feat: enforce CAC admissibility gate and CACert pipeline#23620
feat: enforce CAC admissibility gate and CACert pipeline#23620BrianCLong wants to merge 1 commit intomainfrom
Conversation
BrianCLong
added
the
codex
ChatGPT Codex Connector
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 17 minutes and 51 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 67b9ed599c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } catch (error) { | ||
| if (!expectFailure) { | ||
| throw error; | ||
| } |
There was a problem hiding this comment.
The expectFailure branch currently swallows all thrown errors, including the intentional Expected failure but succeeded error, so the three negative demo checks can never fail this script. In run-cac-gate.mjs, a regression where an invalid bundle starts passing would still report success, which defeats the CI gate’s stated purpose of enforcing rejection of inadmissible artifacts.
Useful? React with 👍 / 👎.
| verdict: 'PASS', | ||
| admissibility_score: verdict.admissibility_score, | ||
| evidence_hash: sha256Hex(canonicalize(bundle)), | ||
| signed: true, |
There was a problem hiding this comment.
The generated CACert hard-codes signed: true even though this script never performs a signing operation. If the external signing workflow is skipped or fails, downstream systems will still treat the artifact as cryptographically signed, creating a false attestation and weakening the admissibility/certification control.
Useful? React with 👍 / 👎.
| "reproducibility_hash" | ||
| ], | ||
| "additionalProperties": false, | ||
| "properties": { |
There was a problem hiding this comment.
The schema sets additionalProperties: false but does not define decision_output, while the emitted/validated bundles include that field as required. Any consumer that validates bundles against docs/cac/cac.schema.json will reject otherwise valid artifacts, so the machine-readable contract is internally inconsistent with the implemented validator and sample bundle format.
Useful? React with 👍 / 👎.
BrianCLong
force-pushed
the
codex/bind-cac-into-ci/cd-as-enforcement-gate
branch
from
67b9ed5 to
c58eef7
Compare
1 participant
Motivation
CACert) when admissible.Description
docs/cac/CAC_SPEC_v0.1.mdanddocs/cac/cac.schema.jsonthat define required fields, determinism rules, and certification requirements.packages/core/decision-trace.tsthat canonicalizes payloads and computes a SHA-256reproducibility_hashfor reproducibility checks.packages/validators/cac-validator.tsand a portable CI validator atscripts/ci/cac-validator.mjs, including non-determinism, missing-field, and unverifiable-source checks and a Cosign signing integration hook (COSIGN_SUBJECT).cac_gatejob into.github/workflows/ci.yml, addscripts/ci/run-cac-gate.mjsto assert one passing bundle and three failing demo scenarios indemos/cac_failures/, and publish an evidence map atdocs/governance/evidence_map.yamlplus sample artifacts underartifacts/.Testing
node scripts/ci/cac-validator.mjs artifacts/sample-decision-bundle.json artifacts/cac-verdict.json artifacts/cacert.json, which returnedPASSand producedartifacts/cacert.json(success).node scripts/ci/run-cac-gate.mjs, which validated the passing bundle and asserted the three demo failure cases fail (success: passing case allowed, demos rejected).node scripts/check-boundaries.cjs, which reported no boundary violations (success).pnpm exec tsxcommand failed due to environment/corepack network restrictions, and the validator was exercised using thenode-based scripts as a fallback (environmental failure, functional fallback succeeded).Codex Task