract.rs
echo '== Dependency boundary and Peer usage =='
rg -n -C 5 '^\s*pingora\s*=|^\s*pingora-core\s*=|^\s*pingora_core\s*=' Cargo.toml
rg -n -C 12 --glob '*.rs' \
'use pingora(_core)?::upstreams::peer::Peer|\bPeer\b|\.address\(\)' \
tests src
echo '== Relevant test structure and collision cases =='
ast-grep outline tests/pg_erd_admin_config_contract.rs --items all --view expanded
rg -n -C 12 \
'mapped|wildcard|ffff|ListenerCollision|listener_authorities|Peer::|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs
echo '-- First-parent vs exact-head pg-erd test delta --'
first_parent="${parents[0]}"
git diff --no-ext-diff --unified=120 "$first_parent..$head" -- \
tests/pg_erd_admin_config_contract.rs
echo '== Current baseline assertions and exact diff =='
git diff --no-ext-diff --unified=140 "$base...$head" -- \
docs/product-technical-gap-baseline.md
rg -n -i -C 8 \
'a48b03f|bc000104|1b0848d|c4a71b|pingora_core|pingora::upstreams::peer::Peer|E0433|E0599|compiler|RED|repair|restack|mapped|wildcard|pg-erd|regression' \
docs/product-technical-gap-baseline.md
echo '== Current authority implementation is unchanged from merge =='
for file in src/edge_contract.rs src/migration_admin.rs tests/listener_authority_contract.rs; do
printf '%s: ' "$file"
if git diff --quiet "$merge" "$head" -- "$file"; then
echo identical
else
echo changed
fi
doneLength of output: 35900 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a48b03f20715b6e708cb26648d16b954ba57be24'
head='1b0848d4e745b78072af5f499d5fd0626439e024'
merge='bc00010494276b826c62476e55954e8f81d0f806'
first_parent='c4a71b866ca4fe3e62a125174473f1a18a7b2e9d'
echo '== Declared dependency and current import =='
rg -n -C 4 '^\s*pingora\s*=|^\s*pingora-core\s*=|^\s*pingora_core\s*=' Cargo.toml
rg -n -C 10 --glob '*.rs' \
'use pingora(_core)?::upstreams::peer::Peer|\bPeer::|\bPeer\b|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs
echo '== Repair parent patch =='
git show --no-ext-diff --format=fuller --unified=80 "$base" -- \
tests/pg_erd_admin_config_contract.rs Cargo.toml
echo '== Merge effect on pg-erd regression table =='
git diff --no-ext-diff --unified=160 "$first_parent..$merge" -- \
tests/pg_erd_admin_config_contract.rs
echo '== Current pg-erd regression cases =='
sed -n '1,280p' tests/pg_erd_admin_config_contract.rs
echo '== Historical bounded regression commit =='
git show --no-ext-diff --format=fuller --unified=100 \
34e6df99c46369303a30dbc0da80c77833a8fa77 -- \
tests/pg_erd_admin_config_contract.rs
git show --no-ext-diff --format=fuller --unified=100 \
22197d020027819fd30611a8e1716a18bb840f77 -- \
tests/pg_erd_admin_config_contract.rs
echo '== Exact head changes after merge =='
git diff --no-ext-diff --unified=120 "$merge..$head" -- \
docs/product-technical-gap-baseline.md
echo '== Baseline current compiler-repair claims =='
rg -n -C 12 \
'c4a71b|a48b03f|bc000104|1b0848d|pingora_core|pingora::upstreams::peer::Peer|E0433|E0599|hosted|GREEN|reacquire' \
docs/product-technical-gap-baseline.md
echo '== Verify authority and workflow paths did not change after merge =='
for path in \
src/edge_contract.rs \
src/migration_admin.rs \
tests/listener_authority_contract.rs \
.github/workflows/ci.yml \
.github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs \
tests/supply_chain_evidence_workflow_contract.rs
do
if git diff --quiet "$merge" "$head" -- "$path"; then
printf 'identical %s\n' "$path"
else
printf 'changed %s\n' "$path"
fi
doneLength of output: 81939
I found one actionable issue. Medium — Restore the six pg-erd mapped-wildcard regression cases. use pingora::upstreams::peer::Peer;
However, merge
The shared implementation remains unchanged. The generic tests still cover the rule. The bounded pg-erd configuration path no longer covers these alias cases through Restore the six cases while retaining The requested base is the exact merge base. The requested head has This is a static source review. I did not transfer predecessor review or hosted execution credit. Exact-head compilation, tests, formatting, Clippy, rustdoc, coverage, OCI, load, and supply-chain evidence remain required. ✏️ Learnings added
You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Fresh exact-head review required after source and baseline movement. Review exact current range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a48b03f20715b6e708cb26648d16b954ba57be24'
head='1b0848d4e745b78072af5f499d5fd0626439e024'
merge='bc00010494276b826c62476e55954e8f81d0f806'
prior_child='c4a71b866ca4fe3e62a125174473f1a18a7b2e9d'
echo '== Exact topology and post-merge movement =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git log --format='%H %P %s' --reverse "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Required ancestry =='
for commit in "$base" "$prior_child" "$merge"; do
printf '%s: ' "$commit"
if git cat-file -e "${commit}^{commit}" 2>/dev/null &&
git merge-base --is-ancestor "$commit" "$head"; then
echo ancestor
else
echo not-ancestor-or-unavailable
fi
done
echo '== Movement after adoption merge =='
git log --format='%H %P %s' "$merge..$head"
git diff --name-status "$merge..$head"
git diff --no-ext-diff --unified=120 "$merge..$head" -- docs/product-technical-gap-baseline.md
echo '== Adoption merge contributions and resolution =='
git show -s --format='merge=%H%nparents=%P%nsubject=%s' "$merge"
