[node-maintenance-repair/1] Receive a signed webhook and read the installed repository by omry · Pull Request #42 · hydra-ecosystem/github-actions

omry · 2026-10-22T22:46:53Z

Adds the stateless Cloudflare receiver for the shared Security Maintenance GitHub App. It verifies webhook signatures over the original bytes, creates an App JWT from either GitHub-downloaded PKCS#1 or PKCS#8 RSA keys, and reads canonical repository metadata with a token restricted to one repository.

Webhook input and sequential GitHub reads share one eight-second processing budget. Stalled input and upstream calls abort within that budget; failures return a sanitized response. The operator reference covers repeatable checks and recovery.

Validation:

19 Worker unit tests, with 100% line coverage.
Native Workers runtime: signed ping, signature rejection, streamed size limit, JWT/scoped read, and the shared deadline across two slow sequential reads.
1,294 Node maintenance tests, Ruff, formatting, and Pyrefly.
Pinned Wrangler bundle validation; CI also exercises the existing Node 22/24 package-manager matrix.

Hosted acceptance is recorded for each source/deployment pair before a slice is accepted. The initial deployment at 587cc8a247788e490b1d754d2595340472468e47 passed real signed ping and PR deliveries, forged-signature rejection, and the one-repository token boundary against a verified private probe. Those initial receipts predate the key-format and deadline corrections; delivery tracks the matching receipts for each updated deployment separately.

This is infrastructure slice node-maintenance-repair/1. Checks, dispatch, storage, and dependency repairs follow in later slices. The larger draft #41 remains parked until its remaining work has transferred to linked replacements.

