Repository navigation
v1.91.135.0 fix(cso-eval): producer artifact inventory recognizes dependency-closure file names - #3265
Merged
Conversation
|
😎 This pull request was merged. |
Contributor
E2E Evals: ✅ PASS121 executed, 0 reused rule/judge records | 0 manual accepted (unscored; no score-cache credit) | $93.34 rule/judge cost | reconcile exit: 0 Profile: pr / mode Derived dependents (scripts/pr-dependencies.ts):
Rule and judge shards
Fail-closed reconciliationSliced lane: planner → duration-packed executors → fail-closed report. Behavior cases run a pre-registered 3-trial panel (PASS at 2/3 with no contract violation); a PASS 2/3 is shown with its failed trial, never as a clean pass. Reused results retain their original provenance and expiry. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the second paid /cso runtime qualification (evaluator run 39107626021), the rails-constantize-param fixed-variant comprehensive cell failed with
REDACTION_FAILED: artifact path component 4 under "ID/ID/dependency-closures" looks like a secret. That failure counts againstmatchedCompleteMatrix,mandatoryReportsandallCoreColdStarts.Cause. Repairs reach
verifysince v1.91.123.0 (#3240). Once they do, the helper retains dependency closures as<finding id>-<before|after>-<plan hash>.json(closureStateFileinlib/cso/cli.ts).assertProducerArtifactPathaccepts a path component without redaction only when it matchesHELPER_ID_COMPONENT. That pattern allows a word prefix before hex IDs, but not a word between two of them. So the closure name went to the secret redactor, which read the 64-hex finding ID as a credential.Fix.
HELPER_ID_COMPONENTgains one alternative: exactly[a-f0-9]{64}-(before|after)-[a-f0-9]{16}.json. Any other word in that position still goes through the redactor.Test. The existing artifact-name test in
test/cso-eval.test.tsnow uses a closure name chosen so the redactor flags it. It checks that the before and after forms are accepted, and that-during-still fails with "looks like a secret".Checks:
bun run typecheck;test/cso-eval.test.ts,test/cso-eval-producer.test.tsand the module-size ratchet (74 pass).Stamped v1.91.135.0 (slot from GStack Minder).