Skip to content

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository - #42

Open
omry wants to merge 1 commit into
mainfrom
pr42
Open

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository#42
omry wants to merge 1 commit into
mainfrom
pr42

Conversation

@omry

@omry omry commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Adds the stateless Cloudflare receiver for the shared Security Maintenance GitHub App. It verifies webhook signatures over the original bytes, creates an App JWT from either GitHub-downloaded PKCS#1 or PKCS#8 RSA keys, and reads canonical repository metadata with a token restricted to one repository.

Webhook input and sequential GitHub reads share one eight-second processing budget. Stalled input and upstream calls abort within that budget; failures return a sanitized response. The operator reference covers repeatable checks and recovery.

Validation:

  • 19 Worker unit tests, with 100% line coverage.
  • Native Workers runtime: signed ping, signature rejection, streamed size limit, JWT/scoped read, and the shared deadline across two slow sequential reads.
  • 1,294 Node maintenance tests, Ruff, formatting, and Pyrefly.
  • Pinned Wrangler bundle validation; CI also exercises the existing Node 22/24 package-manager matrix.

Hosted acceptance is recorded for each source/deployment pair before a slice is accepted. The initial deployment at 587cc8a247788e490b1d754d2595340472468e47 passed real signed ping and PR deliveries, forged-signature rejection, and the one-repository token boundary against a verified private probe. Those initial receipts predate the key-format and deadline corrections; delivery tracks the matching receipts for each updated deployment separately.

This is infrastructure slice node-maintenance-repair/1. Checks, dispatch, storage, and dependency repairs follow in later slices. The larger draft #41 remains parked until its remaining work has transferred to linked replacements.

