docs: handoff V3 — pre-submission final + security-hardening guide#93
Conversation
… guide Captures the full session: video V2 assembly, GitHub About/Pages metadata fixes, the 5-agent pre-submission audit + cleanup (PR #92), and a dedicated, code-verified security-hardening section (SCORING_MODE=structured + JUDGE_API_TOKEN): what each flip does, the exact flip mechanism (deploy.sh:134), the demo-breaking tradeoffs, and the recommendation to keep the public demo open (disclosed + shipped opt-in). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
More reviews will be available in 44 minutes and 23 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the session handoff document to version V3 (pre-submission FINAL), detailing the finalization of the demonstration video, GitHub metadata corrections, a 5-angle parallel audit, and security hardening analysis. The review comments correctly identify minor inaccuracies in the handoff document regarding the default grader backend value and the deployment script's secret handling, both of which should be updated to match the codebase.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| | Agent Engine | `reasoningEngines/7480191458771730432` (유일 서빙, deep trace) | | ||
| | Arize AX | project `glasshat`, Space:45136 — deep trace + `glasshat-hit-at-13-gemini`(hit@13 0.6154) | | ||
| | **시연 영상** | **`~/Downloads/glasshat-final-v2.mp4`** (1920×1080·30fps·H.264·AAC·**2:41**·~20MB) ← 제출용 | | ||
| | 기본값 | `mock`/`python`/**`legacy`**/`heuristic`/`code` (데모 byte-identical, parity-preserved) | |
There was a problem hiding this comment.
The default value for repo_grader_backend in config.py is "null", not "code". Update the text to match the codebase.
| | 기본값 | `mock`/`python`/**`legacy`**/`heuristic`/`code` (데모 byte-identical, parity-preserved) | | |
| | 기본값 | `mock`/`python`/**`legacy`**/`heuristic`/`null` (데모 byte-identical, parity-preserved) | |
| | 영상 조립 스크립트(휘발성/tmp) | `/tmp/asm.sh` · `/tmp/make_v2.sh` (repo 미보존) | | ||
| | 보안 — scoring mode | `agents/src/glasshat/agents/hats.py` (legacy vs structured) · `agents/.../injection_guard.py` | | ||
| | 보안 — judge gate | `apps/api/src/glasshat/api/app.py` (`_require_judge`/`_enforce_mode`) · `packages/shared/.../config.py` | | ||
| | 프로드 배포 | `infra/deploy.sh` (유저만 `--confirm`; SCORING_MODE/JUDGE_API_TOKEN은 L134 API_ENV) | |
There was a problem hiding this comment.
In infra/deploy.sh, JUDGE_API_TOKEN is passed via API_SECRETS (L135) as a secret, not API_ENV (L134). Update the reference to reflect this.
| | 프로드 배포 | `infra/deploy.sh` (유저만 `--confirm`; SCORING_MODE/JUDGE_API_TOKEN은 L134 API_ENV) | | |
| | 프로드 배포 | `infra/deploy.sh` (유저만 `--confirm`; SCORING_MODE는 L134 API_ENV, JUDGE_API_TOKEN은 L135 API_SECRETS) | |
1 participant
Updates the session handoff to V3: full session (video V2, About/Pages fixes, pre-submission cleanup #92) + a code-verified §SEC detailing the user-gated security hardening (
SCORING_MODE=structured+JUDGE_API_TOKEN) — what each does, how to flip, the demo tradeoffs, and the keep-open recommendation.