Strengthen Codex upstream dependency and contract validation - #57
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Codex updates now have a shared local/CI validation entrypoint and target-filtered product dependency reports. Forbidden agent dependencies and Runner-to-sandbox library edges fail with a path; ordinary package/source/edge changes can be compared against an archived baseline without auto-approval. The Codex pin is unchanged.
Validation reports bind results to source/lock hashes, repository and Codex SHAs, platform and Rust toolchain. CI retains logs on failures, runs macOS PTY/filesystem contracts, and requires those checks in the aggregate. PTY size is tested on an actual created terminal rather than against an upstream default.
Contract changes
No MCP, storage, or runtime policy changes. New developer interfaces:
python3 scripts/validate-upstream.py all(or named stages) andscripts/upstream_dependencies.py --target ... --output ... [--compare ...]. macOS cannot qualify Linux isolation; reports explicitly distinguish incomplete coverage.Tests
Local on head
4db80f610e9ff7af580f40954c9ef6263919abe8: 11 Python fixture/orchestrator tests; pin, policy and format checks; all six macOS dependency graphs and a no-drift baseline comparison; PTY/filesystem Clippy and tests using Command Line Tools; bilingual registry and 5 documentation tests passed. Local reports:target/upstream-reports/committedandtarget/upstream-reports/macos-committed.The default local Xcode license configuration blocked the first native attempt; Command Line Tools resolved it without changing license settings. Local docs build was not run with the required Node 24.21.0, but the pinned-toolchain hosted docs build passed. Linux isolation is verified by hosted Linux CI, not by the macOS host.
Hosted verification is tied to PR head
4db80f610e9ff7af580f40954c9ef6263919abe8; GitHub's tested merge checkout is87d11a8a175c4f08a3b22c26d854dacbd57aeee9, as recorded in the artifacts. All hosted Rust gates, including Linux isolation, full workspace integration, macOS contracts/dependencies and the aggregate, passed. Documentation build passed; Pages publishing is intentionally skipped on a PR. CI: https://github.com/novelKR/CodeSpace/actions/runs/35442243256 .Security scenarios
Normal/build graph traversal excludes development edges, resolves aliases by package identity, rejects missing roots and metadata errors, and preserves target identity in comparisons. Source changes during validation invalidate reports. Existing Linux deny/proxy/termination tests remain required.
Out of scope
No Codex pin upgrade, public process-result additions, new runtime dependencies, or merge. Follow-up upstream candidate rehearsal remains separate.