D3.2: bind account evidence to verified image layers by omry · Pull Request #292 · omry/reploy

omry · 2026-10-27T13:48:43Z

Authenticate image identity sources by exact immutable config digest, Linux platform, ordered full-stream layer DiffIDs and locked RootFSSubject. Project the three account files in manifest order using bounded streaming summaries, then verify relationships through D3.1. Reuse the pinned image-save transport, outer parser and framing checks while preserving healthcheck behavior. Reject unsupported links, whiteouts, sparse/framing ambiguity and resource-limit violations. Policy-bearing execution remains inhibited; final-image lock integration remains D4.1.

Validation: focused source/health/identity tests and coverage, affected vet, Linux CLI build, Docker-skipped CLI smoke and the qualified complete source suite pass. The known unchanged WSL tmpfs test is excluded. Fresh independent Sol review is clean with zero findings. No live-engine or runtime qualification is claimed. Exact-head CI and PR approval remain separate required gates.

omry · 2026-10-27T13:52:34Z

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON)

{
  "approval": {
    "candidate_revision_fingerprint": "sha256:548b13d761dd412f67caf010461cd380590500cf2bf3f36475202d618788838c",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:146b305ae1732ad14e8c5eef04d4f5ec47db383706172645f8cf324fde970166",
          "closure_identity": "sha256:185e50870280fc48e9657371149b02de34f241a98fdcbebfa24ab554375cfb0b",
          "document_identity": "sha256:fee62dbad94f6815fdccc1920a7180864dfef8e5ad9238e0fdee689a87db5573",
          "sidecar_identity": "sha256:ef591acea1e1d83645b8d05a175752075b4284d750a5cf289cfa7e1ff8f1180c"
        },
        {
          "baseline_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "closure_identity": "sha256:185e50870280fc48e9657371149b02de34f241a98fdcbebfa24ab554375cfb0b",
          "document_identity": "sha256:0339661e75fd610092b903a1352c65ef98de35c4963c613923f0c9852193c597",
          "sidecar_identity": "sha256:4dfd0c546d6d2e562cc7a566336696f9064ebe740c2ec04774e9a9fdceef5437"
        },
        {
          "baseline_identity": "sha256:a68d5bec4bca25c403f41460bd202236954d42c9524b3fe50a7210e0af055387",
          "closure_identity": "sha256:185e50870280fc48e9657371149b02de34f241a98fdcbebfa24ab554375cfb0b",
          "document_identity": "sha256:ba63be4406185d978f1794a3c22b2598a80288a0cff47ce018ff1e8ef745870c",
          "sidecar_identity": "sha256:7e9de65c8d26ece8f101b0f61307340bf736ab67be0f959e23d611a3492566f4"
        },
        {
          "closure_identity": "sha256:185e50870280fc48e9657371149b02de34f241a98fdcbebfa24ab554375cfb0b",
          "document_identity": "sha256:779702b5fa170b026d6a04df2aeaa97ce006b96bcba41897ca39babd8b956e83",
          "sidecar_identity": "sha256:63430091146b6ed1c3c6db0e08608fc1d94e0a09e176adeedb8c3a2d5da56bbf"
        }
      ],
      "candidate_revision_fingerprint": "sha256:548b13d761dd412f67caf010461cd380590500cf2bf3f36475202d618788838c",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122248882118
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122239745556
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122239770257
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122239772236
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122239770980
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122239770732
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122239771032
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122239771049
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122239771223
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:41875827daf0220a35ed61b735600234eb58c4e4dfe27e0c46078a659e3c06d8",
      "operation_identity": "sha256:5c1ee153d5177d775f4840d53f55279abe98b8ab9b6f3c17f6f9bdb2819e3bfb",
      "review_request": {
        "body_digest": "sha256:ad3f708c5fa3167765825c979123e6c5d4c36e83a3fb344d7d2dd37ca35cf393",
        "id": 6444370456
      },
      "review_result": {
        "body_digest": "sha256:39149bd05df56784c9adec4060abc1fc069729df8fdf9488fb662b5e3a45f251",
        "id": 6448676714
      }
    },
    "evidence_fingerprint": "sha256:6ad466cede5595065788c8a34a76252f27c407c5b2070597c9f30bece95917ff",
    "head_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
    "operation_identity": "sha256:5c1ee153d5177d775f4840d53f55279abe98b8ab9b6f3c17f6f9bdb2819e3bfb",
    "review_request_id": 6444370456,
    "review_result_id": 6448676714,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:548b13d761dd412f67caf010461cd380590500cf2bf3f36475202d618788838c",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 122248882118
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 122239745556
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 122239770257
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 122239772236
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 122239770980
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 122239770732
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 122239771032
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 122239771049
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 122239771223
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "name": "Bash native evidence checks",
          "reason": "missing",
          "status": "pending"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122227842799,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122227842799"
