Repository navigation
Prove authorized staging execution and Pact replay protection - #4
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abdee4fe66
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| test -n "$ARTIFACT_SHA" | ||
| test "$ARTIFACT_SHA" != "null" | ||
| jq -n --slurpfile pact /tmp/pact.json --arg artifact "$ARTIFACT_SHA" \ | ||
| '{pact:$pact[0], action:"deploy_staging", parameters:{target:"staging", artifact_sha256:$artifact}, human_approved:true}' \ |
There was a problem hiding this comment.
On automatic pull_request and push runs, the workflow unconditionally sets human_approved:true; there is no protected environment, reviewer gate, or approval-derived input anywhere in this workflow. The run therefore proves only that a caller-controlled Boolean unlocks the approval branch, not the documented claim that an explicitly human-approved action executed. Source this value from a human-controlled gate or qualify the proof as simulated approval.
Useful? React with 👍 / 👎.
| run: | | ||
| mkdir -p /tmp/igraph-live-proof | ||
| for file in /tmp/health.json /tmp/datahub-health.txt /tmp/discover.json /tmp/analyze-request.json /tmp/analyze.json /tmp/verify.json /tmp/pact.json /tmp/tampered-pact.json /tmp/tampered-request.json /tmp/tampered-response.json /tmp/expired-pact.json /tmp/expired-request.json /tmp/expired-response.json /tmp/unavailable-health.json /tmp/unavailable-response.json /tmp/igraph.log /tmp/igraph-unavailable.log; do | ||
| for file in /tmp/health.json /tmp/datahub-health.txt /tmp/discover.json /tmp/analyze-request.json /tmp/analyze.json /tmp/verify.json /tmp/pact.json /tmp/execute-request.json /tmp/execute-response.json /tmp/replay-response.json /tmp/tampered-pact.json /tmp/tampered-request.json /tmp/tampered-response.json /tmp/expired-pact.json /tmp/expired-request.json /tmp/expired-response.json /tmp/unavailable-health.json /tmp/unavailable-response.json /tmp/igraph.log /tmp/igraph-unavailable.log; do |
There was a problem hiding this comment.
The new deterministic discovery request writes its evidence to /tmp/target-discover.json, but the collector omits that file. When the linked proof artifact is used to audit the documented claim that /v1/discover found order_items with lineage, it contains only the unrelated wildcard response and cannot substantiate that specific assertion; add the target response to this collection list.
Useful? React with 👍 / 👎.
1 participant
What changed
deploy_stagingaction with explicit human approvalWhy
The existing proof demonstrated live reads and fail-closed denials, but did not exercise the positive enforcement path. This closes that evidence gap without enabling production mutation or DataHub write-back.
Safety boundary
stagingIGRAPH_ENABLE_WRITEBACK=falseValidation
GitHub Actions will run ordinary CI and the full DataHub live-proof workflow against the PR branch.