feat(cac): enforce market CAC with certification, procurement, and leaderboard stack#23614
feat(cac): enforce market CAC with certification, procurement, and leaderboard stack#23614BrianCLong wants to merge 1 commit intomainfrom
Conversation
BrianCLong
added
the
codex
ChatGPT Codex Connector
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 17 minutes and 23 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (27)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1dedfd39b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const artifact = req.body?.artifact as CACArtifact; | ||
| const cacert = req.body?.cacert as CACertEnvelope; | ||
|
|
||
| const id = randomUUID(); | ||
| const verification = validateSubmission(id, artifact, cacert); |
There was a problem hiding this comment.
POST /submit forwards req.body?.artifact and req.body?.cacert directly into validateSubmission, but verifySubmission immediately dereferences artifact.vendor_id. If a client sends {} or null fields, this path throws before any schema rejection and returns a 500 instead of a deterministic 4xx validation response.
Useful? React with 👍 / 👎.
| const unresolvedCritical = artifact.policy_failures.some((failure) => failure.severity === 'critical'); | ||
| if (unresolvedCritical) { | ||
| return 'REJECTED'; |
There was a problem hiding this comment.
The tier assignment logic only rejects unresolved critical failures, but the new certification rules in docs/cac/CERTIFICATION.md require Silver to reject unresolved high failures and Gold to reject failures of any severity. As written, a submission with high (or even low/medium) policy failures can still be promoted to SILVER/GOLD if its scores are high enough.
Useful? React with 👍 / 👎.
| const KNOWN_KEYS: Record<string, string> = { | ||
| 'summit-cac-key-v1': 'summit-cac-public-material-v1', | ||
| }; |
There was a problem hiding this comment.
Signature verification relies on key material hard-coded in the verifier itself. Because this value is embedded in source and the expected signature is derived from it, any submitter can mint matching signatures for arbitrary payloads, which defeats the authenticity guarantee implied by CACert verification.
Useful? React with 👍 / 👎.
| if (!verification.valid) { | ||
| return res.status(400).json({ | ||
| id, | ||
| status: 'rejected', | ||
| ...verification, |
There was a problem hiding this comment.
Rejected submissions return a generated id but are never stored, so follow-up calls to GET /status/:id or GET /cacert/:id for that returned ID always 404. This breaks the registry’s own status/certificate lookup flow for the rejection cases that most need auditability.
Useful? React with 👍 / 👎.
…aderboard stack (rebase on main)
BrianCLong
force-pushed
the
codex/implement-cac-certification-and-procurement-system
branch
from
1dedfd3 to
1d02733
Compare
1 participant
Motivation
Description
docs/cac/CERTIFICATION.md(Bronze / Silver / Gold with MUST/MUST NOT requirements and rejection rules).docs/cac/procurement/includingRFP_REQUIREMENTS.md,VENDOR_QUESTIONNAIRE.md, and a machine-readableEVALUATION_SCORECARD.yaml.workflows/verify_submission.tsthat validates schema, verifies CACert signatures, recomputes reproducibility hashes, and assigns tiers deterministically.services/cac-registry/) withPOST /submit,GET /status/:id, andGET /cacert/:id, a leaderboard engine (services/leaderboard/) that publishespublic/leaderboard.json, public API endpoints (api/cac/), and demo vendor bundles indemos/vendors/to exercise Gold/Silver/Rejected flows.Testing
tsx) which failed due to missing runtime in this environment but does not affect repository artifacts.{ "agent": "codex", "task": "cac-procurement-certification", "change_class": "minor", "prompt_registry_ref": "deferred-pending-registration", "deterministic": true, "manual_override": false }Codex Task