@omry

omry commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
    "evidence": {
      "attestations": [
        {
          "closure_identity": "sha256:6cf076773cd968a6ac1dcfaf1dfda82c543b5f3e2658013d265407e3e97be1e6",
          "document_identity": "sha256:59cc4c60e3c82a2c6d63ccc1826ff14e5cc26f89052dbb23bd864ffe8fb3f0a9",
          "sidecar_identity": "sha256:23cc87503b0b509365d991bd815ad7f2a18b3623756ceac875f9696da82802ab"
        }
      ],
      "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:30864b71ab338fed981033be94bea8674dd6a7ba114697a380175fef1a7ab7ce",
      "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
      "review_request": {
        "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
        "id": 6362183690
      },
      "review_result": {
        "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
        "id": 6362228282
      }
    },
    "evidence_fingerprint": "sha256:7b08f320c2a46adb65969ccf7de29dce0d935395540577f492cabbfe60419e33",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
    "review_request_id": 6362183690,
    "review_result_id": 6362228282,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "repair-app",
      "run_id": 120349689752
    },
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 120349689630
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 120349689836
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 120349690011
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 120349689833
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 120349689870
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 120349689903
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 120349689886
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120315927460,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927460"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120315927750,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927750"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120315927922,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927922"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120315927629,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927629"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120315927837,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927837"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120315927624,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927624"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120315927679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120315927862,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927862"
        }
      ],
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:09e994d0701c66a64a82f7da69411651f7ef8e312022098d515258087b7d17ab",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120308132534,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132534"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120308132270,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132270"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120308132708,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132708"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120308132675,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132675"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120308132808,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132808"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120308132600,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132600"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120308132660,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132660"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120308132581,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132581"
        }
      ],
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": "sha256:4fdad83ffcaee6b1401b14f546e01f8c8da2e75a0ae69d531c8b41d0d16c832b",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689752"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689630"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689836"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349690011"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689833"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689870"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689903"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689886"
        }
      ],
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": "sha256:cb2fef0bcb0e6dc78bcb39745baaa3f6b1bf0710482824b83c7958e9fe7082bf",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120132953699,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953699"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120132954220,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132954220"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120132953679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120132953633,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953633"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120132953599,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953599"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120132953726,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953726"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120132953890,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953890"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120132953707,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953707"
        }
      ],
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": "sha256:e5f7ba987cdf2fbb42c62cef0ae77aff813335cddf0cbb42355edeb78e32cb07",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357434171",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357549587",
        "/tmp/node-maintenance-keyfix-local-validation.json",
        "0155e8bd89c57e1cbcafb1bec3731f9446b02b02"
      ],
      "id": 4357434171,
      "invariant": "GitHub App JWT signing accepts GitHub-downloaded PKCS#1 RSA keys and existing PKCS#8 keys.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "severity": "P1",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vhcLl"
    },
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358070701",
        "https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks#respond-within-10-seconds",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358233195",
        "/home/omry/.local/state/awd/runs/run_07h2fm1myttbq3ckm56j1gvyew/deadline-correction/local-validation.json",
        "6009198151028e1d42d6f26a76545852d6553c2e"
      ],
      "id": 4358070701,
      "invariant": "Webhook processing shares an overall deadline below GitHub's 10-second response limit, including sequential upstream calls.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "severity": "P2",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vi9p7"
    }
  ],
  "pr": {
    "base_ref": "main",
    "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
    "body_digest": "sha256:46aba7b39490a238fd88726d965a854d66f6817dbd853b8f34fc75d7de153aa9",
    "diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
    "head_ref": "pr42",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "pr": 42,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:022f2c6b4dd2ed5124111dd0f6f37ec86f48189ee1e506f6c9d241d4351d085d"
  },
  "record_version": 16,
  "review_observations": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "evidence_digest": "sha256:4bc10751540ab46f43cec6a65a35e548861656d9a9e4711660d3895bfcac365e",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:9dfd6919e49fab100878835bf869529d2578a2d86f70441d4c62f6b4d6374f78",
      "request_comment_id": 6360695964,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:17050a7c0a918d189733536a49fe5527ac3b1b96ce7342f8fc6e9e8670cbb423",
      "created_at": "2026-10-22T23:04:36Z",
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353257750,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:794866d8b1c0f5b7404817230111d3ec461bf2901a2579f30619647c37ede684",
      "created_at": "2026-10-23T08:04:04Z",
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 6360383602,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T08:22:47Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6360695964,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T09:24:55Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6361750828,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
      "created_at": "2026-10-23T09:50:10Z",
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362183690,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bf75cd1f5e15c28b24c7367be1e49f68c6cf7b6eb8a2e0975ab2d4e3a5731cc4",
      "commit_id": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 5625558404,
      "inline_message_ids": [
        4357434171
      ],
      "request_comment_id": 6360383602,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T08:06:28Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vhcLl"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:2823743bd0f45953398d7a8bd09d929143528a8897067228914375eb282471ac",
      "commit_id": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 5626376684,
      "inline_message_ids": [
        4358070701
      ],
      "request_comment_id": 6361750828,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T09:26:56Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vi9p7"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:cf875ed4763470a33935f946fcd700897e2eb6f54f3a6c0929988bba1418fec1",
      "commit_id": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353297263,
      "inline_message_ids": [],
      "request_comment_id": 6353257750,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-22T23:07:16Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
      "commit_id": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362228282,
      "inline_message_ids": [],
      "request_comment_id": 6362183690,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-23T09:52:47Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:8b98ef71dde4c1a5377cedff83732aecffcd619657bec24240f64861da28a038",
      "finding_ids": [],
      "invariants": [
        "Original-byte signature verification precedes payload processing.",
        "Installation tokens and repository reads stay scoped to one canonical repository.",
        "No Check, dispatch, repair or repository write enters slice 1.",
        "All required checks and complete local validation pass; hosted acceptance remains explicitly pending."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "587cc8a247788e490b1d754d2595340472468e47",
      "review_observation_id": null,
      "review_request_id": 6353257750,
      "review_result_id": 6353297263,
      "reviewed_head": "587cc8a247788e490b1d754d2595340472468e47",
      "root_cause": "No actionable defect found by the attributable exact-head regular review or current local validation.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "disposition_changes": [
        4357434171
      ],
      "effective_diff_digest": "sha256:c43fb28b62838e3f0d9d6701d6bab743c18b14d631085fbe96e2c02227184897",
      "finding_ids": [
        4357434171
      ],
      "invariants": [
        "GitHub-downloaded RSA PKCS#1 and PKCS#8 keys both produce valid App JWTs."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "resulting_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "review_observation_id": null,
      "review_request_id": 6360383602,
      "review_result_id": 5625558404,
      "reviewed_head": "b81526100ff43863d7a62b52e81b8c682d225372",
      "root_cause": "Receiver assumed PKCS#8 PEM and could not decode GitHub-downloaded PKCS#1 keys.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "disposition_changes": [
        4358070701
      ],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [
        4358070701
      ],
      "invariants": [
        "One overall webhook deadline stays below GitHub's 10-second response window."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6361750828,
      "review_result_id": 5626376684,
      "reviewed_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "root_cause": "Two sequential calls each used an independent 15-second timeout; streamed cancellation could also wait indefinitely.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [],
      "invariants": [
        "Signed ingress, supported App keys, one-repository reads and the shared deadline remain within receiver scope."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6362183690,
      "review_result_id": 6362228282,
      "reviewed_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "root_cause": null,
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 22, 2026 22:58
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-23T09:52:48.911754Z 6009198 Manual request
🔒 Security Review ✅ Completed 2026-10-22T23:01:42.905263Z 587cc8a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 587cc8a

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 587cc8a247

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added approved and removed approved labels Oct 22, 2026
@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: b815261

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 23, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b81526100f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread repair-app/worker.mjs Outdated
@omry

omry commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Superseded at the maintainer’s request by a fresh regular review of commit 0155e8bd89c57e1cbcafb1bec3731f9446b02b02. The previous attempt remained pending; this comment is retained as history.

Original stalled review request 
@codex review

Exact head: 0155e8bd89c57e1cbcafb1bec3731f9446b02b02

@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 0155e8b

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 23, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0155e8bd89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread repair-app/worker.mjs Outdated
@omry
[node-maintenance-repair/1] Receive a signed webhook and read the ins…
6009198 
…talled repository

Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository.

Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions.

Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly.

Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof.

Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.
@omry

omry commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

Exact head: 6009198

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 6009198151

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 23, 2026
@omry omry mentioned this pull request Oct 23, 2026
Open
@omry
omry added this pull request to stack #44 October 23, 2026 12:06
This was referenced Oct 23, 2026
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry