feat(portfolio): add contract-linter producer and shadow checks#169
Conversation
saagpatel
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 052ed8aa8b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| continue | ||
| identity = project.get("identity") | ||
| path = identity.get("path") if isinstance(identity, dict) else None | ||
| entry = repos.get(path) if isinstance(path, str) else None |
There was a problem hiding this comment.
Because load_portfolio_catalog normalizes repo keys via _normalize_key, while portfolio truth identity.path preserves the original case/path, this exact lookup skips normal catalog entries such as AIGCCore from config/portfolio-catalog.yaml after it is loaded as aigccore. In those cases CL-DECL-001 never inspects provenance, so a stale artifact that dropped catalog_repo declarations can pass the shadow check; resolve entries with the same normalization/catalog matching path the producer uses.
Useful? React with 👍 / 👎.
| current = _git(repo_root, "rev-parse", "HEAD") | ||
| if current != evidence.commit: |
There was a problem hiding this comment.
When preflight evidence was collected from a clean tree and a source/catalog file is edited before publish without changing HEAD, this revalidation still passes because it only compares rev-parse HEAD. publish_portfolio_truth(..., require_producer_evidence=True) then writes producer evidence with worktree_clean: true even though the artifact was built from a dirty checkout; rerun the porcelain cleanliness check here before accepting the evidence.
Useful? React with 👍 / 👎.
1 participant
Summary
Verification
Boundaries