omry · 2026-10-22T22:54:53Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
    "evidence": {
      "attestations": [
        {
          "closure_identity": "sha256:6cf076773cd968a6ac1dcfaf1dfda82c543b5f3e2658013d265407e3e97be1e6",
          "document_identity": "sha256:59cc4c60e3c82a2c6d63ccc1826ff14e5cc26f89052dbb23bd864ffe8fb3f0a9",
          "sidecar_identity": "sha256:23cc87503b0b509365d991bd815ad7f2a18b3623756ceac875f9696da82802ab"
        }
      ],
      "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:30864b71ab338fed981033be94bea8674dd6a7ba114697a380175fef1a7ab7ce",
      "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
      "review_request": {
        "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
        "id": 6362183690
      },
      "review_result": {
        "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
        "id": 6362228282
      }
    },
    "evidence_fingerprint": "sha256:7b08f320c2a46adb65969ccf7de29dce0d935395540577f492cabbfe60419e33",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "operation_identity": "sha256:897e0d0e0e5538ba0313fc76b82526f280846e95b4b758dcfb1aee0c898bbb6d",
    "review_request_id": 6362183690,
    "review_result_id": 6362228282,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "repair-app",
      "run_id": 120349689752
    },
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 120349689630
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 120349689836
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 120349690011
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 120349689833
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 120349689870
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 120349689903
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 120349689886
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120315927460,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927460"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120315927750,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927750"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120315927922,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927922"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120315927629,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927629"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120315927837,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927837"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120315927624,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927624"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120315927679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120315927862,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39924034084/job/120315927862"
        }
      ],
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:09e994d0701c66a64a82f7da69411651f7ef8e312022098d515258087b7d17ab",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120308132534,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132534"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120308132270,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132270"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120308132708,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132708"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120308132675,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132675"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120308132808,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132808"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120308132600,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132600"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120308132660,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132660"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120308132581,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39921675878/job/120308132581"
        }
      ],
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": "sha256:4fdad83ffcaee6b1401b14f546e01f8c8da2e75a0ae69d531c8b41d0d16c832b",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120349689752,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689752"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120349689630,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689630"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120349689836,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689836"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120349690011,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349690011"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120349689833,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689833"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120349689870,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689870"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120349689903,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689903"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120349689886,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39934226751/job/120349689886"
        }
      ],
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": "sha256:cb2fef0bcb0e6dc78bcb39745baaa3f6b1bf0710482824b83c7958e9fe7082bf",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "repair-app",
          "run_id": 120132953699,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953699"
        },
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 120132954220,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132954220"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 120132953679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 120132953633,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953633"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 120132953599,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953599"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 120132953726,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953726"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 120132953890,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953890"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 120132953707,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39867402510/job/120132953707"
        }
      ],
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": "sha256:e5f7ba987cdf2fbb42c62cef0ae77aff813335cddf0cbb42355edeb78e32cb07",
      "required_checks": [
        "repair-app",
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357434171",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4357549587",
        "/tmp/node-maintenance-keyfix-local-validation.json",
        "0155e8bd89c57e1cbcafb1bec3731f9446b02b02"
      ],
      "id": 4357434171,
      "invariant": "GitHub App JWT signing accepts GitHub-downloaded PKCS#1 RSA keys and existing PKCS#8 keys.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "severity": "P1",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vhcLl"
    },
    {
      "classification": "current-slice defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358070701",
        "https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks#respond-within-10-seconds",
        "https://github.com/hydra-ecosystem/github-actions/pull/42#discussion_r4358233195",
        "/home/omry/.local/state/awd/runs/run_07h2fm1myttbq3ckm56j1gvyew/deadline-correction/local-validation.json",
        "6009198151028e1d42d6f26a76545852d6553c2e"
      ],
      "id": 4358070701,
      "invariant": "Webhook processing shares an overall deadline below GitHub's 10-second response limit, including sequential upstream calls.",
      "path": "repair-app/worker.mjs",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "severity": "P2",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86vi9p7"
    }
  ],
  "pr": {
    "base_ref": "main",
    "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
    "body_digest": "sha256:46aba7b39490a238fd88726d965a854d66f6817dbd853b8f34fc75d7de153aa9",
    "diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
    "head_ref": "pr42",
    "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
    "pr": 42,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:022f2c6b4dd2ed5124111dd0f6f37ec86f48189ee1e506f6c9d241d4351d085d"
  },
  "record_version": 16,
  "review_observations": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "evidence_digest": "sha256:4bc10751540ab46f43cec6a65a35e548861656d9a9e4711660d3895bfcac365e",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": "sha256:9dfd6919e49fab100878835bf869529d2578a2d86f70441d4c62f6b4d6374f78",
      "request_comment_id": 6360695964,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:17050a7c0a918d189733536a49fe5527ac3b1b96ce7342f8fc6e9e8670cbb423",
      "created_at": "2026-10-22T23:04:36Z",
      "head_sha": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353257750,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:794866d8b1c0f5b7404817230111d3ec461bf2901a2579f30619647c37ede684",
      "created_at": "2026-10-23T08:04:04Z",
      "head_sha": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 6360383602,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T08:22:47Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6360695964,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:63f9a10b776c2ff3aabe50569bb2ec90dd321620def280ec287fa74798ab39b7",
      "created_at": "2026-10-23T09:24:55Z",
      "head_sha": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 6361750828,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-22T22:46:53Z",
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:f7bb8963eb826b82fd6c90c565fe7dffdbe25cfd2d4dff04a210849d264070f1",
      "created_at": "2026-10-23T09:50:10Z",
      "head_sha": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362183690,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bf75cd1f5e15c28b24c7367be1e49f68c6cf7b6eb8a2e0975ab2d4e3a5731cc4",
      "commit_id": "b81526100ff43863d7a62b52e81b8c682d225372",
      "id": 5625558404,
      "inline_message_ids": [
        4357434171
      ],
      "request_comment_id": 6360383602,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T08:06:28Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vhcLl"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:2823743bd0f45953398d7a8bd09d929143528a8897067228914375eb282471ac",
      "commit_id": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "id": 5626376684,
      "inline_message_ids": [
        4358070701
      ],
      "request_comment_id": 6361750828,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-23T09:26:56Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86vi9p7"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:cf875ed4763470a33935f946fcd700897e2eb6f54f3a6c0929988bba1418fec1",
      "commit_id": "587cc8a247788e490b1d754d2595340472468e47",
      "id": 6353297263,
      "inline_message_ids": [],
      "request_comment_id": 6353257750,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-22T23:07:16Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "main",
      "base_sha": "0938f9298b84dd6741a394fc2db8dfd6e04942a7",
      "body_digest": "sha256:bdd9477d83d6084b2101c23dc7efa986099a9c377d7328a738537381cb44125f",
      "commit_id": "6009198151028e1d42d6f26a76545852d6553c2e",
      "id": 6362228282,
      "inline_message_ids": [],
      "request_comment_id": 6362183690,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-23T09:52:47Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:e1d664bc6da0055fb8e28da0b34cf67723c36e2e1ac31f6809fa9da3f741e0c5",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:8b98ef71dde4c1a5377cedff83732aecffcd619657bec24240f64861da28a038",
      "finding_ids": [],
      "invariants": [
        "Original-byte signature verification precedes payload processing.",
        "Installation tokens and repository reads stay scoped to one canonical repository.",
        "No Check, dispatch, repair or repository write enters slice 1.",
        "All required checks and complete local validation pass; hosted acceptance remains explicitly pending."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "587cc8a247788e490b1d754d2595340472468e47",
      "review_observation_id": null,
      "review_request_id": 6353257750,
      "review_result_id": 6353297263,
      "reviewed_head": "587cc8a247788e490b1d754d2595340472468e47",
      "root_cause": "No actionable defect found by the attributable exact-head regular review or current local validation.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "disposition_changes": [
        4357434171
      ],
      "effective_diff_digest": "sha256:c43fb28b62838e3f0d9d6701d6bab743c18b14d631085fbe96e2c02227184897",
      "finding_ids": [
        4357434171
      ],
      "invariants": [
        "GitHub-downloaded RSA PKCS#1 and PKCS#8 keys both produce valid App JWTs."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs"
      ],
      "resulting_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "review_observation_id": null,
      "review_request_id": 6360383602,
      "review_result_id": 5625558404,
      "reviewed_head": "b81526100ff43863d7a62b52e81b8c682d225372",
      "root_cause": "Receiver assumed PKCS#8 PEM and could not decode GitHub-downloaded PKCS#1 keys.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "disposition_changes": [
        4358070701
      ],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [
        4358070701
      ],
      "invariants": [
        "One overall webhook deadline stays below GitHub's 10-second response window."
      ],
      "outcome": "corrected",
      "proposed_fix_paths": [
        "repair-app/worker.mjs",
        "repair-app/worker.test.mjs",
        "repair-app/runtime-smoke.mjs",
        "docs/node-maintenance-operator.md"
      ],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6361750828,
      "review_result_id": 5626376684,
      "reviewed_head": "0155e8bd89c57e1cbcafb1bec3731f9446b02b02",
      "root_cause": "Two sequential calls each used an independent 15-second timeout; streamed cancellation could also wait indefinitely.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:66574e373e1b7a3ae7ab143caf7dd317187126978fabd0ea1d158f0f1b4b9d03",
      "finding_ids": [],
      "invariants": [
        "Signed ingress, supported App keys, one-repository reads and the shared deadline remain within receiver scope."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "review_observation_id": null,
      "review_request_id": 6362183690,
      "review_result_id": 6362228282,
      "reviewed_head": "6009198151028e1d42d6f26a76545852d6553c2e",
      "root_cause": null,
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-22T22:59:03Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T09:52:48.911754Z	`6009198`	Manual request
🔒 Security Review	✅ Completed 2026-10-22T23:01:42.905263Z	`587cc8a`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-22T23:04:36Z

@codex review

Exact head: 587cc8a

chatgpt-codex-connector · 2026-10-22T23:07:16Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 587cc8a247

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-23T08:04:04Z

@codex review

Exact head: b815261

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b81526100f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry · 2026-10-23T08:22:47Z

Superseded at the maintainer’s request by a fresh regular review of commit 0155e8bd89c57e1cbcafb1bec3731f9446b02b02. The previous attempt remained pending; this comment is retained as history.

Original stalled review request

@codex review

Exact head: 0155e8bd89c57e1cbcafb1bec3731f9446b02b02

omry · 2026-10-23T09:24:55Z

@codex review

Exact head: 0155e8b

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0155e8bd89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…talled repository Add the preview GitHub App receiver for the first infrastructure slice. Verify webhook signatures over original bytes, enforce the 2 MB limit while streaming, and validate delivery and repository identities before a canonical metadata read. Request a Contents-read installation token for exactly the event repository. Keep this slice stateless. It performs no Check writes, workflow dispatch, dependency repair or repository writes. Add unit/native Workers tests, pinned development tooling, a dry-run CI check and operator preview instructions. Validation: 15 Worker tests with 100% line/branch/function coverage; native Workerd smoke; Wrangler dry-run bundle; 1,294 existing repository tests; Ruff check/format and Pyrefly. Live acceptance remains pending. Named GitHub App and Cloudflare targets need G-SETUP authorization, followed by real signed ping/PR deliveries and positive/negative repository-scope evidence. Local mocks and this PR do not establish hosted success. Do not start slice 2 before that proof. Related to #41, which remains parked until its work has been transferred to the smaller replacement PRs.

omry · 2026-10-23T09:50:10Z

@codex review

Exact head: 6009198

chatgpt-codex-connector · 2026-10-23T09:52:47Z

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 6009198151

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry marked this pull request as ready for review October 22, 2026 22:58

omry added approved and removed approved labels Oct 22, 2026

omry force-pushed the pr42 branch from 587cc8a to b815261 Compare October 23, 2026 08:00

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

Comment thread repair-app/worker.mjs Outdated

omry force-pushed the pr42 branch from b815261 to 0155e8b Compare October 23, 2026 08:21

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

Comment thread repair-app/worker.mjs Outdated

omry force-pushed the pr42 branch from 0155e8b to 6009198 Compare October 23, 2026 09:45

omry added the approved label Oct 23, 2026

omry mentioned this pull request Oct 23, 2026

[node-maintenance-repair/2] Show the selected batch in the native Check #43

Open

omry added this pull request to stack #44 October 23, 2026 12:06

Navigation Menu

Repository navigation

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository - #42

[node-maintenance-repair/1] Receive a signed webhook and read the installed repository#42
omry wants to merge 1 commit into
mainfrom
pr42

omry commented Oct 22, 2026 •

edited

Loading

Uh oh!

omry commented Oct 22, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

omry commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

omry commented Oct 23, 2026 •

edited

Loading

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

omry commented Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 22, 2026 •

edited

Loading

omry commented Oct 22, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

omry commented Oct 23, 2026 •

edited

Loading