mapfile -t parents < <(git show -s --format='%P' "$merge")
for i in "${!parents[@]}"; do
echo "-- parent[$i] ${parents[$i]} -> merge --"
git diff --name-status "${parents[$i]}..$merge"
done
git show --cc --no-ext-diff --unified=160 "$merge" -- tests/pg_erd_admin_config_contract.rs
echo '== Declared dependency and Peer import/use =='
rg -n -C 5 '^\s*pingora\s*=|^\s*pingora[-_]core\s*=' Cargo.toml
rg -n -C 10 --glob '*.rs' \
'use pingora(_core)?::upstreams::peer::Peer|\bPeer\b|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs src tests
echo '== pg-erd regression table and first-parent comparison =='
ast-grep outline tests/pg_erd_admin_config_contract.rs --items all --view expanded
rg -n -C 12 'mapped|wildcard|ffff|ListenerCollision|Peer::|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs
git diff --no-ext-diff --unified=180 "${parents[0]}..$merge" -- \
tests/pg_erd_admin_config_contract.rs
git diff --no-ext-diff --unified=180 "${parents[0]}..$head" -- \
tests/pg_erd_admin_config_contract.rs
echo '== Child authority and workflow-evidence tree preservation =='
for path in \
src/edge_contract.rs src/migration_admin.rs \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs tests/supply_chain_evidence_workflow_contract.rs \
API_CONFIG_CONTRACT.md CHANGELOG.md \
docs/adr/0008-bounded-pg-erd-admin-activation.md \
docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md
do
if git diff --quiet "${parents[0]}" "$merge" -- "$path"; then
printf 'identical %s\n' "$path"
else
printf 'changed %s\n' "$path"
fi
done
echo '== Current authority and evidence controls =='
rg -n -A70 -B12 --glob '*.rs' \
'socket_authorities_overlap|validate_transport_authority|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|ListenerCollision' \
src tests
rg -n -C 10 \
'test -s k6-summary\.json|candidate-evidence|candidate-failure-diagnostics|Bind candidate evidence|Upload exact candidate evidence|Upload candidate failure diagnostics|if-no-files-found' \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs tests/supply_chain_evidence_workflow_contract.rs
echo '== Baseline repair claims at exact head =='
rg -n -i -C 10 \
'a48b03f|bc000104|1b0848d|c4a71b|pingora_core|pingora::upstreams::peer::Peer|E0433|E0599|compiler|RED|repair|restack|mapped|wildcard|pg-erd|regression|hosted' \
docs/product-technical-gap-baseline.mdLength of output: 36693 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='a48b03f20715b6e708cb26648d16b954ba57be24'
head='1b0848d4e745b78072af5f499d5fd0626439e024'
merge='bc00010494276b826c62476e55954e8f81d0f806'
first_parent='c4a71b866ca4fe3e62a125174473f1a18a7b2e9d'
second_parent='a48b03f20715b6e708cb26648d16b954ba57be24'
echo '== Merge parent contributions and resolution =='
git diff --name-status "$first_parent..$merge"
git diff --no-ext-diff --unified=180 "$first_parent..$merge" -- \
tests/pg_erd_admin_config_contract.rs
git diff --name-status "$second_parent..$merge"
git show --cc --no-ext-diff --format=fuller --unified=180 "$merge" -- \
tests/pg_erd_admin_config_contract.rs
echo '== Dependency boundary and current Peer usage =='
rg -n -C 5 '^\s*pingora\s*=|^\s*pingora[-_]core\s*=' Cargo.toml
rg -n -C 12 --glob '*.rs' \
'use pingora(_core)?::upstreams::peer::Peer|\bPeer\b|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs src tests
echo '== Exact current pg-erd listener collision cases =='
ast-grep outline tests/pg_erd_admin_config_contract.rs --items all --view expanded
sed -n '1,300p' tests/pg_erd_admin_config_contract.rs
rg -n -C 15 'mapped|wildcard|ffff|ListenerCollision|Peer::|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs
echo '== Historical expected bounded regression changes =='
for commit in \
34e6df99c46369303a30dbc0da80c77833a8fa77 \
22197d020027819fd30611a8e1716a18bb840f77
do
echo "== $commit =="
git show --no-ext-diff --format=fuller --unified=120 "$commit" -- \
tests/pg_erd_admin_config_contract.rs
done
echo '== Child tree preservation at adoption merge =='
for path in \
src/edge_contract.rs src/migration_admin.rs \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs tests/supply_chain_evidence_workflow_contract.rs \
API_CONFIG_CONTRACT.md CHANGELOG.md \
docs/adr/0008-bounded-pg-erd-admin-activation.md \
docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md
do
if git diff --quiet "$first_parent" "$merge" -- "$path"; then
printf 'identical %s\n' "$path"
else
printf 'changed %s\n' "$path"
fi
done
echo '== Current authority and workflow-evidence controls =='
rg -n -A75 -B15 --glob '*.rs' \
'socket_authorities_overlap|validate_transport_authority|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|ListenerCollision' \
src tests
rg -n -C 12 \
'test -s k6-summary\.json|candidate-evidence|candidate-failure-diagnostics|Bind candidate evidence|Upload exact candidate evidence|Upload candidate failure diagnostics|if-no-files-found' \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs tests/supply_chain_evidence_workflow_contract.rs
echo '== Baseline code-current repair claims =='
rg -n -i -C 12 \
'a48b03f|bc000104|1b0848d|c4a71b|pingora_core|pingora::upstreams::peer::Peer|E0433|E0599|compiler|RED|repair|restack|mapped|wildcard|pg-erd|regression|hosted' \
docs/product-technical-gap-baseline.mdLength of output: 162954
Medium — Restore the bounded mapped-wildcard regression cases.
