Repository navigation
fix(requirements): validate native planning lineage - #767
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to No actionable issue remains from this review. Complete the pending hosted checks and integration authorization before merging. Pre-merge checks ·
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (12 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Title check The title uses the preferred Conventional Commits prefix fix:and accurately summarizes the native planning lineage validation change.Description check The description is detailed and covers the problem, issue reference, OpenSpec traceability, contract impact, testing evidence, environment, quality gates, pending integration work, and rollback contex…
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 5 files. (12 skipped: 12 unsupported.)
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
-
📝 Generate docstrings 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
SpecFact CLI Validation Report✅ All validations passed! |
|
SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1 |
SpecFact CLI Validation Report✅ All validations passed! |
Keep protected proof ancestry anchored to the review base. Validate authenticated planning ancestry against the candidate instead. Native stacks project dev as the review base, so the former assertion blocked valid planning before independent reconciliation. Both real workflow controls fail before this patch and pass afterward. Preserve root authentication, source authority and every required gate. Refs #760
|
SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1 |
SpecFact CLI Validation Report✅ All validations passed! |
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. So far, Strix has reviewed 48 pull requests across this workspace. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
# Description Module #481 remains In Progress, while paired #483 remains Todo as checked on 12 October 2026. Preserve the newer proposal already on dev and defer core runtime adoption until its signed module contract is implemented. **Refs** #742 **Contract References**: Planning-only contract research and dependency reconciliation. No future runtime execution or delivery completion is claimed. ## Type of Change - [x] 📚 Documentation update ## Contract-First Testing Evidence Strict OpenSpec and local planned Requirements validate the proposal. Existing completed evidence is preserved with its original scope. Runtime adoption requires its own spec, actual failing-first tests, implementation and passing exact-head evidence. ## How Has This Been Tested? Validate source proposals, current repository contents and paired implementation readiness. Prerequisites [#761](#761) and [#767](#767) are merged at protected dev `c6af68a0`. Signed #743 head `4d1e7429` follows signed security parent `57f51829`, whose [native Requirements](https://github.com/nold-ai/specfact-cli/actions/runs/38306990823) is verified with no findings and whose exact-head authority passes. Strict selected OpenSpec, documentation validation and unchanged-provider planned Requirements pass locally: one source, planned maturity, no findings. Hosted producer/execution/final verdict must independently authenticate inherited root proof with scoped tokens; those current-head checks remain pending. ## Checklist - [x] Verify planning scope and preserve completed work - [x] Keep deferred runtime tasks unchecked - [x] Signed branch history and owner-authorized exact-head grants - [x] Protected prerequisite integration and signed restacking onto the validated root - [ ] Final exact-head Requirements, required CI and review closure ## Quality Gates Status Current signed head: `4d1e7429c2dfb69e9d33a93bf554aed8aae6affd`. Normal applicable hooks passed and GitHub signature verification precedes the authorized new djm81 grant. No required execution, signature, authority, review or security gate is bypassed. Final current-head checks and review remain required. ## Stack Native [stack #759](https://github.com/nold-ai/specfact-cli/pull/759): `dev ← #719 security implementation ← #743 workflow planning ← #751 roadmap planning`. Leave all three stack PRs unmerged for owner review. The earlier planning consumer ancestry failure is corrected by protected #767. Current hosted consumers must independently validate that correction with the fresh root proof; no gate or trust boundary is weakened. Independent Code Review correctly rejected the planned receipt as non-final execution proof (run 38303860784). The reviewed local protective follow-up preserves full protected-dev review and authentic finalized root proof; exact acceptance, native proof and protected integration remain pending. Current inherited review gates stay enforced; this PR is not yet ready to merge.
1 participant
Description
Fix native-stack Requirements execution that rejects valid planning children before reconciliation. Native CI exposes
devas the review base even when the planning parent is newer. Anchor protected proof ancestry to the immutable review base, and independently require authenticated planning ancestry to reach the candidate. Validate both commit identities explicitly.Refs #760
OpenSpec: fix-native-planning-lineage.
Contract References: Root identity, successful check/run authentication, protected control-object equality, signatures, member authority, closed planning scope and complete plan/context equality remain enforced. No provider pin, maturity rule, required gate or threshold is changed. The two direct ancestry checks keep distinct purposes explicit without introducing another helper or bypass path.
Type of Change
Contract-First Testing Evidence
Protected baseline:
c4ee5be8457f69848bf9bc2150ebc3df56b52d4fafter #761. Signed spec6e5c7c6fprecedes signed authored064040e0and signed implementation208f1a69.Owner djm81 accepted exact two-selector mapping
sha256:8f07b2b300326ff199daed499240b6875d947c6431518ececf52fec3b3a160a0; the genuine record is committed. Native authored RED, artifact11769210296, has two real failures, zero errors/skips/findings, gate pass and red maturity. The wrong-job-key draft fixture is discarded. Workflow implementation follows retained native RED; test bytes, mapping and acceptance remain unchanged. The unchanged provenance validator passes for literal final SHA208f1a69674031f7be986f2d332571f4b23157ac.How Has This Been Tested?
0.55.8bugfix declarations, root lock version and generated promotion fixture are synchronized; frozen export payload matches the parent.Test Environment
Dedicated frozen CPython 3.12 worktree and reviewed immutable module/documentation fixtures. Hosted Python 3.11–3.13 delivery and independent Requirements consumers remain mandatory on the final signed head.
Checklist
Quality Gates Status
Current signed head:
208f1a69674031f7be986f2d332571f4b23157ac. Normal hooks and exact-SHA retained-proof provenance pass. No fabricated acceptance, rewritten report, disabled analyzer, relaxed trust boundary or skipped required gate. All required current-head checks pass. Native final run 38299339592 reports verified maturity with no findings; authority run 38299339668 passes. CodeRabbit explicitly covers 208f1a6 and reports no actionable findings. GitHub reports CLEAN/MERGEABLE, with zero unresolved threads. Mapping/grant approval does not authorize merging.Stack
Unblocks native stack #759:
dev ← #719 security implementation ← #743 workflow planning ← #751 roadmap planning. Leave all three unmerged. Protected workflow object equality intentionally blocks stale parent controls; after reviewed integration, re-author current-base #719 proof and restack both planning children. Synchronize pending #719 to the next available patch if this protected0.55.8metadata merges. Deferred module/runtime proposals remain planning.Rollback retains captured target heads and genuine proof, restores the coherent workflow/version patch, and uses exact force-with-lease protection for any branch restoration. Archive completed OpenSpec only after merge and follow-up validation.