Repository navigation
feat(supply-path): verify authoritative evidence with shared registry semantics - #2908
Conversation
![aao-secretariat[bot]](https://avatars.githubusercontent.com/u/221690821?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — clean review, no blocking findings.
Reviewer found no Critical/High/Medium findings. The PR adds evidence-first, fail-closed supply-path verification consistent with the witness-not-translator posture: the evaluator dedupes host property IDs and refuses dangling/ambiguous ones (evaluate.ts:906-909), bulk inquiry never stitches unrelated collection legs (evaluate.ts:828-838), the 404-vs-unavailable distinction is correct and non-transient SSRF refusals reject rather than degrade (fetch-evidence.ts:1203,1229), all I/O is deadline/abort-bound, and the registry boundary re-validates cached verdicts. Changeset present and matches the additive impact.
Decision path: no critical/high findings (row 1 n/a); gated_paths=false (row 2 n/a); high_risk=false (rows 3/5 n/a); no medium findings (rows 4/8 n/a); no prior decision (row 6 n/a); no no-auto-approve team match (row 7 n/a) → row 9 approve.
Non-blocking note: PR body leaves ci:quick unverified and depends on upstream adcp#7513 landing first — worth a human glance before merge but not blocking.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve.
Delta pass on PR #2908. Since the prior clean approve, the only change is a +34 bump to MAX_PACKED_FILE_COUNT in scripts/check-package-size.mjs. The reviewer confirmed the arithmetic (32 runtime/declaration artifacts + guide + packaged example) matches the shipped surface and the bump is precise, not padded. A changeset is present, satisfying the changeset-vs-wire-impact requirement for the touched src/lib/**, scripts/**, and package.json files paths.
No blocking findings. No medium findings.
Gate checks: no no-auto-approve team match; gated_paths is false (row 2 does not apply despite review_decision: REVIEW_REQUIRED); high_risk is false; no prior escalation. None of rows 1–8 fire, so the outcome falls through to row 9 (approve).
589fbfd to
16a77a8
Compare
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — clean pass, no blocking or Medium findings.
Reviewed the full supply-path verification surface (evaluate.ts, fetch-evidence.ts, products.ts, verify.ts, validation.ts, revocations.ts, types.ts, plus SingleAgentClient / ssrf-fetch / discovery integration). Confirmed: fail-closed ladder, witness-not-translator compliant (opt-in evidence-computed annotations, seller verdicts replaced not trusted), bounded/timeout-guarded SSRF fetching, correct minor changeset, provenance-pinned fixtures.
Decision-table walk:
- Rows 1: no critical/high findings.
- Row 2: gated_paths is false — does not fire despite review_decision REVIEW_REQUIRED.
- Rows 3-5: high_risk is false.
- Row 6: prior decision was approve — sticky escalation N/A.
- Row 7: no no-auto-approve team match.
- Row 8: fewer than three medium findings (zero).
- Row 9: approve.
Prior decision on an earlier head was also approve with no findings; this run confirms the diff remains clean.
16a77a8 to
16bb61e
Compare
There was a problem hiding this comment.
Ladon verdict: Approve
Approve.
Subsequent pass over the delta since the prior clean approve. This run reviewed one commit making parseManifest async so validated publisher denials persist immediately after parsing — before any later fetch, authority-store operation, or deadline can fail. This is a fail-closed improvement: a failed affirmative verification can no longer erase a denial. Persistence ordering was traced; the revocation store observe is idempotent per (authority, publisher_domain) and the admission budget consumes once via the existingAuthority guard, so the end-of-readAndRemember re-persist is a safe no-op. Throw/timeout tests validate denial retention on the exact failure paths.
No blocking (critical/high) findings and no medium findings.
Gate checks:
- No no-auto-approve team match.
gated_paths: false— row 2 does not apply despitereview_decision: REVIEW_REQUIRED.high_risk: false— no deletion/modification escalation triggers.- Prior decision was
approve, notescalate— row 6 does not apply. - Zero medium findings — rows 4, 5, 8 do not apply.
Falls through to row 9: approve.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — subsequent pass, no blocking or medium findings.
Checked:
- No author no-auto-approve team match.
gated_paths: false— hard path gate does not apply (row 2 not triggered even thoughreview_decisionis REVIEW_REQUIRED).high_risk: false— no deleted/modified high-risk trigger.- Delta since prior clean approve is a single JSDoc comment on
AuthoritativeSupplyPathOptions.authorityStoreinsrc/lib/supply-path/types.ts; text accurately mirrors theSupplyPathAuthorityStorecontract with no behavior, wire-shape, or changeset impact. - Prior decision was
approve; sticky escalation (row 6) not applicable.