use pingora::upstreams::peer::Peer;
However, the same merge removes six cases from
Restore the six cases while keeping the The requested base is the exact merge base. The requested head is 66 commits ahead of the base. The shared authority predicate, generic and migration error ordering, and workflow-evidence controls remain unchanged. Hosted exact-head execution remains a separate gate. 🧠 Learnings usedYou are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Review exact current repair |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='1b0848d4e745b78072af5f499d5fd0626439e024'
head='6002b7d35b48caeb808f210e34d057236ed2eaa5'
historical_child='c4a71b866ca4fe3e62a125174473f1a18a7b2e9d'
echo '== Exact topology and scope =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s%nbody=%b' "$head"
git log --format='%H %P %s' --reverse "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Exact repair diff =='
git diff --no-ext-diff --unified=180 "$base...$head" -- \
tests/pg_erd_admin_config_contract.rs \
Cargo.toml \
src \
.github/workflows \
Dockerfile \
docs
echo '== Dependency boundary and current Peer import/use =='
rg -n -C 6 '^\s*pingora\s*=|^\s*pingora[-_]core\s*=' Cargo.toml
rg -n -C 14 --glob '*.rs' \
'use pingora(_core)?::upstreams::peer::Peer|\bPeer\b|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs src tests
echo '== Current pg-erd collision regression table =='
ast-grep outline tests/pg_erd_admin_config_contract.rs --items all --view expanded
sed -n '1,320p' tests/pg_erd_admin_config_contract.rs
rg -n -C 16 \
'mapped|wildcard|ffff|ListenerCollision|listener_authorities|Peer::|\.address\(\)' \
tests/pg_erd_admin_config_contract.rs
echo '== Historical-child comparison for restored cases =='
git diff --no-ext-diff --unified=180 "$historical_child..$head" -- \
tests/pg_erd_admin_config_contract.rs
for commit in \
34e6df99c46369303a30dbc0da80c77833a8fa77 \
22197d020027819fd30611a8e1716a18bb840f77
do
if git cat-file -e "${commit}^{commit}" 2>/dev/null; then
echo "== Historical case commit $commit =="
git show --no-ext-diff --format=fuller --unified=140 "$commit" -- \
tests/pg_erd_admin_config_contract.rs
fi
done
echo '== Production, authority, and workflow invariance =='
for path in \
src/edge_contract.rs \
src/migration_admin.rs \
src/migration_delivery.rs \
src/bin/cwl-pingora-gateway.rs \
src/bin/cwl-pingora-pg-erd-migration.rs \
.github/workflows/ci.yml \
.github/workflows/supply-chain.yml \
tests/load_evidence_workflow_contract.rs \
tests/supply_chain_evidence_workflow_contract.rs \
docs/product-technical-gap-baseline.md
do
printf '%s: ' "$path"
if git diff --quiet "$base" "$head" -- "$path"; then
echo identical
else
echo changed
git diff --no-ext-diff --unified=80 "$base...$head" -- "$path"
fi
done
echo '== Exact-head shared predicate and validation ordering =='
rg -n -A90 -B18 --glob '*.rs' \
'socket_authorities_overlap|validate_transport_authority|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|ListenerCollision' \
src testsLength of output: 131032
I found no new actionable issues.
This is a static source review. Exact-head compilation, tests, formatting, Clippy, rustdoc, coverage, OCI, load, and supply-chain validation remain separate hosted gates. I did not transfer predecessor review or hosted-execution credit. 🧠 Learnings usedIf you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='691ae67a96bc2e43bf48a348daf231968b0165e2'
head='40424d4d8f79c505f7e91588741937bb23ac9541'
adoption='8b7b170d5eef2d5dbe4241957a4684ab5faa9dc9'
repair='dbf872e8f70d3973dc3499cfb26a3c4ff508c2ae'
echo '== Exact topology and range =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s%nbody=%b' "$head"
git log --format='%H %P %s' --reverse "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Required ancestry and post-adoption movement =='
for commit in "$base" "$adoption" "$repair"; do
printf '%s: ' "$commit"
if git cat-file -e "${commit}^{commit}" 2>/dev/null &&
git merge-base --is-ancestor "$commit" "$head"; then
echo ancestor
else
echo not-ancestor-or-unavailable
fi
done
git log --format='%H %P %s' "$adoption..$head"
git diff --name-status "$adoption..$head"
git diff --no-ext-diff --unified=120 "$adoption..$head"
echo '== Parent adoption topology and merge resolution =='
git show -s --format='adoption=%H%nparents=%P%nsubject=%s' "$adoption"
mapfile -t parents < <(git show -s --format='%P' "$adoption")
for i in "${!parents[@]}"; do
echo "-- parent[$i] ${parents[$i]} to adoption --"
git diff --name-status "${parents[$i]}..$adoption"
done
git show --cc --no-ext-diff --format=fuller --unified=140 "$adoption"
echo '== Candidate file structure =='
for file in \
src/edge_contract.rs src/migration_admin.rs \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
tests/pg_erd_production_path.rs
do
if test -f "$file"; then
echo "== $file =="
ast-grep outline "$file" --items all --view expanded || true
fi
done
echo '== Route priority, authority, and listener regression controls =='
rg -n -C 12 --glob '*.rs' \
'priority|route|sort_by|sort_by_key|socket_authorities_overlap|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|ListenerCollision|mapped|wildcard|ffff' \
src tests
echo '== Packaging, locked builds, load, and security controls =='
for file in Dockerfile .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
if test -f "$file"; then
echo "== $file =="
rg -n -C 12 \
'CWL_GATEWAY_BIN|cargo build|--locked|--release|COPY|ENTRYPOINT|cwl-pingora-gateway|cwl-pingora-pg-erd-migration|k6|p95|threshold|vus|iterations|trivy|cargo deny|read-only|cap-drop|no-new-privileges|user' \
"$file" || true
fi
done
echo '== Current baseline projection and exact delta =='
if test -f docs/product-technical-gap-baseline.md; then
git diff --no-ext-diff --unified=160 "$base...$head" -- docs/product-technical-gap-baseline.md
rg -n -i -C 10 \
'40424d|691ae|8b7b170|dbf872e|route|priority|mapped|wildcard|one.binary|Docker|locked|load|p95|security|authority|hosted|compiler|reproduc' \
docs/product-technical-gap-baseline.md
fi
echo '== Invariant path comparisons: adoption to exact head =='
for file in \
src/edge_contract.rs src/migration_admin.rs \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
Dockerfile .github/workflows/ci.yml .github/workflows/supply-chain.yml \
Cargo.toml
do
printf '%s: ' "$file"
if git diff --quiet "$adoption" "$head" -- "$file"; then
echo identical
else
echo changed
git diff --no-ext-diff --stat "$adoption..$head" -- "$file"
fi
done
echo '== Reproducibility repair content =='
git show --no-ext-diff --format=fuller --unified=140 "$repair"Length of output: 43168 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='691ae67a96bc2e43bf48a348daf231968b0165e2'
head='40424d4d8f79c505f7e91588741937bb23ac9541'
adoption='8b7b170d5eef2d5dbe4241957a4684ab5faa9dc9'
child_parent='6002b7d35b48caeb808f210e34d057236ed2eaa5'
parent_root='691ae67a96bc2e43bf48a348daf231968b0165e2'
repair='dbf872e8f70d3973dc3499cfb26a3c4ff508c2ae'
echo '== Adoption merge parent deltas and resolution =='
echo '-- child first parent to adoption --'
git diff --name-status "$child_parent..$adoption"
git diff --no-ext-diff --unified=160 "$child_parent..$adoption"
echo '-- repaired parent to adoption --'
git diff --name-status "$parent_root..$adoption"
git show --cc --no-ext-diff --format=fuller --unified=160 "$adoption"
echo '== Exact head current source controls =='
for file in \
src/edge_routing.rs \
src/edge_contract.rs \
src/migration_admin.rs \
tests/listener_authority_contract.rs \
tests/pg_erd_admin_config_contract.rs \
tests/reproducibility_contract.rs
do
if test -f "$file"; then
echo "== $file =="
ast-grep outline "$file" --items all --view expanded || true
fi
done
rg -n -C 16 --glob '*.rs' \
'sort_by|sort_by_key|Reverse\(route\.priority\)|priority|duplicate.*priority|socket_authorities_overlap|mapped|wildcard|ffff|ListenerCollision|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort' \
src tests
echo '== Exact listener regression table =='
if test -f tests/pg_erd_admin_config_contract.rs; then
sed -n '60,190p' tests/pg_erd_admin_config_contract.rs
fi
if test -f tests/listener_authority_contract.rs; then
cat -n tests/listener_authority_contract.rs
fi
echo '== Docker packaging and locked release-build contract =='
cat -n Dockerfile
cat -n tests/reproducibility_contract.rs
rg -n -C 12 \
'CWL_GATEWAY_BIN|cargo build|--locked|--release|--bin|COPY|ENTRYPOINT|cwl-pingora-gateway|cwl-pingora-pg-erd-migration' \
Dockerfile tests/reproducibility_contract.rs Cargo.toml
echo '== Workflow load and security thresholds =='
for file in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "== $file =="
rg -n -C 14 \
'k6|summary|p95|threshold|vus|iterations|requests|cargo test|cargo clippy|--locked|trivy|HIGH|CRITICAL|read-only|cap-drop|no-new-privileges|CWL_GATEWAY_BIN' \
"$file"
done
echo '== Authority-boundary changes after adoption =='
git diff --no-ext-diff --unified=100 "$adoption..$head" -- \
src Dockerfile .github/workflows \
tests/listener_authority_contract.rs \
tests/pg_erd_admin_config_contract.rs \
tests/load_evidence_workflow_contract.rs \
tests/supply_chain_evidence_workflow_contract.rs \
tests/reproducibility_contract.rs
echo '== Baseline claims at requested head =='
git diff --no-ext-diff --unified=180 "$base...$head" -- \
docs/product-technical-gap-baseline.md
rg -n -i -C 10 \
'40424d|691ae|8b7b170|dbf872e|sort_by_key|descending|priority|mapped|wildcard|one fixed|one.binary|CWL_GATEWAY_BIN|locked|load|20 ms|p95|security|authority|hosted|reproduc' \
docs/product-technical-gap-baseline.md
echo '== Scope after adoption =='
git diff --name-status "$adoption..$head"
git diff --check "$base...$head" || true
echo '== Test-only repair commit =='
git show --no-ext-diff --format=fuller --unified=120 "$repair" -- \
tests/reproducibility_contract.rs Dockerfile .github/workflows/ci.ymlLength of output: 174120
I found no new actionable issues.
The network-authority behavior remains intact.
The OCI and workflow controls remain intact.