        },
        {
          "name": "Linux CI checks",
          "run_id": 122227832801,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832801"
        },
        {
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122227832798,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832798"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122227833145,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227833145"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122227832872,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832872"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122227832756,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832756"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122227832820,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832820"
        },
        {
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122227832993,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/40515369860/job/122227832993"
        }
      ],
      "head_sha": "2bb2d51cd04eee38c1f021d36a65e47316401875",
      "id": "sha256:91af4273b13727562e136d4c6f85be78829d4a2558853b805780fd3c392e22e2",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "pending"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 122248882118,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122248882118"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 122239745556,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/122239745556"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 122239770257,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239770257"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 122239772236,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239772236"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 122239770980,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239770980"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 122239770732,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239770732"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 122239771032,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239771032"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 122239771049,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239771049"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 122239771223,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/40518807050/job/122239771223"
        }
      ],
      "head_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "id": "sha256:b6f1932bcb39514ffdcec476ba612904b7f0ddb966bc8286d1f67e835a1b0f9a",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "current-slice-defect",
      "disposition": "fixed",
      "evidence": [
        "/home/omry/.local/state/awd/reploy-D-implementation-run_1wza9wb55tpx4p8t0by67kyc6k/D3.2-PR-repeated-layer-analysis.json",
        "https://github.com/omry/reploy/pull/292#discussion_r4389475488",
        "/home/omry/.local/state/awd/reploy-D-implementation-run_1wza9wb55tpx4p8t0by67kyc6k/D3.2-PR-fix-review.json",
        "/home/omry/.local/state/awd/reploy-D-implementation-run_1wza9wb55tpx4p8t0by67kyc6k/D3.2-R3-pr-local-validation-receipt.json",
        "https://github.com/omry/reploy/pull/292#discussion_r4389721420"
      ],
      "id": "review-comment:4389475488",
      "invariant": "Verify each ordered manifest position against its corresponding immutable DiffID and apply supported replacements in exact manifest order. Reusing an authenticated member is not a duplicate archive entry.",
      "proposed_authorized_paths": [
        "internal/dockerdeploy/image_identity_archive.go",
        "internal/dockerdeploy/image_identity_archive_test.go"
      ],
      "rationale": "The seen-name guard rejects supported repeated digest positions. Existing RootFSSubject preserves repeated positions; Docker exporter deduplicates saved layer blobs. Removing this guard retains every positional digest and all bounds; no design or authority change.",
      "severity": "medium",
      "source_comment_id": 4389475488,
      "source_review_id": 5668114507,
      "source_reviewer": "gitar-bot",
      "source_url": "https://github.com/omry/reploy/pull/292#discussion_r4389475488",
      "status": "resolved",
      "thread_id": "PRRT_kwDOTFQCkM6wtlS_"
    }
  ],
  "pr": {
    "base_ref": "pr291",
    "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
    "body_digest": "sha256:60f9e6773967839c1a6ce5103630db02b1e91d8f8664a44647f756c9e5238457",
    "body_identity_version": 2,
    "diff_digest": "sha256:5b66c0767b4aa3b9561b51cc53928527b8b7086170629e9a75b60166975fdd66",
    "head_ref": "pr292",
    "head_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
    "pr": 292,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:078e63e84d432c2aad03120ca30e40ec4572a8970e6bf6be9d5008608a30f435",
        "path": "docs/MULTI_IDENTITY_D_DESIGN.md"
      },
      {
        "digest": "sha256:3ef44a7a0be43648f5df1faad39b16101978662c58c87d6fa8e7409093a58fe9",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:fe188bb8a80f7f235e99b023283749a3a9e3172e4adf70b70b495d80e50e9218",
        "path": "docs/MULTI_IDENTITY_MAIL_RECONCILIATION.md"
      },
      {
        "digest": "sha256:b049714f4a85d0f3fb204615897374377690564627bfcdd03e50c945fb042826",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      }
    ],
    "title_digest": "sha256:61aa6ded79231add5cf821f0923773385c9ffc0cb0e0d7423ba3f98700332298"
  },
  "record_version": 8,
  "review_observations": [
    {
      "base_ref": "pr291",
