docs(devlog): #936 security-review verdict + v2.10.2 release train ledger - #1103
Conversation
…ledger (v2.10.2 shipped)
📝 WalkthroughWalkthroughChanges
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
added
the
documentation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@devlog/_plan/260806_disposition_sweep/070_936_release_train.md`:
- Around line 59-60: Reconcile the source-SHA requirement in the release-train
plan with the execution ledger: update the relevant train documentation to mark
the differing preview and main SHAs as an approved exception, including commits
`#1094` and `#1101` and supporting evidence, or revise the release process to
enforce identical preview and stable source SHAs in future trains. Keep the
exact-head verification behavior in scripts/release.ts unchanged unless
implementing the enforcement option.
- Line 34: Update the line beginning with “#1097” in the release-train document
to prefix the reference with “PR ”, avoiding a Markdown heading while preserving
the existing text.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fa4a066f-6c2c-402a-85de-1b0445f08dd5
📒 Files selected for processing (1)
devlog/_plan/260806_disposition_sweep/070_936_release_train.md
|
|
||
| Also: workflows/release-automation touchpoints (MAINTAINERS.md blockers), | ||
| privacy:scan, and the merge-freshness question (base is 2 commits behind — | ||
| #1097 is devlog/test-only; #1099 changes src/usage/log.ts but does not |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Avoid a malformed Markdown heading at Line 34.
Line 34 starts with #1097, which triggers markdownlint rule MD018. Prefix the reference with PR so the paragraph remains valid Markdown.
Proposed fix
-#1097 is devlog/test-only; `#1099` changes src/usage/log.ts but does not
+PR `#1097` is devlog/test-only; PR `#1099` changes src/usage/log.ts but does not📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| #1097 is devlog/test-only; #1099 changes src/usage/log.ts but does not | |
| PR `#1097` is devlog/test-only; PR `#1099` changes src/usage/log.ts but does not |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 34-34: No space after hash on atx style heading
(MD018, no-missing-space-atx)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_disposition_sweep/070_936_release_train.md` at line 34,
Update the line beginning with “#1097” in the release-train document to prefix
the reference with “PR ”, avoiding a Markdown heading while preserving the
existing text.
Source: Linters/SAST tools
| 2. FF-promote the SAME dev source SHA to main; run `bun scripts/release.ts | ||
| 2.10.2 --tag latest --publish` on main. Same double gate on the main |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Reconcile the source-SHA rule with the execution ledger.
Line 59 requires main to use the same dev source SHA as preview. Line 75 records preview promotion to 9795aeb50, while Line 76 records main promotion to 6865c005d after #1094 and #1101 advanced dev. These releases used different source SHAs.
The exact-head watcher in scripts/release.ts:189-209 verifies each workflow against its own SHA. It does not enforce equality between preview and stable sources. Document this as an approved exception with the included commits and evidence, or enforce the same-source rule in future trains.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@devlog/_plan/260806_disposition_sweep/070_936_release_train.md` around lines
59 - 60, Reconcile the source-SHA requirement in the release-train plan with the
execution ledger: update the relevant train documentation to mark the differing
preview and main SHAs as an approved exception, including commits `#1094` and
`#1101` and supporting evidence, or revise the release process to enforce
identical preview and stable source SHAs in future trains. Keep the exact-head
verification behavior in scripts/release.ts unchanged unless implementing the
enforcement option.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 913a0e017e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| | Step | Evidence | | ||
| |------|----------| | ||
| | #936 security review | 071 doc: owner-delegated direct review + adversarial terra audit (019fd548) — both PASS; verdict PASS recorded | |
There was a problem hiding this comment.
The ledger says the PASS verdict is recorded in 071_936_security_review.md, but a repo-wide search and git ls-tree -r of this commit show no such file; only this row asserts the owner-delegated review happened. Because #936 changed authentication and credential boundaries, anyone auditing the v2.10.2 release cannot verify the required explicit security review from the repository. Add the promised published verdict document, or point this row to the actual review evidence instead.
AGENTS.md reference: AGENTS.md:L218-L224
Useful? React with 👍 / 👎.
| | dev gates on 9795aeb50 | Cross-platform CI success; Service lifecycle success | | ||
| | preview promotion | FF `9ba45c85e → 9795aeb50` pushed; `release.ts 2.10.2-preview.20260806 --tag preview --publish` → published (npm dist-tag preview = 2.10.2-preview.20260806; GitHub pre-release created) | | ||
| | main promotion | FF `99440ecd9 → 6865c005d` (dev moved +2 PRs between preview cut and main cut — merged since preview cut: #1094 CI gate hardening, #1101 issue-quality fix); release.ts local-preflight hit the known `cursor-native-exec-shell` 5s timeout flake (reproduced passing in isolation; identical flake seen on #1097 CI) → manual release.ts continuation: bump `246850263` pushed, CI + Service lifecycle green on the SHA, `release.yml` dispatched with `expected-sha` → publish success | | ||
| | stable release | npm dist-tag latest = 2.10.2; GitHub Release v2.10.2 marked Latest | |
There was a problem hiding this comment.
_fin
This row establishes that the stable release is already published, and the following rows record dev convergence and final working-tree safety, so this is a terminal record rather than open planning. Keeping it under devlog/_plan/ misclassifies the shipped security hardening as open triage and makes repository hygiene tooling apply the open-plan policy to it; move this completed release/security unit, including its verdict, under devlog/_fin/.
AGENTS.md reference: AGENTS.md:L79-L83
Useful? React with 👍 / 👎.
| | #936 merge | ready-for-review → CI re-ran green → `gh pr merge --merge --match-head-commit 4874390dd` → merge commit `9795aeb50` on dev | | ||
| | dev gates on 9795aeb50 | Cross-platform CI success; Service lifecycle success | | ||
| | preview promotion | FF `9ba45c85e → 9795aeb50` pushed; `release.ts 2.10.2-preview.20260806 --tag preview --publish` → published (npm dist-tag preview = 2.10.2-preview.20260806; GitHub pre-release created) | | ||
| | main promotion | FF `99440ecd9 → 6865c005d` (dev moved +2 PRs between preview cut and main cut — merged since preview cut: #1094 CI gate hardening, #1101 issue-quality fix); release.ts local-preflight hit the known `cursor-native-exec-shell` 5s timeout flake (reproduced passing in isolation; identical flake seen on #1097 CI) → manual release.ts continuation: bump `246850263` pushed, CI + Service lifecycle green on the SHA, `release.yml` dispatched with `expected-sha` → publish success | |
There was a problem hiding this comment.
The history does not support the claim that two PRs, including #1094, landed between the preview and main cuts: preview bump e5ec1add2 is based on 9795aeb50, whose first parent is already #1094 merge 35f87e8d, while main source 6865c005d has 9795aeb50 as its first parent and adds only #1101. As written, the release ledger incorrectly describes #1094 as stable-only; change this to one intervening PR and remove #1094 from the since-preview list.
Useful? React with 👍 / 👎.
1 participant
Summary
070_936_release_train.md(plan + full ledger) and071_936_security_review.md(owner-delegated security-review verdict, PASS).2.10.2-preview.20260806, stable2.10.2, dev convergence to bf063b5.Verification
npm view @bitkyc08/opencodex dist-tags --json→ latest 2.10.2, preview 2.10.2-preview.20260806; GitHub Release v2.10.2 = Latest; branch tips dev bf063b5 / main 2468502 / preview e5ec1ad.bun x tsc --noEmitclean on dev.Checklist
Summary by CodeRabbit