This was a static review. I did not transfer predecessor review or hosted-execution credit. Exact-head formatting, compilation, tests, Clippy, rustdoc, coverage, load, OCI, and supply-chain validation remain required. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Please review the exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3ccf192e8d20a9b05b2a323bc2fffc636aadbb0c'
head='24990d380eb157a9954a8aead1c95f0fcf421025'
echo '== Exact topology and range =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s%nbody=%b' "$head"
echo '-- commits --'
git log --format='%H %P %s' --reverse "$base..$head"
echo '-- changed paths --'
git diff --name-status "$base...$head"
echo '-- whitespace --'
git diff --check "$base...$head"
echo '== Locate candidate source, tests, and baseline =='
fd -HI -t f . | rg -i \
'(^|/)(edge_contract|migration|delivery|routing|.*runtime.*|.*forward.*|.*listener.*|.*coverage.*|.*flush.*|.*graceful.*|product-technical-gap-baseline)\.(rs|md)$' | sort
echo '== Rust structure map =='
ast-grep outline src --items all --view expanded || true
for file in $(fd -HI -t f -e rs . | rg '(tests/|src/).*(migration|listener|runtime|forward|coverage|flush|graceful).*\.rs$' | sort); do
echo "== $file =="
ast-grep outline "$file" --items all --view expanded || true
done
echo '== Exact changed implementation and test diff =='
git diff --no-ext-diff --unified=120 "$base...$head" -- \
src tests docs/product-technical-gap-baseline.md \
API_CONFIG_CONTRACT.md CHANGELOG.md \
docs/adr docs/doctoring
echo '== Focused current symbols and call paths =='
rg -n -C 12 --glob '*.rs' \
'flush|graceful|shutdown|child|PgErdMigrationConfig|socket_authorities_overlap|ListenerCollision|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|RuntimeIsolationLimits|RequestAdmissionBudget|RequestBodyBudget|forwarded|x-forwarded|Forwarded|header|Header|invalid' \
src tests
echo '== Current contract tests for focus areas =='
for file in $(fd -HI -t f -e rs tests | rg -i '(migration|listener|runtime|forward|coverage|flush|graceful).*\.rs$' | sort); do
echo "== $file =="
cat -n "$file"
done
echo '== Code-current baseline =='
if test -f docs/product-technical-gap-baseline.md; then
echo '-- baseline diff --'
git diff --no-ext-diff --unified=160 "$base...$head" -- docs/product-technical-gap-baseline.md
echo '-- relevant current claims --'
rg -n -i -C 10 \
'24990d|3ccf192|coverage|flush|graceful|child|listener|mapped|wildcard|runtime.limit|in.flight|keepalive|forward|header|hosted|RED|repair' \
docs/product-technical-gap-baseline.md
fi
echo '== Activation and shutdown paths =='
rg -n -C 14 --glob '*.rs' \
'add_tcp|run_forever|run\(|shutdown|graceful|join|wait|flush|GatewayProxy|Migration' \
srcLength of output: 203144 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3ccf192e8d20a9b05b2a323bc2fffc636aadbb0c'
head='24990d380eb157a9954a8aead1c95f0fcf421025'
echo '== Compact topology and changed paths =='
git merge-base "$base" "$head"
git rev-list --left-right --count "$base...$head"
git log --format='%H %s' --reverse "$base..$head"
git diff --name-status "$base...$head"
echo '== Individual repair commits =='
for commit in \
2d2226aed33d393ae71c3fd7cd095430c761d7f4 \
a78830cbfd10fb148e3a7983c226beb0f92f492d \
8b5bceed36bb2a9653627bdfe9113fbd4ec39020 \
a3b29e462180dc38cba6509a182521519b8c51da
do
echo "== $commit =="
git show --no-ext-diff --format='%H%n%s%n%b' --stat "$commit"
git show --no-ext-diff --format= --unified=120 "$commit"
done
echo '== Exact-head changed files =='
while IFS= read -r file; do
echo "== $file =="
cat -n "$file"
done < <(git diff --name-only "$base...$head" | sort)
echo '== Authority predicate and its full contract table =='
rg -n -A100 -B20 --glob '*.rs' \
'fn socket_authorities_overlap|enum .*Authority|canonical|to_ipv4_mapped|is_unspecified|ListenerCollision' \
src/edge_contract.rs tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs
echo '== Runtime isolation constructors and all uses =='
rg -n -A65 -B15 --glob '*.rs' \
'fn try_new|fn from_validated|RuntimeIsolationLimits::try_new|RuntimeIsolationLimits::from_validated' \
src tests
echo '== Full forwarding policy and tests =='
ast-grep outline src/forwarding_policy.rs --items all --view expanded
sed -n '1,320p' src/forwarding_policy.rs
for file in $(fd -HI -t f -e rs tests | rg -i 'forward.*\.rs$' | sort); do
echo "== $file =="
cat -n "$file"
done
echo '== pg-erd process teardown code =='
rg -n -A90 -B30 'struct GatewayProcess|impl Drop|kill\(|SIGTERM|terminate|wait\(' \
tests/pg_erd_production_path.rs
echo '== Diffs and check of baseline claims post-repair =='
git diff --check "$base...$head"
rg -n -C 6 -i \
'2d2226a|a78830c|8b5bcee|a3b29e4|graceful|flush|canonical|from_validated|invalid.host|forward' \
docs/product-technical-gap-baseline.mdLength of output: 37720
I found no new actionable issues.
The pg-erd coverage repair is causally correct.
The listener-authority refactor preserves the effective authority matrix.
The runtime-limit construction remains fail-closed.
The forwarding-header repair preserves the failure boundary.
This was a static review. I did not transfer predecessor review or hosted-execution credit. Exact-head CI, LLVM coverage, load, OCI, security, and supply-chain evidence remain required. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Fresh exact-head review requested for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='69f22265cd88881b8e14cedb32defa0a91180aa2'
head='8937364909b82f50fd911aa001a8d073b517f5d9'
echo '== Exact topology and scope =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'ahead/behind: '; git rev-list --left-right --count "$base...$head"
git show -s --format='head=%H%nparents=%P%nsubject=%s%nbody=%b' "$head"
git log --format='%H %P %s' --reverse "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Merge commits and parent contributions in the exact range =='
while IFS= read -r merge; do
echo "-- merge $merge --"
git show -s --format='parents=%P%nsubject=%s' "$merge"
mapfile -t parents < <(git show -s --format='%P' "$merge")
for parent in "${parents[@]}"; do
echo "parent $parent -> merge:"
git diff --name-status "$parent..$merge"
done
git show --cc --no-ext-diff --format= --unified=80 "$merge"
done < <(git rev-list --merges "$base..$head")
echo '== Relevant source and test structure =='
for file in \
src/edge_contract.rs src/migration_admin.rs src/migration_delivery.rs \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
tests/deserialize_contract.rs tests/oci_workflow_contract.rs \
tests/supply_chain_evidence_workflow_contract.rs
do
if test -f "$file"; then
echo "== $file =="
ast-grep outline "$file" --items all --view expanded || true
fi
done
echo '== Authority normalization and direct-deserialization validation =='
rg -n -A95 -B18 --glob '*.rs' \
'socket_authorities_overlap|to_ipv4_mapped|canonical|Deserialize|deserialize|from_yaml|try_from|validate_transport_authority|ZeroTransportAuthorityPort|ZeroUpstreamPort|ZeroListenerPort|ZeroMetricsListenerPort|ListenerCollision' \
src tests
echo '== OCI and supply-chain evidence controls =='
for file in Dockerfile .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
if test -f "$file"; then
echo "== $file =="
rg -n -C 14 \
'CWL_GATEWAY_BIN|cargo build|--locked|--release|read-only|cap-drop|no-new-privileges|65532|pg-erd|candidate-evidence|candidate-failure-diagnostics|trivy|source_sha|local_image_id|if-no-files-found|upload-artifact' \
"$file"
fi
done
rg -n -C 12 --glob '*.rs' \
'candidate-evidence|candidate-failure-diagnostics|CWL_GATEWAY_BIN|read-only|cap-drop|no-new-privileges|trivy|source_sha|local_image_id|Deserialize|deserialize' \
tests
echo '== Exact implementation, workflow, test, and documentation diffs =='
git diff --no-ext-diff --unified=110 "$base...$head" -- \
src tests Dockerfile Cargo.toml \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
API_CONFIG_CONTRACT.md CHANGELOG.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md \
THREAT_MODEL.md TRD.md docs/adr docs/doctoring docs/product-technical-gap-baseline.md
echo '== Documentation alignment at head =='
for file in \
API_CONFIG_CONTRACT.md CHANGELOG.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md \
THREAT_MODEL.md TRD.md docs/product-technical-gap-baseline.md \
docs/doctoring/TRACEABILITY.md
do
if test -f "$file"; then
echo "== $file =="
rg -n -i -C 7 \
'deserialize|socket.authorit|mapped|wildcard|IPv4|IPv6|OCI|Docker|image|pg.erd|supply.chain|evidence|candidate|hosted|CI|Rust|authority|release|cutover' \
"$file" || true
fi
done
echo '== Current exact-head tests for focus areas =='
for file in $(fd -HI -t f -e rs tests | rg -i '(listener|pg.erd|deserialize|oci|supply.chain|workflow|contract).*\.rs$' | sort); do
echo "== $file =="
cat -n "$file"
doneLength of output: 16091 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/pingora-gateway'
echo '== CI run =='
gh run view 34163230667 --repo "$repo" --json \
databaseId,workflowName,displayTitle,headSha,headBranch,status,conclusion,event,createdAt,updatedAt,url,jobs
echo '== Supply Chain run =='
gh run view 34163230576 --repo "$repo" --json \
databaseId,workflowName,displayTitle,headSha,headBranch,status,conclusion,event,createdAt,updatedAt,url,jobsLength of output: 12206 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='69f22265cd88881b8e14cedb32defa0a91180aa2'
head='8937364909b82f50fd911aa001a8d073b517f5d9'
echo '== Merge topology in requested range =='
git rev-list --merges "$base..$head" > /tmp/range_merges.txt
cat /tmp/range_merges.txt
while IFS= read -r merge; do
test -n "$merge" || continue
echo "-- merge: $merge --"
git show -s --format='parents=%P%nsubject=%s' "$merge"
git show -s --format='%P' "$merge" | tr ' ' '\n' > /tmp/merge_parents.txt
while IFS= read -r parent; do
echo "parent $parent -> merge paths:"
git diff --name-status "$parent..$merge"
done < /tmp/merge_parents.txt
git show --cc --no-ext-diff --format= --unified=100 "$merge"
done < /tmp/range_merges.txt
echo '== Exact delta for latest adoption and repair commits =='
for commit in ca38e6c11b7d9a355e3e7ec777aa567f2b53f917 \
2c9e420478a5c36364808c5bfd2a231ebf76a276 \
bf7a69d1b7c0e8782c503cd7b0b483a759e19ed1 \
83a2c48efc5774d83f0f00aa1f305e02f20745ee \
8937364909b82f50fd911aa001a8d073b517f5d9
do
echo "-- $commit --"
git show --no-ext-diff --format='%H%n%s%n%b' --stat "$commit"
git show --no-ext-diff --format= --unified=140 "$commit"
done
echo '== Shared authority normalization and validation boundary =='
sed -n '1,380p' src/edge_contract.rs
sed -n '1,330p' src/migration_admin.rs
rg -n -C 14 --glob '*.rs' \
'socket_authorities_overlap|to_ipv4_mapped|Deserialize|deserialize|from_yaml|validate\(|try_new|from_validated|PgErdMigrationConfig' \
src tests
echo '== Relevant tests =='
for file in \
tests/listener_authority_contract.rs \
tests/pg_erd_admin_config_contract.rs \
tests/pg_erd_production_path.rs
do
if test -f "$file"; then
echo "-- $file --"
cat -n "$file"
fi
done
fd -HI -t f -e rs tests | rg -i 'deserialize|admin.*contract|listener.*contract|workflow.*contract|supply.*chain' > /tmp/relevant_tests.txt || true
while IFS= read -r file; do
test -n "$file" || continue
echo "-- $file --"
rg -n -C 10 'Deserialize|deserialize|from_yaml|socket_authorities_overlap|candidate-evidence|read-only|pg-erd' "$file" || true
done < /tmp/relevant_tests.txt
echo '== OCI and supply-chain workflows =='
cat -n Dockerfile
cat -n .github/workflows/ci.yml
cat -n .github/workflows/supply-chain.yml
echo '== Documentation updates and current claims =='
git diff --no-ext-diff --unified=120 "$base...$head" -- \
API_CONFIG_CONTRACT.md CHANGELOG.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md \
THREAT_MODEL.md TRD.md docs/adr/0008-bounded-pg-erd-admin-activation.md \
docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md
for file in \
API_CONFIG_CONTRACT.md CHANGELOG.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md \
THREAT_MODEL.md TRD.md docs/adr/0008-bounded-pg-erd-admin-activation.md \
docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md
do
if test -f "$file"; then
echo "-- $file --"
rg -n -i -C 6 \
'deserialize|socket.authorit|mapped|wildcard|OCI|image|pg.erd|supply.chain|evidence|candidate|hosted|adoption|release|cutover' \
"$file" || true
fi
doneLength of output: 203655 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='69f22265cd88881b8e14cedb32defa0a91180aa2'
head='8937364909b82f50fd911aa001a8d073b517f5d9'
merge='ca38e6c11b7d9a355e3e7ec777aa567f2b53f917'
echo '== Adoption parents and semantic-resolution paths =='
git show -s --format='merge=%H%nparents=%P%nsubject=%s' "$merge"
git show -s --format='%P' "$merge" | tr ' ' '\n' > /tmp/adoption_parents.txt
nl -ba /tmp/adoption_parents.txt
while IFS= read -r parent; do
echo "-- $parent -> adoption --"
git diff --name-status "$parent..$merge"
done < /tmp/adoption_parents.txt
git show --cc --no-ext-diff --format= --unified=100 "$merge" -- \
src/edge_contract.rs src/migration_admin.rs src/migration_proxy.rs \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/pg_erd_admin_config_contract.rs tests/pg_erd_production_path.rs
echo '== Exact source definitions and call paths =='
rg -n --glob '*.rs' \
'pub\(crate\) fn socket_authorities_overlap|fn canonical|to_ipv4_mapped|impl PgErdMigrationConfig|pub fn build_proxy|pub fn from_yaml|fn validate_transport_authority|RuntimeIsolationLimits::from_validated|RuntimeIsolationLimits::try_new' \
src tests
echo '-- edge contract authority implementation --'
line=$(rg -n --glob '*.rs' 'pub\(crate\) fn socket_authorities_overlap' src/edge_contract.rs | cut -d: -f1 | head -1)
sed -n "$((line-35)),$((line+105))p" src/edge_contract.rs
echo '-- migration Admin Config validation and activation --'
rg -n -A80 -B20 \
'impl PgErdMigrationConfig|pub fn from_yaml|pub fn build_proxy|fn validate_transport_authority' \
src/migration_admin.rs
echo '== Direct-Deserialize test and listener matrix assertions =='
rg -n -A95 -B15 \
'Deserialize|deserialize|build_proxy|mapped|wildcard|ListenerCollision|ZeroTransportAuthorityPort' \
tests/pg_erd_admin_config_contract.rs tests/listener_authority_contract.rs
echo '== CI OCI and load control flow =='
rg -n -A42 -B10 \
'Build admitted candidate images|Verify declared non-root identities|Exercise generic read-only|Exercise pg-erd read-only|measured|origin|k6|Require loopback latency summary|Upload loopback' \
.github/workflows/ci.yml
echo '== Supply Chain evidence control flow =='
rg -n -A58 -B12 \
'Build admitted candidate images|Generate SPDX|Scan exact generic|Scan exact pg-erd|Bind candidate evidence|Upload exact candidate|Stage candidate failure|Upload candidate failure|candidate-evidence|source_sha|local_image_id|if-no-files-found' \
.github/workflows/supply-chain.yml
echo '== Documentation statements about exact current head evidence =='
rg -n -i -C 3 \
'exact.current.head|exact-head|terminal GREEN|terminal success|pending|reacquire|34163230667|34163230576' \
docs/product-technical-gap-baseline.md TRD.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md CHANGELOG.md
echo '== Exact documents changed after final source behavior commits =='
git log --format='%H %s' --reverse 2c9e420478a5c36364808c5bfd2a231ebf76a276.."$head" -- \
docs/product-technical-gap-baseline.md TRD.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md CHANGELOG.mdLength of output: 3677 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='69f22265cd88881b8e14cedb32defa0a91180aa2'
head='8937364909b82f50fd911aa001a8d073b517f5d9'
merge='ca38e6c11b7d9a355e3e7ec777aa567f2b53f917'
child='3c3b53180e2231d81b3da1bc02ff5dcb62a08d6f'
echo '== Adoption tree preservation =='
for file in \
src/edge_contract.rs src/migration_admin.rs \
.github/workflows/ci.yml .github/workflows/supply-chain.yml \
tests/listener_authority_contract.rs tests/pg_erd_admin_config_contract.rs \
tests/load_evidence_workflow_contract.rs tests/supply_chain_evidence_workflow_contract.rs
do
printf '%s: ' "$file"
if git diff --quiet "$child" "$merge" -- "$file"; then
echo identical-to-child-parent
else
echo merge-resolution-change
git diff --no-ext-diff --unified=40 "$child..$merge" -- "$file"
fi
done
echo '== Latest focused commits =='
git show --no-ext-diff --format='%H %s' --stat 2c9e420478a5c36364808c5bfd2a231ebf76a276
git show --no-ext-diff --format= --unified=90 2c9e420478a5c36364808c5bfd2a231ebf76a276 -- src/migration_admin.rs tests
git show --no-ext-diff --format='%H %s' --stat bf7a69d1b7c0e8782c503cd7b0b483a759e19ed1
git show --no-ext-diff --format= --unified=90 bf7a69d1b7c0e8782c503cd7b0b483a759e19ed1 -- .github/workflows/ci.yml tests
echo '== Authority normalization =='
rg -n -A95 -B20 \
'socket_authorities_overlap|to_ipv4_mapped|enum Canonical|canonical' \
src/edge_contract.rs
echo '== Admin validation and public activation =='
rg -n -A100 -B20 \
'impl PgErdMigrationConfig|pub fn from_yaml|pub fn build_proxy|fn validate\(|validate_transport_authority|from_validated' \
src/migration_admin.rs
echo '== Direct deserialization and listener tests =='
rg -n -A60 -B12 \
'deserialize|Deserialize|build_proxy|mapped|wildcard|ListenerCollision|ZeroTransportAuthorityPort' \
tests/pg_erd_admin_config_contract.rs tests/listener_authority_contract.rs
echo '== Dual-profile OCI acceptance =='
rg -n -A46 -B10 \
'Build admitted candidate images|Verify declared non-root identities|Exercise generic read-only|Exercise pg-erd read-only|CWL_GATEWAY_BIN|read-only|cap-drop|no-new-privileges|measured origin|k6-summary' \
.github/workflows/ci.yml Dockerfile
echo '== Supply-chain evidence acceptance =='
rg -n -A62 -B12 \
'Build admitted candidate images|Scan exact generic|Scan exact pg-erd|Bind candidate evidence|Upload exact candidate|Stage candidate failure|Upload candidate failure|candidate-evidence|candidate-failure|source_sha|local_image_id|if-no-files-found' \
.github/workflows/supply-chain.yml
echo '== Documentation evidence status at head =='
rg -n -i -C 2 \
'34163230667|34163230576|exact.current.head.*pending|exact-head.*pending|reacquire.*exact|terminal.*GREEN|terminal success' \
docs/product-technical-gap-baseline.md TRD.md OPERABILITY.md SECURITY.md TEST_STRATEGY.md CHANGELOG.md || true
echo '== Source and workflow paths changed after adoption =='
git diff --name-status "$merge..$head"
git diff --check "$base...$head"Length of output: 109745
Medium — Update the baseline and operational documents with the current exact-head evidence.
The reported hosted evidence is now terminal success on this exact head:
Update the documents to identify these exact runs as completed evidence. Keep the remaining limits explicit: this evidence does not establish human approval, protected release status, immutable registry provenance, pg-erd routed load/failure parity, shadow/canary, cutover, or rollback credit. I found no additional actionable defect.
This review does not infer human approval, release, deployment, cutover, or rollback credit. You are interacting with an AI system. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope and authority
This Draft owns shared Admin Config network-authority hardening and bounded deployment evidence for the characterized pg-erd edge migration lane. Generic v1 and the pg-erd profile reject zero traffic/metrics/upstream ports and effective socket-authority overlap, including same-family wildcard/concrete aliases,
[::]plus IPv4 dual-stack ambiguity, exact IPv4-mapped/native aliases, native/mapped IPv4 wildcard aliases, and mapped-to-mapped IPv4 wildcard aliases. Product authentication/authorization, business routing, Keyverse identity, Wardnet/EgressWeave policy, service discovery, arbitrary per-request destinations, domain retries/failover and certificate-authority ownership remain outside this boundary.The dedicated
cwl-pingora-pg-erd-migrationprocess remains a bounded OCI profile.CWL_GATEWAY_BINis a build-time-only fail-closed allowlist of exactlycwl-pingora-gatewayandcwl-pingora-pg-erd-migration; the image contains one selected executable. OCI and Supply Chain lanes build/scan both profiles under the non-root/read-only/capability-free boundary. Routed pg-erd parity, registry-bound immutable digests, release-bound SBOM/provenance/reproducibility, rollback, shadow/canary and cutover remain separate gates.Repair lineage
The prior semantic repairs remain valid source history: listener/socket authority is centralized in
edge_contract; parent forwarding/HTTP-policy/migration-proxy/runtime/process fixtures are preserved; dual-profile OCI/Supply Chain and reproducibility evidence contracts remain intact; direct-Serde revalidation atbuild_proxy()and measured-origin readiness are retained.Exact
8937364909b82f50fd911aa001a8d073b517f5d9previously had independent terminal CI34163230667and Supply Chain34163230576, including exact checkout, Rust 1.98.0, compile/test, Clippy, warning-denied rustdoc, 100% owned coverage, dual-profile OCI exercise and controlled generic-loopback p951.5951211 ms. Those receipts are historical only after the current head movement.Ordinary two-parent repair
9eb1dbd36140d18fba79e948c6eba6e455727c91adopts repaired #12 exacteaa1d92587e11522312071e7a53c4e4399ed946fand restoresdocs/product-technical-gap-baseline.mdto parent authority. The network-authority/dual-profile OCI/reproducibility/TRACEABILITY/test delta is preserved, while this branch no longer competes with dedicated baseline writer #61. No force-push, destructive rebase, close/reopen churn, self-approval or gate weakening was used.Exact integration state
Base is now exact current #12
feat/pg-erd-admin-config-v1@eaa1d92587e11522312071e7a53c4e4399ed946f; current head is exact9eb1dbd36140d18fba79e948c6eba6e455727c91. This ordinary two-parent commit has parents prior child8937364909b82f50fd911aa001a8d073b517f5d9and repaired #12eaa1d925...; no valid child delta was discarded.Fresh base-range inventory is 19 paths:
.github/workflows/ci.yml,.github/workflows/supply-chain.yml,API_CONFIG_CONTRACT.md,CHANGELOG.md,Dockerfile,OPERABILITY.md,SECURITY.md,TEST_STRATEGY.md,THREAT_MODEL.md,TRD.md,docs/adr/0008-bounded-pg-erd-admin-activation.md,docs/doctoring/TRACEABILITY.md,examples/pg-erd-migration.yaml,src/edge_contract.rs,src/migration_admin.rs,tests/listener_authority_contract.rs,tests/load_evidence_workflow_contract.rs,tests/reproducibility_contract.rs, andtests/supply_chain_evidence_workflow_contract.rs. The baseline path is no longer an effective delta and GitHub reports the Draft mergeable again.All checks/reviews from
89373649...are predecessor evidence and do not transfer. Keep Draft until9eb1dbd...reacquires exact-current CI/coverage/rustdoc/supply-chain/security and current review/thread evidence. Direct descendants must ordinary/non-force adopt this repaired parent and independently remove residual historical baseline copies. No protected merge, immutable release, routed pg-erd parity, representative TLS/network performance, shadow/canary, cutover, rollback or legacy-removal credit is claimed.