      "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
      "evidence_digest": "sha256:ce853b165dc6e2a8728c963b44d5f42f668518bc5e4d431dc0b54a2f7fd371b6",
      "head_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "id": "sha256:75142992a6e653860068458702963aa7ebf4afcce0e7e83ec56febdf64880825",
      "poll": {
        "completed_at": "2026-10-27T16:58:07.673Z",
        "elapsed_seconds": 41.544,
        "observations": 2,
        "started_at": "2026-10-27T16:57:26.130Z"
      },
      "request_comment_id": 6444370456,
      "status": "timeout"
    }
  ],
  "review_requests": [
    {
      "base_established_at": "2026-10-27T13:48:46Z",
      "base_ref": "pr291",
      "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
      "body_digest": "sha256:f47f9143f5fc06d7786f52988bf3346967df117a0046523daf118f2f21dc670d",
      "created_at": "2026-10-27T13:54:43Z",
      "head_sha": "2bb2d51cd04eee38c1f021d36a65e47316401875",
      "id": 6443701897,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-27T13:48:46Z",
      "base_ref": "pr291",
      "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
      "body_digest": "sha256:ad3f708c5fa3167765825c979123e6c5d4c36e83a3fb344d7d2dd37ca35cf393",
      "created_at": "2026-10-27T14:17:13Z",
      "head_sha": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "id": 6444370456,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr291",
      "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
      "body_digest": "sha256:1ac6f3a67f80bd50475143658a5749ce34be5f37f364b1bcd3c545ed9dfaaa3f",
      "commit_id": "2bb2d51cd04eee38c1f021d36a65e47316401875",
      "id": 6443748790,
      "inline_message_ids": [],
      "request_comment_id": 6443701897,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-27T13:56:10Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6wtlS_"
      ]
    },
    {
      "base_ref": "pr291",
      "base_sha": "6dedcb9e9f42a2d5b3ed3b60eb9a4bb164bda27c",
      "body_digest": "sha256:39149bd05df56784c9adec4060abc1fc069729df8fdf9488fb662b5e3a45f251",
      "commit_id": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "id": 6448676714,
      "inline_message_ids": [],
      "request_comment_id": 6444370456,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-27T17:21:29Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:548b13d761dd412f67caf010461cd380590500cf2bf3f36475202d618788838c",
  "rounds": [
    {
      "applied_fix_paths": [
        "internal/dockerdeploy/image_identity_archive.go",
        "internal/dockerdeploy/image_identity_archive_test.go"
      ],
      "disposition_changes": [
        "review-comment:4389475488"
      ],
      "effective_diff_digest": "sha256:5b66c0767b4aa3b9561b51cc53928527b8b7086170629e9a75b60166975fdd66",
      "finding_ids": [
        "review-comment:4389475488"
      ],
      "invariants": [
        "Each ordered manifest position hashes to its corresponding config DiffID.",
        "Repeated authenticated blobs apply in manifest order; duplicate physical archive members remain invalid.",
        "Immutable RootFSSubject, bounds and execution inhibition remain."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/dockerdeploy/image_identity_archive.go",
        "internal/dockerdeploy/image_identity_archive_test.go"
      ],
      "resulting_head": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "review_observation_id": null,
      "review_request_id": 6443701897,
      "review_result_id": 6443748790,
      "reviewed_head": "2bb2d51cd04eee38c1f021d36a65e47316401875",
      "root_cause": "The ordered projection incorrectly treated repeated manifest references as duplicate archive members.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:5b66c0767b4aa3b9561b51cc53928527b8b7086170629e9a75b60166975fdd66",
      "finding_ids": [],
      "invariants": [
        "A pending remote review cannot grant approval.",
        "Preserve exact candidate, all prior findings and cumulative retry count."
      ],
      "outcome": "timeout",
      "proposed_fix_paths": [],
      "resulting_head": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "review_observation_id": "sha256:75142992a6e653860068458702963aa7ebf4afcce0e7e83ec56febdf64880825",
      "review_request_id": 6444370456,
      "review_result_id": null,
      "reviewed_head": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "root_cause": "External review still reports running after more than two hours; no attributable current-head result. External cause is unverified. This is a non-result observation, not code convergence.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:5b66c0767b4aa3b9561b51cc53928527b8b7086170629e9a75b60166975fdd66",
      "finding_ids": [],
      "invariants": [
        "Exact immutable config, ordered positional DiffIDs and RootFSSubject authenticate the source.",
        "Bounded account-path projection preserves order, supported repeated references and fixed redaction.",
        "All exact-head required jobs and qualified local validation pass; mapped payload execution remains inhibited."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "review_observation_id": null,
      "review_request_id": 6444370456,
      "review_result_id": 6448676714,
      "reviewed_head": "6a8e9c992ee93ac4e719c9967c437fc2eb61b83c",
      "root_cause": "No new finding in the completed current-head review; prior repeated-reference defect truth-fixed and its thread resolved. Recovery preserves the timed-out attribution window.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