No critical/high/medium findings surfaced. Falls through to row 9 → approve.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — clean delta pass, no blocking or medium findings.
This is a subsequent review (prior outcome: approve). The reviewer found no new critical/high/medium findings. The location.hash → location.href.includes('#') change in fetch-evidence.ts:1356 correctly closes the empty-trailing-fragment gap (fail-closed, no false positives since path/query # serializes to %23), with matching docs, an appropriate minor changeset, and covering tests.
Decision-table walk:
- Row 1 (critical/high): none.
- Row 2 (gated_paths): false — does not fire despite review_decision REVIEW_REQUIRED.
- Row 3 (deleted high-risk): high_risk false, none.
- Rows 4–5 (medium categories / modified high-risk): no medium findings.
- Row 6 (sticky escalate): prior was approve, N/A.
- Row 7 (no-auto-approve team): no match.
- Row 8 (≥3 medium): none.
- Row 9: approve.
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — clean pass, test-only delta.
The current run's actionable delta is confined to test/lib/cli-webhook-receiver-flag.test.js: two tunnel-lifecycle tests swap the live public test-mcp target for a refused loopback endpoint (http://127.0.0.1:1/mcp) to remove live-network timing flakiness, and the second test gains the missing SIGKILL hang guard the first already had. These are test-hardening changes with no wire-shape, changeset, or transport-client impact.
No critical/high/medium findings. Test-only change requires no changeset. No high-risk paths (high_risk: false), no gated paths (gated_paths: false), no no-auto-approve team match. Prior decision was approve with no findings — this remains a net-clean state.
Decision table: rows 1–8 do not fire (no findings, no gates, no team match). Falls through to row 9 → approve.
|
Taking this over for post-#7544 qualification. Hold this Draft: I will rebase onto current client |
|
Acknowledged — holding Draft, standing down on existing checks. Will wait for your rebase onto current Generated by Claude Code |
007aed6 to
6de659a
Compare
|
Takeover requalification is complete.
Moving this PR to Ready for Review. Human approval is still required. I have not merged it. |
There was a problem hiding this comment.
Ladon verdict: Approve
Approve — supply-path verification SDK addition, clean re-review.
Reviewer re-read every non-generated supply-path module (evaluate, fetch-evidence, products, verify, types, validation, revocations) plus the ssrf-fetch and SingleAgentClient edits. Verified the fail-closed evaluator, SSRF-pinned bounded fetching, atomic revocation/authority stores, opt-in annotation, and a correct additive minor changeset. No Critical/High/Medium findings.
Decision-table walk:
- Row 1 (critical/high): none.
- Row 2 (gated_paths): gated_paths is false — does not fire despite review_decision REVIEW_REQUIRED.
- Row 3 (deletions in high-risk): high_risk false.
- Rows 4–5 (medium categories / high-risk modified): no medium findings.
- Row 6 (sticky escalate): prior decision was approve, not escalate.
- Row 7 (no-auto-approve team): no team match.
- Row 8 (≥3 medium): zero findings.
- Row 9: approve.
This is a subsequent clean pass consistent with the prior approve. Nothing actionable surfaced.
Adds complete registry and authoritative supply-path verification for owner-sold collections carried by another publisher. Registry mode is a typed wrapper over the canonical endpoint. Authoritative mode fetches publisher evidence and computes the same fail-closed verdict and five leg diagnostics.
Canonical provenance
dc69e0b2264b4c563f2175a48c515b7108dbb4f6.vectors.jsonSHA-256:1a239d61209896aad843375d307650fb22dbfe7a8c73ebb900d8aec6d58abd31.mainatcfab37ee99d939acbda1e42347b649f9e3e08ae6.Behavior
Qualification
Current public head:
8c3330cb647926fe140aabce0f72af19f9563639.Local exact-head checks passed:
Fresh GitHub exact-head CI is clean, including the rerun of an unrelated reference-seller reporting-fetch flake. Independent Claude and Codex code/protocol/security/DX reviews converge on SHIP at this exact head. The PR is Ready for Review; human approval remains required, and earlier approvals or checks were not reused.
Includes public exports, guide, runnable example, type checks, focused regressions, and a minor changeset. No generated schema changes are added by this feature.
Fixes #2783