feat(review): signal integrity — digests, classifier, airlock, batch - #16
Merged
Conversation
Add repo-free review of received packs, sample fixtures, Phase 0 installer/SDD honesty, and reviewers-first site copy. Preserve on a branch for human review — not merge-ready until claim-safety outside sandbox. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Make offline review metrics interpretable and safe on hostile packs: write payload/file digests into one-pager provenance (fingerprint includes digests so prepare rewrites), classify references once with causes, redact-then-emit airlock, and rank --batch with parent expand. Document schema v2 + assessor offline binary path. Not conformity assessment. Co-authored-by: Cursor <cursoragent@cursor.com>
Curbpack check✅ Gates green — readiness 100%
|
Co-authored-by: Cursor <cursoragent@cursor.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
curbpack reviewnow emits interpretable schema v2 metrics: reference unit (refclass:1), one state per key, unconfirmed causes (producer/extractor/genuine/external), digest self-checks against one-pager provenance.result_digest/sbom_digest/vex_digestinto provenance; fingerprint includes digests so prepare rewrites existing packs (fixes silent skip).--batchexpands parent dirs, ranks unreadable → contradicted → genuine, refuses--full.Why
Kill-test % was dominated by self-inflicted noise (missing digests, backtick junk, context-pack cache paths). Review also ate hostile input without airlock. This makes the reader metric real and safe before any cohort.
Test plan
go test ./internal/review/... ./internal/release/... ./internal/cli/...go run ./cmd/curbpack check(green)curbpack prepare-releasethencurbpack review ./review-pack --json→ digests present, P/E/G ≈ 0curbpack review --batch <parent-of-packs>ranks;--batch --fullusage errorOps checklist (required)
mainbefore mergemain(PR merge only)site/for-reviewers/)Risk / rollback
@v0.5.2)Made with Cursor