chatgpt-codex-connector · 2026-10-27T13:53:24Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T17:21:31.113166Z	`6a8e9c9`	Manual request
🔒 Security Review	✅ Completed 2026-10-27T13:56:03.891087Z	`2bb2d51`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

omry · 2026-10-27T13:54:43Z

@codex review

Exact head: 2bb2d51

chatgpt-codex-connector · 2026-10-27T13:56:10Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 2bb2d51cd0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Authenticate image identity sources by exact immutable config digest, Linux platform, ordered full-stream layer DiffIDs and locked RootFSSubject. Project the three account files in manifest order using bounded streaming summaries, then verify relationships through D3.1. Reuse the pinned image-save transport, outer parser and framing checks while preserving healthcheck behavior. Reject unsupported links, whiteouts, sparse/framing ambiguity and resource-limit violations. Policy-bearing execution remains inhibited; final-image lock integration remains D4.1. Validation: focused source/health/identity tests and coverage, affected vet, Linux CLI build, Docker-skipped CLI smoke and the qualified complete source suite pass. The known unchanged WSL tmpfs test is excluded. Fresh independent Sol review is clean with zero findings. No live-engine or runtime qualification is claimed. Exact-head CI and PR approval remain separate required gates.

gitar-bot · 2026-10-27T14:12:32Z

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adds Docker-layer account-file evidence bound to config and RootFS digests; parsing or ordering errors could misstate image identity, though policy execution remains inhibited.

Binds account evidence to verified image layers by authenticating image identity via exact config digest, Linux platform, ordered layer DiffIDs and RootFSSubject, with bounded streaming summaries and D3.1 relationship checks. Repeated layer DiffIDs are now always rejected, addressing that finding. No open issues remain.

✅ 1 closed

✅ Edge Case: Images that repeat a layer DiffID are always rejected

📄 internal/dockerdeploy/image_identity_archive.go:88-98 📄 internal/dockerdeploy/image_identity_archive_test.go:157
readDockerImageIdentityArchiveV1 fails whenever a manifest Layers entry shows up more than once (seen[name], image_identity_archive.go:91). An image can legitimately list the same DiffID twice in rootfs.diff_ids. The common case is the empty layer sha256:5f70bf18… from no-op RUN, WORKDIR or COPY steps. docker image save writes that blob once and points to it from each manifest position. The outer parser also rejects duplicate member names (docker_image_health.go:249), so the only way an archive can represent those positions is by repeating the name. As a result, an otherwise valid image with a repeated layer cannot produce identity evidence. The check also requires len(ordered) == len(diffIDs), so there is no fallback. Fix: allow a repeated name as long as layer.digest == diffIDs[index] at every position. Re-applying the same layer's files in order matches overlay semantics. Then update the "duplicate layer" test to cover the legitimate case and keep the mismatched-digest case rejected.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

omry · 2026-10-27T14:17:13Z

@codex review

Exact head: 6a8e9c9

omry · 2026-10-27T17:20:03Z

@codex review

Exact head: 6a8e9c9

chatgpt-codex-connector · 2026-10-27T17:21:29Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 6a8e9c992e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry changed the base branch from main to pr291 October 27, 2026 13:48

omry added this pull request to stack #287 October 27, 2026 13:49

gitar-bot Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread internal/dockerdeploy/image_identity_archive.go Resolved

omry marked this pull request as ready for review October 27, 2026 13:53

omry force-pushed the pr292 branch from 2bb2d51 to 6a8e9c9 Compare October 27, 2026 14:11

omry added the approved PR reviewed and approved label Oct 27, 2026

This was referenced Oct 27, 2026

D4.1: bind identity policy evidence to finalized builds #293

Merged

D4.2: validate declared identities against retained reservations #294

Merged

omry merged commit fc40735 into main Oct 28, 2026
9 checks passed

omry deleted the pr292 branch October 28, 2026 04:55

Navigation Menu

Repository navigation

D3.2: bind account evidence to verified image layers - #292

D3.2: bind account evidence to verified image layers#292
omry merged 1 commit into
pr291from
pr292

omry commented Oct 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

omry commented Oct 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

gitar-bot Bot commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

omry commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

omry commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

gitar-bot Bot commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

omry commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

omry commented Oct 27, 2026 •

edited

Loading

omry commented Oct 27, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading